diff --git a/src/Doc/Classes/Classes.thy b/src/Doc/Classes/Classes.thy
--- a/src/Doc/Classes/Classes.thy
+++ b/src/Doc/Classes/Classes.thy
@@ -1,631 +1,631 @@
 theory Classes
 imports Main Setup
 begin
 
 section \<open>Introduction\<close>
 
 text \<open>
-  Type classes were introduced by Wadler and Blott @{cite wadler89how}
+  Type classes were introduced by Wadler and Blott \<^cite>\<open>wadler89how\<close>
   into the Haskell language to allow for a reasonable implementation
   of overloading\footnote{throughout this tutorial, we are referring
   to classical Haskell 1.0 type classes, not considering later
   additions in expressiveness}.  As a canonical example, a polymorphic
   equality function \<open>eq :: \<alpha> \<Rightarrow> \<alpha> \<Rightarrow> bool\<close> which is overloaded on
   different types for \<open>\<alpha>\<close>, which is achieved by splitting
   introduction of the \<open>eq\<close> function from its overloaded
   definitions by means of \<open>class\<close> and \<open>instance\<close>
   declarations: \footnote{syntax here is a kind of isabellized
   Haskell}
 
   \begin{quote}
 
   \<^noindent> \<open>class eq where\<close> \\
   \hspace*{2ex}\<open>eq :: \<alpha> \<Rightarrow> \<alpha> \<Rightarrow> bool\<close>
 
   \<^medskip>\<^noindent> \<open>instance nat :: eq where\<close> \\
   \hspace*{2ex}\<open>eq 0 0 = True\<close> \\
   \hspace*{2ex}\<open>eq 0 _ = False\<close> \\
   \hspace*{2ex}\<open>eq _ 0 = False\<close> \\
   \hspace*{2ex}\<open>eq (Suc n) (Suc m) = eq n m\<close>
 
   \<^medskip>\<^noindent> \<open>instance (\<alpha>::eq, \<beta>::eq) pair :: eq where\<close> \\
   \hspace*{2ex}\<open>eq (x1, y1) (x2, y2) = eq x1 x2 \<and> eq y1 y2\<close>
 
   \<^medskip>\<^noindent> \<open>class ord extends eq where\<close> \\
   \hspace*{2ex}\<open>less_eq :: \<alpha> \<Rightarrow> \<alpha> \<Rightarrow> bool\<close> \\
   \hspace*{2ex}\<open>less :: \<alpha> \<Rightarrow> \<alpha> \<Rightarrow> bool\<close>
 
   \end{quote}
 
   \<^noindent> Type variables are annotated with (finitely many) classes;
   these annotations are assertions that a particular polymorphic type
   provides definitions for overloaded functions.
 
   Indeed, type classes not only allow for simple overloading but form
   a generic calculus, an instance of order-sorted algebra
-  @{cite "nipkow-sorts93" and "Nipkow-Prehofer:1993" and "Wenzel:1997:TPHOL"}.
+  \<^cite>\<open>"nipkow-sorts93" and "Nipkow-Prehofer:1993" and "Wenzel:1997:TPHOL"\<close>.
 
   From a software engineering point of view, type classes roughly
   correspond to interfaces in object-oriented languages like Java; so,
   it is naturally desirable that type classes do not only provide
   functions (class parameters) but also state specifications
   implementations must obey.  For example, the \<open>class eq\<close>
   above could be given the following specification, demanding that
   \<open>class eq\<close> is an equivalence relation obeying reflexivity,
   symmetry and transitivity:
 
   \begin{quote}
 
   \<^noindent> \<open>class eq where\<close> \\
   \hspace*{2ex}\<open>eq :: \<alpha> \<Rightarrow> \<alpha> \<Rightarrow> bool\<close> \\
   \<open>satisfying\<close> \\
   \hspace*{2ex}\<open>refl: eq x x\<close> \\
   \hspace*{2ex}\<open>sym: eq x y \<longleftrightarrow> eq x y\<close> \\
   \hspace*{2ex}\<open>trans: eq x y \<and> eq y z \<longrightarrow> eq x z\<close>
 
   \end{quote}
 
   \<^noindent> From a theoretical point of view, type classes are
   lightweight modules; Haskell type classes may be emulated by SML
-  functors @{cite classes_modules}.  Isabelle/Isar offers a discipline
+  functors \<^cite>\<open>classes_modules\<close>.  Isabelle/Isar offers a discipline
   of type classes which brings all those aspects together:
 
   \begin{enumerate}
     \item specifying abstract parameters together with
        corresponding specifications,
     \item instantiating those abstract parameters by a particular
        type
     \item in connection with a ``less ad-hoc'' approach to overloading,
     \item with a direct link to the Isabelle module system:
-      locales @{cite "kammueller-locales"}.
+      locales \<^cite>\<open>"kammueller-locales"\<close>.
   \end{enumerate}
 
   \<^noindent> Isar type classes also directly support code generation in
   a Haskell like fashion. Internally, they are mapped to more
-  primitive Isabelle concepts @{cite "Haftmann-Wenzel:2006:classes"}.
+  primitive Isabelle concepts \<^cite>\<open>"Haftmann-Wenzel:2006:classes"\<close>.
 
   This tutorial demonstrates common elements of structured
   specifications and abstract reasoning with type classes by the
   algebraic hierarchy of semigroups, monoids and groups.  Our
-  background theory is that of Isabelle/HOL @{cite "isa-tutorial"}, for
+  background theory is that of Isabelle/HOL \<^cite>\<open>"isa-tutorial"\<close>, for
   which some familiarity is assumed.
 \<close>
 
 section \<open>A simple algebra example \label{sec:example}\<close>
 
 subsection \<open>Class definition\<close>
 
 text \<open>
   Depending on an arbitrary type \<open>\<alpha>\<close>, class \<open>semigroup\<close> introduces a binary operator \<open>(\<otimes>)\<close> that is
   assumed to be associative:
 \<close>
 
 class %quote semigroup =
   fixes mult :: "\<alpha> \<Rightarrow> \<alpha> \<Rightarrow> \<alpha>"    (infixl "\<otimes>" 70)
   assumes assoc: "(x \<otimes> y) \<otimes> z = x \<otimes> (y \<otimes> z)"
 
 text \<open>
   \<^noindent> This @{command class} specification consists of two parts:
   the \qn{operational} part names the class parameter (@{element
   "fixes"}), the \qn{logical} part specifies properties on them
   (@{element "assumes"}).  The local @{element "fixes"} and @{element
   "assumes"} are lifted to the theory toplevel, yielding the global
   parameter @{term [source] "mult :: \<alpha>::semigroup \<Rightarrow> \<alpha> \<Rightarrow> \<alpha>"} and the
   global theorem @{fact "semigroup.assoc:"}~@{prop [source] "\<And>x y z ::
   \<alpha>::semigroup. (x \<otimes> y) \<otimes> z = x \<otimes> (y \<otimes> z)"}.
 \<close>
 
 
 subsection \<open>Class instantiation \label{sec:class_inst}\<close>
 
 text \<open>
   The concrete type \<^typ>\<open>int\<close> is made a \<^class>\<open>semigroup\<close> instance
   by providing a suitable definition for the class parameter \<open>(\<otimes>)\<close> and a proof for the specification of @{fact assoc}.  This is
   accomplished by the @{command instantiation} target:
 \<close>
 
 instantiation %quote int :: semigroup
 begin
 
 definition %quote
   mult_int_def: "i \<otimes> j = i + (j::int)"
 
 instance %quote proof
   fix i j k :: int have "(i + j) + k = i + (j + k)" by simp
   then show "(i \<otimes> j) \<otimes> k = i \<otimes> (j \<otimes> k)"
     unfolding mult_int_def .
 qed
 
 end %quote
 
 text \<open>
   \<^noindent> @{command instantiation} defines class parameters at a
   particular instance using common specification tools (here,
   @{command definition}).  The concluding @{command instance} opens a
   proof that the given parameters actually conform to the class
   specification.  Note that the first proof step is the @{method
   standard} method, which for such instance proofs maps to the @{method
   intro_classes} method.  This reduces an instance judgement to the
   relevant primitive proof goals; typically it is the first method
   applied in an instantiation proof.
 
   From now on, the type-checker will consider \<^typ>\<open>int\<close> as a \<^class>\<open>semigroup\<close> automatically, i.e.\ any general results are immediately
   available on concrete instances.
 
   \<^medskip> Another instance of \<^class>\<open>semigroup\<close> yields the natural
   numbers:
 \<close>
 
 instantiation %quote nat :: semigroup
 begin
 
 primrec %quote mult_nat where
   "(0::nat) \<otimes> n = n"
   | "Suc m \<otimes> n = Suc (m \<otimes> n)"
 
 instance %quote proof
   fix m n q :: nat 
   show "m \<otimes> n \<otimes> q = m \<otimes> (n \<otimes> q)"
     by (induct m) auto
 qed
 
 end %quote
 
 text \<open>
   \<^noindent> Note the occurrence of the name \<open>mult_nat\<close> in the
   primrec declaration; by default, the local name of a class operation
   \<open>f\<close> to be instantiated on type constructor \<open>\<kappa>\<close> is
   mangled as \<open>f_\<kappa>\<close>.  In case of uncertainty, these names may be
   inspected using the @{command "print_context"} command.
 \<close>
 
 subsection \<open>Lifting and parametric types\<close>
 
 text \<open>
   Overloaded definitions given at a class instantiation may include
   recursion over the syntactic structure of types.  As a canonical
   example, we model product semigroups using our simple algebra:
 \<close>
 
 instantiation %quote prod :: (semigroup, semigroup) semigroup
 begin
 
 definition %quote
   mult_prod_def: "p\<^sub>1 \<otimes> p\<^sub>2 = (fst p\<^sub>1 \<otimes> fst p\<^sub>2, snd p\<^sub>1 \<otimes> snd p\<^sub>2)"
 
 instance %quote proof
   fix p\<^sub>1 p\<^sub>2 p\<^sub>3 :: "\<alpha>::semigroup \<times> \<beta>::semigroup"
   show "p\<^sub>1 \<otimes> p\<^sub>2 \<otimes> p\<^sub>3 = p\<^sub>1 \<otimes> (p\<^sub>2 \<otimes> p\<^sub>3)"
     unfolding mult_prod_def by (simp add: assoc)
 qed      
 
 end %quote
 
 text \<open>
   \<^noindent> Associativity of product semigroups is established using
   the definition of \<open>(\<otimes>)\<close> on products and the hypothetical
   associativity of the type components; these hypotheses are
   legitimate due to the \<^class>\<open>semigroup\<close> constraints imposed on the
   type components by the @{command instance} proposition.  Indeed,
   this pattern often occurs with parametric types and type classes.
 \<close>
 
 
 subsection \<open>Subclassing\<close>
 
 text \<open>
   We define a subclass \<open>monoidl\<close> (a semigroup with a left-hand
   neutral) by extending \<^class>\<open>semigroup\<close> with one additional
   parameter \<open>neutral\<close> together with its characteristic property:
 \<close>
 
 class %quote monoidl = semigroup +
   fixes neutral :: "\<alpha>" ("\<one>")
   assumes neutl: "\<one> \<otimes> x = x"
 
 text \<open>
   \<^noindent> Again, we prove some instances, by providing suitable
   parameter definitions and proofs for the additional specifications.
   Observe that instantiations for types with the same arity may be
   simultaneous:
 \<close>
 
 instantiation %quote nat and int :: monoidl
 begin
 
 definition %quote
   neutral_nat_def: "\<one> = (0::nat)"
 
 definition %quote
   neutral_int_def: "\<one> = (0::int)"
 
 instance %quote proof
   fix n :: nat
   show "\<one> \<otimes> n = n"
     unfolding neutral_nat_def by simp
 next
   fix k :: int
   show "\<one> \<otimes> k = k"
     unfolding neutral_int_def mult_int_def by simp
 qed
 
 end %quote
 
 instantiation %quote prod :: (monoidl, monoidl) monoidl
 begin
 
 definition %quote
   neutral_prod_def: "\<one> = (\<one>, \<one>)"
 
 instance %quote proof
   fix p :: "\<alpha>::monoidl \<times> \<beta>::monoidl"
   show "\<one> \<otimes> p = p"
     unfolding neutral_prod_def mult_prod_def by (simp add: neutl)
 qed
 
 end %quote
 
 text \<open>
   \<^noindent> Fully-fledged monoids are modelled by another subclass,
   which does not add new parameters but tightens the specification:
 \<close>
 
 class %quote monoid = monoidl +
   assumes neutr: "x \<otimes> \<one> = x"
 
 instantiation %quote nat and int :: monoid 
 begin
 
 instance %quote proof
   fix n :: nat
   show "n \<otimes> \<one> = n"
     unfolding neutral_nat_def by (induct n) simp_all
 next
   fix k :: int
   show "k \<otimes> \<one> = k"
     unfolding neutral_int_def mult_int_def by simp
 qed
 
 end %quote
 
 instantiation %quote prod :: (monoid, monoid) monoid
 begin
 
 instance %quote proof 
   fix p :: "\<alpha>::monoid \<times> \<beta>::monoid"
   show "p \<otimes> \<one> = p"
     unfolding neutral_prod_def mult_prod_def by (simp add: neutr)
 qed
 
 end %quote
 
 text \<open>
   \<^noindent> To finish our small algebra example, we add a \<open>group\<close> class with a corresponding instance:
 \<close>
 
 class %quote group = monoidl +
   fixes inverse :: "\<alpha> \<Rightarrow> \<alpha>"    ("(_\<div>)" [1000] 999)
   assumes invl: "x\<div> \<otimes> x = \<one>"
 
 instantiation %quote int :: group
 begin
 
 definition %quote
   inverse_int_def: "i\<div> = - (i::int)"
 
 instance %quote proof
   fix i :: int
   have "-i + i = 0" by simp
   then show "i\<div> \<otimes> i = \<one>"
     unfolding mult_int_def neutral_int_def inverse_int_def .
 qed
 
 end %quote
 
 
 section \<open>Type classes as locales\<close>
 
 subsection \<open>A look behind the scenes\<close>
 
 text \<open>
   The example above gives an impression how Isar type classes work in
   practice.  As stated in the introduction, classes also provide a
   link to Isar's locale system.  Indeed, the logical core of a class
   is nothing other than a locale:
 \<close>
 
 class %quote idem =
   fixes f :: "\<alpha> \<Rightarrow> \<alpha>"
   assumes idem: "f (f x) = f x"
 
 text \<open>
   \<^noindent> essentially introduces the locale
 \<close> (*<*)setup %invisible \<open>Sign.add_path "foo"\<close>
 (*>*)
 locale %quote idem =
   fixes f :: "\<alpha> \<Rightarrow> \<alpha>"
   assumes idem: "f (f x) = f x"
 
 text \<open>\<^noindent> together with corresponding constant(s):\<close>
 
 consts %quote f :: "\<alpha> \<Rightarrow> \<alpha>"
 
 text \<open>
   \<^noindent> The connection to the type system is done by means of a
   primitive type class \<open>idem\<close>, together with a corresponding
   interpretation:
 \<close>
 
 interpretation %quote idem_class:
   idem "f :: (\<alpha>::idem) \<Rightarrow> \<alpha>"
 (*<*)sorry(*>*)
 
 text \<open>
   \<^noindent> This gives you the full power of the Isabelle module system;
   conclusions in locale \<open>idem\<close> are implicitly propagated
   to class \<open>idem\<close>.
 \<close> (*<*)setup %invisible \<open>Sign.parent_path\<close>
 (*>*)
 subsection \<open>Abstract reasoning\<close>
 
 text \<open>
   Isabelle locales enable reasoning at a general level, while results
   are implicitly transferred to all instances.  For example, we can
   now establish the \<open>left_cancel\<close> lemma for groups, which
   states that the function \<open>(x \<otimes>)\<close> is injective:
 \<close>
 
 lemma %quote (in group) left_cancel: "x \<otimes> y = x \<otimes> z \<longleftrightarrow> y = z"
 proof
   assume "x \<otimes> y = x \<otimes> z"
   then have "x\<div> \<otimes> (x \<otimes> y) = x\<div> \<otimes> (x \<otimes> z)" by simp
   then have "(x\<div> \<otimes> x) \<otimes> y = (x\<div> \<otimes> x) \<otimes> z" using assoc by simp
   then show "y = z" using neutl and invl by simp
 next
   assume "y = z"
   then show "x \<otimes> y = x \<otimes> z" by simp
 qed
 
 text \<open>
   \<^noindent> Here the \qt{@{keyword "in"} \<^class>\<open>group\<close>} target
   specification indicates that the result is recorded within that
   context for later use.  This local theorem is also lifted to the
   global one @{fact "group.left_cancel:"} @{prop [source] "\<And>x y z ::
   \<alpha>::group. x \<otimes> y = x \<otimes> z \<longleftrightarrow> y = z"}.  Since type \<open>int\<close> has been
   made an instance of \<open>group\<close> before, we may refer to that
   fact as well: @{prop [source] "\<And>x y z :: int. x \<otimes> y = x \<otimes> z \<longleftrightarrow> y =
   z"}.
 \<close>
 
 
 subsection \<open>Derived definitions\<close>
 
 text \<open>
   Isabelle locales are targets which support local definitions:
 \<close>
 
 primrec %quote (in monoid) pow_nat :: "nat \<Rightarrow> \<alpha> \<Rightarrow> \<alpha>" where
   "pow_nat 0 x = \<one>"
   | "pow_nat (Suc n) x = x \<otimes> pow_nat n x"
 
 text \<open>
   \<^noindent> If the locale \<open>group\<close> is also a class, this local
   definition is propagated onto a global definition of @{term [source]
   "pow_nat :: nat \<Rightarrow> \<alpha>::monoid \<Rightarrow> \<alpha>::monoid"} with corresponding theorems
 
   @{thm pow_nat.simps [no_vars]}.
 
   \<^noindent> As you can see from this example, for local definitions
   you may use any specification tool which works together with
   locales, such as Krauss's recursive function package
-  @{cite krauss2006}.
+  \<^cite>\<open>krauss2006\<close>.
 \<close>
 
 
 subsection \<open>A functor analogy\<close>
 
 text \<open>
   We introduced Isar classes by analogy to type classes in functional
   programming; if we reconsider this in the context of what has been
   said about type classes and locales, we can drive this analogy
   further by stating that type classes essentially correspond to
   functors that have a canonical interpretation as type classes.
   There is also the possibility of other interpretations.  For
   example, \<open>list\<close>s also form a monoid with \<open>append\<close> and
   \<^term>\<open>[]\<close> as operations, but it seems inappropriate to apply to
   lists the same operations as for genuinely algebraic types.  In such
   a case, we can simply make a particular interpretation of monoids
   for lists:
 \<close>
 
 interpretation %quote list_monoid: monoid append "[]"
   proof qed auto
 
 text \<open>
   \<^noindent> This enables us to apply facts on monoids
   to lists, e.g. @{thm list_monoid.neutl [no_vars]}.
 
   When using this interpretation pattern, it may also
   be appropriate to map derived definitions accordingly:
 \<close>
 
 primrec %quote replicate :: "nat \<Rightarrow> \<alpha> list \<Rightarrow> \<alpha> list" where
   "replicate 0 _ = []"
   | "replicate (Suc n) xs = xs @ replicate n xs"
 
 interpretation %quote list_monoid: monoid append "[]" rewrites
   "monoid.pow_nat append [] = replicate"
 proof -
   interpret monoid append "[]" ..
   show "monoid.pow_nat append [] = replicate"
   proof
     fix n
     show "monoid.pow_nat append [] n = replicate n"
       by (induct n) auto
   qed
 qed intro_locales
 
 text \<open>
   \<^noindent> This pattern is also helpful to reuse abstract
   specifications on the \emph{same} type.  For example, think of a
   class \<open>preorder\<close>; for type \<^typ>\<open>nat\<close>, there are at least two
   possible instances: the natural order or the order induced by the
   divides relation.  But only one of these instances can be used for
   @{command instantiation}; using the locale behind the class \<open>preorder\<close>, it is still possible to utilise the same abstract
   specification again using @{command interpretation}.
 \<close>
 
 subsection \<open>Additional subclass relations\<close>
 
 text \<open>
   Any \<open>group\<close> is also a \<open>monoid\<close>; this can be made
   explicit by claiming an additional subclass relation, together with
   a proof of the logical difference:
 \<close>
 
 subclass %quote (in group) monoid
 proof
   fix x
   from invl have "x\<div> \<otimes> x = \<one>" by simp
   with assoc [symmetric] neutl invl have "x\<div> \<otimes> (x \<otimes> \<one>) = x\<div> \<otimes> x" by simp
   with left_cancel show "x \<otimes> \<one> = x" by simp
 qed
 
 text \<open>
   The logical proof is carried out on the locale level.  Afterwards it
   is propagated to the type system, making \<open>group\<close> an instance
   of \<open>monoid\<close> by adding an additional edge to the graph of
   subclass relations (\figref{fig:subclass}).
 
   \begin{figure}[htbp]
    \begin{center}
      \small
      \unitlength 0.6mm
      \begin{picture}(40,60)(0,0)
        \put(20,60){\makebox(0,0){\<open>semigroup\<close>}}
        \put(20,40){\makebox(0,0){\<open>monoidl\<close>}}
        \put(00,20){\makebox(0,0){\<open>monoid\<close>}}
        \put(40,00){\makebox(0,0){\<open>group\<close>}}
        \put(20,55){\vector(0,-1){10}}
        \put(15,35){\vector(-1,-1){10}}
        \put(25,35){\vector(1,-3){10}}
      \end{picture}
      \hspace{8em}
      \begin{picture}(40,60)(0,0)
        \put(20,60){\makebox(0,0){\<open>semigroup\<close>}}
        \put(20,40){\makebox(0,0){\<open>monoidl\<close>}}
        \put(00,20){\makebox(0,0){\<open>monoid\<close>}}
        \put(40,00){\makebox(0,0){\<open>group\<close>}}
        \put(20,55){\vector(0,-1){10}}
        \put(15,35){\vector(-1,-1){10}}
        \put(05,15){\vector(3,-1){30}}
      \end{picture}
      \caption{Subclass relationship of monoids and groups:
         before and after establishing the relationship
         \<open>group \<subseteq> monoid\<close>;  transitive edges are left out.}
      \label{fig:subclass}
    \end{center}
   \end{figure}
 
   For illustration, a derived definition in \<open>group\<close> using \<open>pow_nat\<close>
 \<close>
 
 definition %quote (in group) pow_int :: "int \<Rightarrow> \<alpha> \<Rightarrow> \<alpha>" where
   "pow_int k x = (if k >= 0
     then pow_nat (nat k) x
     else (pow_nat (nat (- k)) x)\<div>)"
 
 text \<open>
   \<^noindent> yields the global definition of @{term [source] "pow_int ::
   int \<Rightarrow> \<alpha>::group \<Rightarrow> \<alpha>::group"} with the corresponding theorem @{thm
   pow_int_def [no_vars]}.
 \<close>
 
 subsection \<open>A note on syntax\<close>
 
 text \<open>
   As a convenience, class context syntax allows references to local
   class operations and their global counterparts uniformly; type
   inference resolves ambiguities.  For example:
 \<close>
 
 context %quote semigroup
 begin
 
 term %quote "x \<otimes> y" \<comment> \<open>example 1\<close>
 term %quote "(x::nat) \<otimes> y" \<comment> \<open>example 2\<close>
 
 end  %quote
 
 term %quote "x \<otimes> y" \<comment> \<open>example 3\<close>
 
 text \<open>
   \<^noindent> Here in example 1, the term refers to the local class
   operation \<open>mult [\<alpha>]\<close>, whereas in example 2 the type
   constraint enforces the global class operation \<open>mult [nat]\<close>.
   In the global context in example 3, the reference is to the
   polymorphic global class operation \<open>mult [?\<alpha> :: semigroup]\<close>.
 \<close>
 
 section \<open>Further issues\<close>
 
 subsection \<open>Type classes and code generation\<close>
 
 text \<open>
   Turning back to the first motivation for type classes, namely
   overloading, it is obvious that overloading stemming from @{command
   class} statements and @{command instantiation} targets naturally
   maps to Haskell type classes.  The code generator framework
-  @{cite "isabelle-codegen"} takes this into account.  If the target
+  \<^cite>\<open>"isabelle-codegen"\<close> takes this into account.  If the target
   language (e.g.~SML) lacks type classes, then they are implemented by
   an explicit dictionary construction.  As example, let's go back to
   the power function:
 \<close>
 
 definition %quote example :: int where
   "example = pow_int 10 (-2)"
 
 text \<open>
   \<^noindent> This maps to Haskell as follows:
 \<close>
 text %quote \<open>
   @{code_stmts example (Haskell)}
 \<close>
 
 text \<open>
   \<^noindent> The code in SML has explicit dictionary passing:
 \<close>
 text %quote \<open>
   @{code_stmts example (SML)}
 \<close>
 
 
 text \<open>
   \<^noindent> In Scala, implicits are used as dictionaries:
 \<close>
 text %quote \<open>
   @{code_stmts example (Scala)}
 \<close>
 
 
 subsection \<open>Inspecting the type class universe\<close>
 
 text \<open>
   To facilitate orientation in complex subclass structures, two
   diagnostics commands are provided:
 
   \begin{description}
 
     \item[@{command "print_classes"}] print a list of all classes
       together with associated operations etc.
 
     \item[@{command "class_deps"}] visualizes the subclass relation
       between all classes as a Hasse diagram.  An optional first sort argument
       constrains the set of classes to all subclasses of this sort,
       an optional second sort argument to all superclasses of this sort.
 
   \end{description}
 \<close>
 
 end
 
diff --git a/src/Doc/Codegen/Computations.thy b/src/Doc/Codegen/Computations.thy
--- a/src/Doc/Codegen/Computations.thy
+++ b/src/Doc/Codegen/Computations.thy
@@ -1,545 +1,545 @@
 theory Computations
   imports Setup
     "HOL-Library.Code_Target_Int"
 begin
 
 section \<open>Computations \label{sec:computations}\<close>
 
 subsection \<open>Prelude -- The \<open>code\<close> antiquotation \label{sec:code_antiq}\<close>
 
 text \<open>
   The @{ML_antiquotation_def code} antiquotation allows to include constants
   from
   generated code directly into ML system code, as in the following toy
   example:
 \<close>
 
 datatype %quote form = T | F | And form form | Or form form (*<*)
 
 (*>*) ML %quote \<open>
   fun eval_form @{code T} = true
     | eval_form @{code F} = false
     | eval_form (@{code And} (p, q)) =
         eval_form p andalso eval_form q
     | eval_form (@{code Or} (p, q)) =
         eval_form p orelse eval_form q;
 \<close>
 
 text \<open>
   \noindent The antiquotation @{ML_antiquotation code} takes
   the name of a constant as argument;
   the required code is generated
   transparently and the corresponding constant names are inserted
   for the given antiquotations.  This technique allows to use pattern
   matching on constructors stemming from compiled datatypes.
   Note that the @{ML_antiquotation code}
   antiquotation may not refer to constants which carry adaptations;
   here you have to refer to the corresponding adapted code directly.
 \<close>
 
   
 subsection \<open>The concept of computations\<close>
 
 text \<open>
   Computations embody the simple idea that for each
   monomorphic Isabelle/HOL term of type \<open>\<tau>\<close> by virtue of
   code generation there exists an corresponding ML type \<open>T\<close> and
   a morphism \<open>\<Phi> :: \<tau> \<rightarrow> T\<close> satisfying
   \<open>\<Phi> (t\<^sub>1 \<cdot> t\<^sub>2) = \<Phi> t\<^sub>1 \<cdot> \<Phi> t\<^sub>2\<close>, with \<open>\<cdot>\<close> denoting
   term application.
 
   For a given Isabelle/HOL type \<open>\<tau>\<close>, parts of \<open>\<Phi>\<close> can be
   implemented by a corresponding ML function \<open>\<phi>\<^sub>\<tau> :: term \<rightarrow> T\<close>.
   How?
 
     \<^descr> \<open>Let input be a constant C :: \<tau>.\<close> \\
       Then \<open>\<phi>\<^sub>\<tau> C = f\<^sub>C\<close> with \<open>f\<^sub>C\<close> being
       the image of \<open>C\<close> under code generation.
 
     \<^descr> \<open>Let input be an application (t\<^sub>1 \<cdot> t\<^sub>2) :: \<tau>.\<close> \\
       Then \<open>\<phi>\<^sub>\<tau> (t\<^sub>1 \<cdot> t\<^sub>2) = \<phi>\<^sub>\<tau> t\<^sub>1 (\<phi>\<^sub>\<tau> t\<^sub>2)\<close>.
 
   \noindent Using these trivial properties, each monomorphic constant
   \<open>C : \<^vec>\<tau>\<^sub>n \<rightarrow> \<tau>\<close> yields the following
   equations:
 \<close>
 
 text %quote \<open>
   \<open>\<phi>\<^bsub>(\<tau>\<^sub>1 \<rightarrow> \<tau>\<^sub>2 \<rightarrow> \<dots> \<rightarrow> \<tau>\<^sub>n \<rightarrow> \<tau>)\<^esub> C = f\<^sub>C\<close> \\
   \<open>\<phi>\<^bsub>(\<tau>\<^sub>2 \<rightarrow> \<dots> \<rightarrow> \<tau>\<^sub>n \<rightarrow> \<tau>)\<^esub> (C \<cdot> t\<^sub>1) = f\<^sub>C (\<phi>\<^bsub>\<tau>\<^sub>1\<^esub> t\<^sub>1)\<close> \\
   \<open>\<dots>\<close> \\
   \<open>\<phi>\<^bsub>\<tau>\<^esub> (C \<cdot> t\<^sub>1 \<cdot> \<dots> \<cdot> t\<^sub>n) = f\<^sub>C (\<phi>\<^bsub>\<tau>\<^sub>1\<^esub> t\<^sub>1) \<dots> (\<phi>\<^bsub>\<tau>\<^sub>n\<^esub> t\<^sub>n)\<close>
 \<close>
   
 text \<open>
   \noindent Hence a computation is characterized as follows:
 
     \<^item> Let \<open>input constants\<close> denote a set of monomorphic constants.
 
     \<^item> Let \<open>\<tau>\<close> denote a monomorphic type and \<open>'ml\<close> be a schematic
       placeholder for its corresponding type in ML under code generation.
 
     \<^item> Then the corresponding computation is an ML function of type
       \<^ML_type>\<open>Proof.context -> term -> 'ml\<close>
       partially implementing the morphism \<open>\<Phi> :: \<tau> \<rightarrow> T\<close> for all
       \<^emph>\<open>input terms\<close> consisting only of input constants and applications.
 
   \noindent The charming idea is that all required code is automatically generated
   by the code generator for givens input constants and types;
   that code is directly inserted into the Isabelle/ML runtime system
   by means of antiquotations.
 \<close>
 
 
 subsection \<open>The \<open>computation\<close> antiquotation\<close>
 
 text \<open>
   The following example illustrates its basic usage:
 \<close>
 
 ML %quote \<open>
   local
 
   fun int_of_nat @{code "0 :: nat"} = 0
     | int_of_nat (@{code Suc} n) = int_of_nat n + 1;
 
   in
 
   val comp_nat = @{computation nat terms:
     "plus :: nat \<Rightarrow> nat \<Rightarrow> nat" "times :: nat \<Rightarrow> nat \<Rightarrow> nat"
     "sum_list :: nat list \<Rightarrow> nat" "prod_list :: nat list \<Rightarrow> nat"
     datatypes: nat "nat list"}
     (fn post => post o HOLogic.mk_nat o int_of_nat o the);
 
   end
 \<close>
 
 text \<open>
     \<^item> Antiquotations occurring in the
       same ML block always refer to the same transparently generated code;
       particularly, they share the same transparently generated datatype
       declarations.
 
     \<^item> The type of a computation is specified as first argument.
 
     \<^item> Input constants are specified the following ways:
 
         \<^item> Each term following \<open>terms:\<close> specifies all constants
           it contains as input constants.
 
         \<^item> Each type following \<open>datatypes:\<close> specifies all constructors
           of the corresponding code datatype as input constants.  Note that
           this does not increase expressiveness but succinctness for datatypes
           with many constructors.  Abstract type constructors are skipped
           silently.
 
     \<^item> The code generated by a \<open>computation\<close> antiquotation takes a functional argument
       which describes how to conclude the computation.  What's the rationale
       behind this?
 
         \<^item> There is no automated way to generate a reconstruction function
           from the resulting ML type to a Isabelle term -- this is in the
           responsibility of the implementor.  One possible approach
           for robust term reconstruction is the \<open>code\<close> antiquotation.
 
         \<^item> Both statically specified input constants and dynamically provided input
           terms are subject to preprocessing.  Likewise the result
           is supposed to be subject to postprocessing; the implementor
           is expected to take care for this explicitly.
 
         \<^item> Computations follow the partiality principle (cf.~\secref{sec:partiality_principle}):
           failures due to pattern matching or unspecified functions
           are interpreted as partiality; therefore resulting ML values
           are optional. 
 
       Hence the functional argument accepts the following parameters
 
         \<^item> A postprocessor function \<^ML_type>\<open>term -> term\<close>.
 
         \<^item> The resulting value as optional argument.
 
       The functional argument is supposed to compose the final result
       from these in a suitable manner.
 
   \noindent A simple application:
 \<close>
 
 ML_val %quote \<open>
   comp_nat \<^context> \<^term>\<open>sum_list [Suc 0, Suc (Suc 0)] * Suc (Suc 0)\<close>
 \<close>
 
 text \<open>
   \noindent A single ML block may contain an arbitrary number of computation
   antiquotations.  These share the \<^emph>\<open>same\<close> set of possible
   input constants.  In other words, it does not matter in which
   antiquotation constants are specified;  in the following example,
   \<^emph>\<open>all\<close> constants are specified by the first antiquotation once
   and for all:
 \<close>
 
 ML %quote \<open>
   local
 
   fun int_of_nat @{code "0 :: nat"} = 0
     | int_of_nat (@{code Suc} n) = int_of_nat n + 1;
 
   in
 
   val comp_nat = @{computation nat terms:
     "plus :: nat \<Rightarrow> nat \<Rightarrow> nat" "times :: nat \<Rightarrow> nat \<Rightarrow> nat"
     "sum_list :: nat list \<Rightarrow> nat" "prod_list :: nat list \<Rightarrow> nat"
     "replicate :: nat \<Rightarrow> nat \<Rightarrow> nat list"
     datatypes: nat "nat list"}
     (fn post => post o HOLogic.mk_nat o int_of_nat o the);
 
   val comp_nat_list = @{computation "nat list"}
     (fn post => post o HOLogic.mk_list \<^typ>\<open>nat\<close> o
       map (HOLogic.mk_nat o int_of_nat) o the);
 
   end
 \<close>
 
   
 subsection \<open>Pitfalls when specifying input constants \label{sec:input_constants_pitfalls}\<close>
 
 text \<open>
     \<^descr> \<open>Complete type coverage.\<close> Specified input constants must
       be \<^emph>\<open>complete\<close> in the sense that for each
       required type \<open>\<tau>\<close> there is at least one corresponding
       input constant which can actually \<^emph>\<open>construct\<close> a concrete
       value of type \<open>\<tau>\<close>, potentially requiring more types recursively;
       otherwise the system of equations cannot be generated properly.
       Hence such incomplete input constants sets are rejected immediately.
 
     \<^descr> \<open>Unsuitful right hand sides.\<close> The generated code for a computation
       must compile in the strict ML runtime environment.  This imposes
       the technical restriction that each compiled input constant
       \<open>f\<^sub>C\<close> on the right hand side of a generated equations
       must compile without throwing an exception.  That rules
       out pathological examples like @{term [source] "undefined :: nat"}
       as input constants, as well as abstract constructors (cf. \secref{sec:invariant}).
 
     \<^descr> \<open>Preprocessing.\<close> For consistency, input constants are subject
       to preprocessing;  however, the overall approach requires
       to operate on constants \<open>C\<close> and their respective compiled images
       \<open>f\<^sub>C\<close>.\footnote{Technical restrictions of the implementation
       enforce this, although those could be lifted in the future.}
       This is a problem whenever preprocessing maps an input constant
       to a non-constant.
 
       To circumvent these situations, the computation machinery
       has a dedicated preprocessor which is applied \<^emph>\<open>before\<close>
       the regular preprocessing, both to input constants as well as
       input terms.  This can be used to map problematic constants
       to other ones that are not subject to regular preprocessing. 
       Rewrite rules are added using attribute @{attribute code_computation_unfold}.
       There should rarely be a need to use this beyond the few default
       setups in HOL, which deal with literals (see also \secref{sec:literal_input}).
 \<close>
 
   
 subsection \<open>Pitfalls concerning input terms\<close>
 
 text \<open>
     \<^descr> \<open>No polymorphism.\<close> Input terms must be monomorphic: compilation
       to ML requires dedicated choice of monomorphic types.
 
     \<^descr> \<open>No abstractions.\<close> Only constants and applications are admissible
       as input; abstractions are not possible.  In theory, the
       compilation schema could be extended to cover abstractions also,
       but this would increase the trusted code base.  If abstractions
       are required, they can always be eliminated by a dedicated preprocessing
       step, e.g.~using combinatorial logic.
 
     \<^descr> \<open>Potential interfering of the preprocessor.\<close> As described in \secref{sec:input_constants_pitfalls}
       regular preprocessing can have a disruptive effect for input constants.
       The same also applies to input terms; however the same measures 
       to circumvent that problem for input constants apply to input terms also.
 \<close>
 
   
 subsection \<open>Computations using the \<open>computation_conv\<close> antiquotation\<close>
 
 text \<open>
   Computations are a device to implement fast proof procedures.
   Then results of a computation are often assumed to be trustable
-  and thus wrapped in oracles (see @{cite "isabelle-isar-ref"}),
+  and thus wrapped in oracles (see \<^cite>\<open>"isabelle-isar-ref"\<close>),
   as in the following example:\footnote{
   The technical details how numerals are dealt with are given later in
   \secref{sec:literal_input}.}
 \<close>
 
 ML %quote \<open>
   local
 
   fun raw_dvd (b, ct) =
     \<^instantiate>\<open>x = ct and y = \<open>if b then \<^cterm>\<open>True\<close> else \<^cterm>\<open>False\<close>\<close>
       in cterm \<open>x \<equiv> y\<close> for x y :: bool\<close>;
 
   val (_, dvd_oracle) = Context.>>> (Context.map_theory_result
     (Thm.add_oracle (\<^binding>\<open>dvd\<close>, raw_dvd)));
 
   in
 
   val conv_dvd = @{computation_conv bool terms:
     "Rings.dvd :: int \<Rightarrow> int \<Rightarrow> bool"
     "plus :: int \<Rightarrow> int \<Rightarrow> int"
     "minus :: int \<Rightarrow> int \<Rightarrow> int"
     "times :: int \<Rightarrow> int \<Rightarrow> int"
     "0 :: int" "1 :: int" "2 :: int" "3 :: int" "-1 :: int"
   } (K (curry dvd_oracle))
 
   end
 \<close>
 
 text \<open>
     \<^item> Antiquotation @{ML_antiquotation computation_conv} basically yields
       a conversion of type \<^ML_type>\<open>Proof.context -> cterm -> thm\<close>
-      (see further @{cite "isabelle-implementation"}).
+      (see further \<^cite>\<open>"isabelle-implementation"\<close>).
 
     \<^item> The antiquotation expects one functional argument to bridge the
       \qt{untrusted gap};  this can be done e.g.~using an oracle.  Since that oracle
       will only yield \qt{valid} results in the context of that particular
       computation, the implementor must make sure that it does not leave
       the local ML scope;  in this example, this is achieved using
       an explicit \<open>local\<close> ML block.  The very presence of the oracle
       in the code acknowledges that each computation requires explicit thinking
       before it can be considered trustworthy!
 
     \<^item> Postprocessing just operates as further conversion after normalization.
 
     \<^item> Partiality makes the whole conversion fall back to reflexivity.
 \<close> (*<*)
 
 (*>*) ML_val %quote \<open>
   conv_dvd \<^context> \<^cterm>\<open>7 dvd ( 62437867527846782 :: int)\<close>;
   conv_dvd \<^context> \<^cterm>\<open>7 dvd (-62437867527846783 :: int)\<close>;
 \<close>
 
 text \<open>
   \noindent An oracle is not the only way to construct a valid theorem.
   A computation result can be used to construct an appropriate certificate:
 \<close>
 
 lemma %quote conv_div_cert:
   "(Code_Target_Int.positive r * Code_Target_Int.positive s)
      div Code_Target_Int.positive s \<equiv> (numeral r :: int)" (is "?lhs \<equiv> ?rhs")
 proof (rule eq_reflection)
   have "?lhs = numeral r * numeral s div numeral s"
     by simp
   also have "numeral r * numeral s div numeral s = ?rhs"
     by (rule nonzero_mult_div_cancel_right) simp
   finally show "?lhs = ?rhs" .
 qed
 
 lemma %quote positive_mult:
   "Code_Target_Int.positive r * Code_Target_Int.positive s = 
     Code_Target_Int.positive (r * s)"
   by simp
   
 ML %quote \<open>
   local
 
   fun integer_of_int (@{code int_of_integer} k) = k
 
   val cterm_of_int = Thm.cterm_of \<^context> o HOLogic.mk_numeral o integer_of_int;
 
   val divisor = Thm.dest_arg o Thm.dest_arg;
 
   val evaluate_simps = map mk_eq @{thms arith_simps positive_mult};
 
   fun evaluate ctxt = 
     Simplifier.rewrite_rule ctxt evaluate_simps;
 
   fun revaluate ctxt k ct =
     @{thm conv_div_cert}
     |> Thm.instantiate' [] [SOME (cterm_of_int k), SOME (divisor ct)]
     |> evaluate ctxt;
 
   in
 
   val conv_div = @{computation_conv int terms:
     "divide :: int \<Rightarrow> int \<Rightarrow> int"
     "0 :: int" "1 :: int" "2 :: int" "3 :: int"
   } revaluate
 
   end
 \<close>
 
 ML_val %quote \<open>
   conv_div \<^context>
     \<^cterm>\<open>46782454343499999992777742432342242323423425 div (7 :: int)\<close>
 \<close>
 
 text \<open>
   \noindent The example is intentionally kept simple: only positive
   integers are covered, only remainder-free divisions are feasible,
   and the input term is expected to have a particular shape.
   This exhibits the idea more clearly:
   the result of the computation is used as a mere
   hint how to instantiate @{fact conv_div_cert}, from which the required
   theorem is obtained by performing multiplication using the
   simplifier;  hence that theorem is built of proper inferences,
   with no oracles involved.
 \<close>
 
 
 subsection \<open>Computations using the \<open>computation_check\<close> antiquotation\<close>
 
 text \<open>
   The \<open>computation_check\<close> antiquotation is convenient if
   only a positive checking of propositions is desired, because then
   the result type is fixed (\<^typ>\<open>prop\<close>) and all the technical
   matter concerning postprocessing and oracles is done in the framework
   once and for all:
 \<close>
 
 ML %quote \<open>
   val check_nat = @{computation_check terms:
     Trueprop "less :: nat \<Rightarrow> nat \<Rightarrow> bool" "plus :: nat \<Rightarrow> nat \<Rightarrow> nat" 
     "times :: nat \<Rightarrow> nat \<Rightarrow> nat"
     "0 :: nat" Suc
   }
 \<close>
 
 text \<open>
   \noindent The HOL judgement \<^term>\<open>Trueprop\<close> embeds an expression
   of type \<^typ>\<open>bool\<close> into \<^typ>\<open>prop\<close>.
 \<close>
 
 ML_val %quote \<open>
   check_nat \<^context> \<^cprop>\<open>less (Suc (Suc 0)) (Suc (Suc (Suc 0)))\<close>
 \<close>
 
 text \<open>
   \noindent Note that such computations can only \<^emph>\<open>check\<close>
   for \<^typ>\<open>prop\<close>s to hold but not \<^emph>\<open>decide\<close>.
 \<close>
 
 
 subsection \<open>Some practical hints\<close>  
 
 subsubsection \<open>Inspecting generated code\<close>
 
 text \<open>
   The antiquotations for computations attempt to produce meaningful error
   messages.  If these are not sufficient, it might by useful to
   inspect the generated code, which can be achieved using
 \<close>
   
 declare %quote [[ML_source_trace]] (*<*) declare %quote [[ML_source_trace = false]] (*>*)
 
 
 subsubsection \<open>Literals as input constants \label{sec:literal_input}\<close>
 
 text \<open>
   Literals (characters, numerals) in computations cannot be processed
   naively: the compilation pattern for computations fails whenever
   target-language literals are involved; since various
   common code generator setups (see \secref{sec:common_adaptation})
   implement \<^typ>\<open>nat\<close> and \<^typ>\<open>int\<close> by target-language literals,
   this problem manifests whenever numeric types are involved.
   In practice, this is circumvented with a dedicated preprocessor
   setup for literals (see also \secref{sec:input_constants_pitfalls}).
 
   The following examples illustrate the pattern
   how to specify input constants when literals are involved, without going into
   too much detail:
 \<close>
 
 paragraph \<open>An example for \<^typ>\<open>nat\<close>\<close>
 
 ML %quote \<open>
   val check_nat = @{computation_check terms:
     Trueprop "even :: nat \<Rightarrow> bool" "plus :: nat \<Rightarrow> nat \<Rightarrow> nat" 
     "0 :: nat" Suc "1 :: nat" "2 :: nat" "3 :: nat"
   }
 \<close>
 
 ML_val %quote \<open>
   check_nat \<^context> \<^cprop>\<open>even (Suc 0 + 1 + 2 + 3 + 4 + 5)\<close>
 \<close>
   
 paragraph \<open>An example for \<^typ>\<open>int\<close>\<close>
 
 ML %quote \<open>
   val check_int = @{computation_check terms:
     Trueprop "even :: int \<Rightarrow> bool" "plus :: int \<Rightarrow> int \<Rightarrow> int" 
     "0 :: int" "1 :: int" "2 :: int" "3 :: int" "-1 :: int"
   }
 \<close>
 
 ML_val %quote \<open>
   check_int \<^context> \<^cprop>\<open>even ((0::int) + 1 + 2 + 3 + -1 + -2 + -3)\<close>
 \<close>
   
 paragraph \<open>An example for \<^typ>\<open>String.literal\<close>\<close>
 
 definition %quote is_cap_letter :: "String.literal \<Rightarrow> bool"
   where "is_cap_letter s \<longleftrightarrow> (case String.asciis_of_literal s
     of [] \<Rightarrow> False | k # _ \<Rightarrow> 65 \<le> k \<and> k \<le> 90)" (*<*)
 
 (*>*) ML %quote \<open>
   val check_literal = @{computation_check terms:
     Trueprop is_cap_letter datatypes: bool String.literal
   }
 \<close>
 
 ML_val %quote \<open>
   check_literal \<^context> \<^cprop>\<open>is_cap_letter (STR ''Q'')\<close>
 \<close>
 
   
 subsubsection \<open>Preprocessing HOL terms into evaluable shape\<close>
 
 text \<open>
   When integrating decision procedures developed inside HOL into HOL itself,
   a common approach is to use a deep embedding where operators etc.
   are represented by datatypes in Isabelle/HOL.  Then it is necessary
   to turn generic shallowly embedded statements into that particular
   deep embedding (\qt{reification}).
 
   One option is to hardcode using code antiquotations (see \secref{sec:code_antiq}).
   Another option is to use pre-existing infrastructure in HOL:
   \<^ML>\<open>Reification.conv\<close> and \<^ML>\<open>Reification.tac\<close>.
 
   A simplistic example:
 \<close>
 
 datatype %quote form_ord = T | F | Less nat nat
   | And form_ord form_ord | Or form_ord form_ord | Neg form_ord
 
 primrec %quote interp :: "form_ord \<Rightarrow> 'a::order list \<Rightarrow> bool"
 where
   "interp T vs \<longleftrightarrow> True"
 | "interp F vs \<longleftrightarrow> False"
 | "interp (Less i j) vs \<longleftrightarrow> vs ! i < vs ! j"
 | "interp (And f1 f2) vs \<longleftrightarrow> interp f1 vs \<and> interp f2 vs"
 | "interp (Or f1 f2) vs \<longleftrightarrow> interp f1 vs \<or> interp f2 vs"
 | "interp (Neg f) vs \<longleftrightarrow> \<not> interp f vs"
 
 text \<open>
   \noindent The datatype \<^type>\<open>form_ord\<close> represents formulae whose semantics is given by
   \<^const>\<open>interp\<close>.  Note that values are represented by variable indices (\<^typ>\<open>nat\<close>)
   whose concrete values are given in list \<^term>\<open>vs\<close>.
 \<close>
 
 ML %quote (*<*) \<open>\<close>
 lemma "thm": fixes x y z :: "'a::order" shows "x < y \<and> x < z \<equiv> interp (And (Less (Suc 0) (Suc (Suc 0))) (Less (Suc 0) 0)) [z, x, y]"
 ML_prf %quote
 (*>*) \<open>val thm =
   Reification.conv \<^context> @{thms interp.simps} \<^cterm>\<open>x < y \<and> x < z\<close>\<close> (*<*)
 by (tactic \<open>ALLGOALS (resolve_tac \<^context> [thm])\<close>)
 (*>*)
 
 text \<open>
   \noindent By virtue of @{fact interp.simps}, \<^ML>\<open>Reification.conv\<close> provides a conversion
   which, for this concrete example, yields @{thm thm [no_vars]}.  Note that the argument
   to \<^const>\<open>interp\<close> does not contain any free variables and can thus be evaluated
   using evaluation.
 
   A less meager example can be found in the AFP, session \<open>Regular-Sets\<close>,
   theory \<open>Regexp_Method\<close>.
 \<close>
 
 end
diff --git a/src/Doc/Codegen/Evaluation.thy b/src/Doc/Codegen/Evaluation.thy
--- a/src/Doc/Codegen/Evaluation.thy
+++ b/src/Doc/Codegen/Evaluation.thy
@@ -1,204 +1,204 @@
 theory Evaluation
 imports Setup
 begin (*<*)
 
 ML \<open>
   Isabelle_System.make_directory (File.tmp_path (Path.basic "examples"))
 \<close> (*>*)
 
 section \<open>Evaluation \label{sec:evaluation}\<close>
 
 text \<open>
   Recalling \secref{sec:principle}, code generation turns a system of
   equations into a program with the \emph{same} equational semantics.
   As a consequence, this program can be used as a \emph{rewrite
   engine} for terms: rewriting a term \<^term>\<open>t\<close> using a program to a
   term \<^term>\<open>t'\<close> yields the theorems \<^prop>\<open>t \<equiv> t'\<close>.  This
   application of code generation in the following is referred to as
   \emph{evaluation}.
 \<close>
 
 
 subsection \<open>Evaluation techniques\<close>
 
 text \<open>
   There is a rich palette of evaluation
   techniques, each comprising different aspects:
 
   \begin{description}
 
     \item[Expressiveness.]  Depending on the extent to which symbolic
       computation is possible, the class of terms which can be evaluated
       can be bigger or smaller.
 
     \item[Efficiency.]  The more machine-near the technique, the
       faster it is.
 
     \item[Trustability.]  Techniques which a huge (and also probably
       more configurable infrastructure) are more fragile and less
       trustable.
 
   \end{description}
 \<close>
 
 
 subsubsection \<open>The simplifier (\<open>simp\<close>)\<close>
 
 text \<open>
   The simplest way for evaluation is just using the simplifier with
   the original code equations of the underlying program.  This gives
   fully symbolic evaluation and highest trustablity, with the usual
   performance of the simplifier.  Note that for operations on abstract
   datatypes (cf.~\secref{sec:invariant}), the original theorems as
   given by the users are used, not the modified ones.
 \<close>
 
 
 subsubsection \<open>Normalization by evaluation (\<open>nbe\<close>)\<close>
 
 text \<open>
-  Normalization by evaluation @{cite "Aehlig-Haftmann-Nipkow:2008:nbe"}
+  Normalization by evaluation \<^cite>\<open>"Aehlig-Haftmann-Nipkow:2008:nbe"\<close>
   provides a comparably fast partially symbolic evaluation which
   permits also normalization of functions and uninterpreted symbols;
   the stack of code to be trusted is considerable.
 \<close>
 
 
 subsubsection \<open>Evaluation in ML (\<open>code\<close>)\<close>
 
 text \<open>
   Considerable performance can be achieved using evaluation in ML, at the cost
   of being restricted to ground results and a layered stack of code to
   be trusted, including a user's specific code generator setup.
 
   Evaluation is carried out in a target language \emph{Eval} which
   inherits from \emph{SML} but for convenience uses parts of the
   Isabelle runtime environment.  Hence soundness depends crucially
   on the correctness of the code generator setup; this is one of the
   reasons why you should not use adaptation (see \secref{sec:adaptation})
   frivolously.
 \<close>
 
 
 subsection \<open>Dynamic evaluation\<close>
 
 text \<open>
   Dynamic evaluation takes the code generator configuration \qt{as it
   is} at the point where evaluation is issued and computes
   a corresponding result.  Best example is the
   @{command_def value} command for ad-hoc evaluation of
   terms:
 \<close>
 
 value %quote "42 / (12 :: rat)"
 
 text \<open>
   \noindent @{command value} tries first to evaluate using ML, falling
   back to normalization by evaluation if this fails.
 
   A particular technique may be specified in square brackets, e.g.
 \<close>
 
 value %quote [nbe] "42 / (12 :: rat)"
 
 text \<open>
   To employ dynamic evaluation in documents, there is also
   a \<open>value\<close> antiquotation with the same evaluation techniques 
   as @{command value}.
 \<close>
 
   
 subsubsection \<open>Term reconstruction in ML\<close>
 
 text \<open>
   Results from evaluation in ML must be
   turned into Isabelle's internal term representation again.  Since
   that setup is highly configurable, it is never assumed to be trustable. 
   Hence evaluation in ML provides no full term reconstruction
   but distinguishes the following kinds:
 
   \begin{description}
 
     \item[Plain evaluation.]  A term is normalized using the vanilla
       term reconstruction from ML to Isabelle; this is a pragmatic
       approach for applications which do not need trustability.
 
     \item[Property conversion.]  Evaluates propositions; since these
       are monomorphic, the term reconstruction is fixed once and for all
       and therefore trustable -- in the sense that only the regular
       code generator setup has to be trusted, without relying
       on term reconstruction from ML to Isabelle.
 
   \end{description}
 
   \noindent The different degree of trustability is also manifest in the
   types of the corresponding ML functions: plain evaluation
   operates on uncertified terms, whereas property conversion
   operates on certified terms.
 \<close>
 
 
 subsubsection \<open>The partiality principle \label{sec:partiality_principle}\<close>
 
 text \<open>
   During evaluation exceptions indicating a pattern
   match failure or a non-implemented function are treated specially:
   as sketched in \secref{sec:partiality}, such
   exceptions can be interpreted as partiality.  For plain evaluation,
   the result hence is optional; property conversion falls back
   to reflexivity in such cases.
 \<close>
   
 
 subsubsection \<open>Schematic overview\<close>
 
 text \<open>
   \newcommand{\ttsize}{\fontsize{5.8pt}{8pt}\selectfont}
   \fontsize{9pt}{12pt}\selectfont
   \begin{tabular}{l||c|c|c}
     & \<open>simp\<close> & \<open>nbe\<close> & \<open>code\<close> \tabularnewline \hline \hline
     interactive evaluation & @{command value} \<open>[simp]\<close> & @{command value} \<open>[nbe]\<close> & @{command value} \<open>[code]\<close> \tabularnewline
     plain evaluation & & & \ttsize\<^ML>\<open>Code_Evaluation.dynamic_value\<close> \tabularnewline \hline
     evaluation method & @{method code_simp} & @{method normalization} & @{method eval} \tabularnewline
     property conversion & & & \ttsize\<^ML>\<open>Code_Runtime.dynamic_holds_conv\<close> \tabularnewline \hline
     conversion & \ttsize\<^ML>\<open>Code_Simp.dynamic_conv\<close> & \ttsize\<^ML>\<open>Nbe.dynamic_conv\<close>
   \end{tabular}
 \<close>
 
   
 subsection \<open>Static evaluation\<close>
   
 text \<open>
   When implementing proof procedures using evaluation,
   in most cases the code generator setup is appropriate
   \qt{as it was} when the proof procedure was written in ML,
   not an arbitrary later potentially modified setup.  This is
   called static evaluation.
 \<close>
 
 
 subsubsection \<open>Static evaluation using \<open>simp\<close> and \<open>nbe\<close>\<close>
   
 text \<open>
   For \<open>simp\<close> and \<open>nbe\<close> static evaluation can be achieved using 
   \<^ML>\<open>Code_Simp.static_conv\<close> and \<^ML>\<open>Nbe.static_conv\<close>.
   Note that \<^ML>\<open>Nbe.static_conv\<close> by its very nature
   requires an invocation of the ML compiler for every call,
   which can produce significant overhead.
 \<close>
 
 
 subsubsection \<open>Intimate connection between logic and system runtime\<close>
 
 text \<open>
   Static evaluation for \<open>eval\<close> operates differently --
   the required generated code is inserted directly into an ML
   block using antiquotations.  The idea is that generated
   code performing static evaluation (called a \<^emph>\<open>computation\<close>)
   is compiled once and for all such that later calls do not
   require any invocation of the code generator or the ML
   compiler at all.  This topic deserves a dedicated chapter
   \secref{sec:computations}.
 \<close>
   
 end
diff --git a/src/Doc/Codegen/Further.thy b/src/Doc/Codegen/Further.thy
--- a/src/Doc/Codegen/Further.thy
+++ b/src/Doc/Codegen/Further.thy
@@ -1,220 +1,220 @@
 theory Further
 imports Setup
 begin
 
 section \<open>Further issues \label{sec:further}\<close>
 
 subsection \<open>Incorporating generated code directly into the system runtime -- \<open>code_reflect\<close>\<close>
 
 subsubsection \<open>Static embedding of generated code into the system runtime\<close>
 
 text \<open>
   The @{ML_antiquotation code} antiquotation is lightweight, but the generated code
   is only accessible while the ML section is processed.  Sometimes this
   is not appropriate, especially if the generated code contains datatype
   declarations which are shared with other parts of the system.  In these
   cases, @{command_def code_reflect} can be used:
 \<close>
 
 code_reflect %quote Sum_Type
   datatypes sum = Inl | Inr
   functions "Sum_Type.sum.projl" "Sum_Type.sum.projr"
 
 text \<open>
   \noindent @{command code_reflect} takes a structure name and
   references to datatypes and functions; for these code is compiled
   into the named ML structure and the \emph{Eval} target is modified
   in a way that future code generation will reference these
   precompiled versions of the given datatypes and functions.  This
   also allows to refer to the referenced datatypes and functions from
   arbitrary ML code as well.
 
   A typical example for @{command code_reflect} can be found in the
   \<^theory>\<open>HOL.Predicate\<close> theory.
 \<close>
 
 
 subsubsection \<open>Separate compilation\<close>
 
 text \<open>
   For technical reasons it is sometimes necessary to separate
   generation and compilation of code which is supposed to be used in
   the system runtime.  For this @{command code_reflect} with an
   optional \<^theory_text>\<open>file_prefix\<close> argument can be used:
 \<close>
 
 code_reflect %quote Rat
   datatypes rat
   functions Fract
     "(plus :: rat \<Rightarrow> rat \<Rightarrow> rat)" "(minus :: rat \<Rightarrow> rat \<Rightarrow> rat)"
     "(times :: rat \<Rightarrow> rat \<Rightarrow> rat)" "(divide :: rat \<Rightarrow> rat \<Rightarrow> rat)"
   file_prefix rat
 
 text \<open>
   \noindent This generates the referenced code as logical files within the theory context,
   similar to @{command export_code}.
 \<close>
 
 subsection \<open>Specialities of the \<open>Scala\<close> target language \label{sec:scala}\<close>
 
 text \<open>
   \<open>Scala\<close> deviates from languages of the ML family in a couple
   of aspects; those which affect code generation mainly have to do with
   \<open>Scala\<close>'s type system:
 
   \begin{itemize}
 
     \item \<open>Scala\<close> prefers tupled syntax over curried syntax.
 
     \item \<open>Scala\<close> sacrifices Hindely-Milner type inference for a
       much more rich type system with subtyping etc.  For this reason
       type arguments sometimes have to be given explicitly in square
       brackets (mimicking System F syntax).
 
     \item In contrast to \<open>Haskell\<close> where most specialities of
       the type system are implemented using \emph{type classes},
       \<open>Scala\<close> provides a sophisticated system of \emph{implicit
       arguments}.
 
   \end{itemize}
 
   \noindent Concerning currying, the \<open>Scala\<close> serializer counts
   arguments in code equations to determine how many arguments
   shall be tupled; remaining arguments and abstractions in terms
   rather than function definitions are always curried.
 
   The second aspect affects user-defined adaptations with @{command
   code_printing}.  For regular terms, the \<open>Scala\<close> serializer prints
   all type arguments explicitly.  For user-defined term adaptations
   this is only possible for adaptations which take no arguments: here
   the type arguments are just appended.  Otherwise they are ignored;
   hence user-defined adaptations for polymorphic constants have to be
   designed very carefully to avoid ambiguity.
 
   Note also that name clashes can occur when generating Scala code
   to case-insensitive file systems; these can be avoid using the
   ``\<open>(case_insensitive)\<close>'' option for @{command export_code}.
 \<close>
 
 
 subsection \<open>Modules namespace\<close>
 
 text \<open>
   When invoking the @{command export_code} command it is possible to
   leave out the @{keyword "module_name"} part; then code is
   distributed over different modules, where the module name space
   roughly is induced by the Isabelle theory name space.
 
   Then sometimes the awkward situation occurs that dependencies
   between definitions introduce cyclic dependencies between modules,
   which in the \<open>Haskell\<close> world leaves you to the mercy of the
   \<open>Haskell\<close> implementation you are using, while for \<open>SML\<close>/\<open>OCaml\<close> code generation is not possible.
 
   A solution is to declare module names explicitly.  Let use assume
   the three cyclically dependent modules are named \emph{A}, \emph{B}
   and \emph{C}.  Then, by stating
 \<close>
 
 code_identifier %quote
   code_module A \<rightharpoonup> (SML) ABC
 | code_module B \<rightharpoonup> (SML) ABC
 | code_module C \<rightharpoonup> (SML) ABC
 
 text \<open>
   \noindent we explicitly map all those modules on \emph{ABC},
   resulting in an ad-hoc merge of this three modules at serialisation
   time.
 \<close>
 
 subsection \<open>Locales and interpretation\<close>
 
 text \<open>
   A technical issue comes to surface when generating code from
   specifications stemming from locale interpretation into global
   theories.
 
   Let us assume a locale specifying a power operation on arbitrary
   types:
 \<close>
 
 locale %quote power =
   fixes power :: "'a \<Rightarrow> 'b \<Rightarrow> 'b"
   assumes power_commute: "power x \<circ> power y = power y \<circ> power x"
 begin
 
 text \<open>
   \noindent Inside that locale we can lift \<open>power\<close> to exponent
   lists by means of a specification relative to that locale:
 \<close>
 
 primrec %quote powers :: "'a list \<Rightarrow> 'b \<Rightarrow> 'b" where
   "powers [] = id"
 | "powers (x # xs) = power x \<circ> powers xs"
 
 lemma %quote powers_append:
   "powers (xs @ ys) = powers xs \<circ> powers ys"
   by (induct xs) simp_all
 
 lemma %quote powers_power:
   "powers xs \<circ> power x = power x \<circ> powers xs"
   by (induct xs)
     (simp_all del: o_apply id_apply add: comp_assoc,
       simp del: o_apply add: o_assoc power_commute)
 
 lemma %quote powers_rev:
   "powers (rev xs) = powers xs"
     by (induct xs) (simp_all add: powers_append powers_power)
 
 end %quote
 
 text \<open>
   After an interpretation of this locale (say, @{command_def
   global_interpretation} \<open>fun_power:\<close> @{term [source] "power (\<lambda>n (f
   :: 'a \<Rightarrow> 'a). f ^^ n)"}), one could naively expect to have a constant \<open>fun_power.powers :: nat list \<Rightarrow> ('a \<Rightarrow> 'a) \<Rightarrow> 'a \<Rightarrow> 'a\<close> for which code
   can be generated.  But this not the case: internally, the term
   \<open>fun_power.powers\<close> is an abbreviation for the foundational
   term @{term [source] "power.powers (\<lambda>n (f :: 'a \<Rightarrow> 'a). f ^^ n)"}
-  (see @{cite "isabelle-locale"} for the details behind).
+  (see \<^cite>\<open>"isabelle-locale"\<close> for the details behind).
 
   Fortunately, a succint solution is available: a dedicated
   rewrite definition:
 \<close>
 
 global_interpretation %quote fun_power: power "(\<lambda>n (f :: 'a \<Rightarrow> 'a). f ^^ n)"
   defines funpows = fun_power.powers
   by unfold_locales
     (simp_all add: fun_eq_iff funpow_mult mult.commute)
 
 text \<open>
   \noindent This amends the interpretation morphisms such that
   occurrences of the foundational term @{term [source] "power.powers (\<lambda>n (f :: 'a \<Rightarrow> 'a). f ^^ n)"}
   are folded to a newly defined constant \<^const>\<open>funpows\<close>.
 
   After this setup procedure, code generation can continue as usual:
 \<close>
 
 text %quote \<open>
   @{code_stmts funpows constant: Nat.funpow funpows (Haskell)}
 \<close>
 
 
 subsection \<open>Parallel computation\<close>
 
 text \<open>
   Theory \<open>Parallel\<close> in \<^dir>\<open>~~/src/HOL/Library\<close> contains
   operations to exploit parallelism inside the Isabelle/ML
   runtime engine.
 \<close>
 
 subsection \<open>Imperative data structures\<close>
 
 text \<open>
   If you consider imperative data structures as inevitable for a
   specific application, you should consider \emph{Imperative
   Functional Programming with Isabelle/HOL}
-  @{cite "bulwahn-et-al:2008:imperative"}; the framework described there
+  \<^cite>\<open>"bulwahn-et-al:2008:imperative"\<close>; the framework described there
   is available in session \<open>Imperative_HOL\<close>, together with a
   short primer document.
 \<close>
 
 end
diff --git a/src/Doc/Codegen/Inductive_Predicate.thy b/src/Doc/Codegen/Inductive_Predicate.thy
--- a/src/Doc/Codegen/Inductive_Predicate.thy
+++ b/src/Doc/Codegen/Inductive_Predicate.thy
@@ -1,268 +1,268 @@
 theory Inductive_Predicate
 imports Setup
 begin
 
 (*<*)
 hide_const %invisible append
 
 inductive %invisible append where
   "append [] ys ys"
 | "append xs ys zs \<Longrightarrow> append (x # xs) ys (x # zs)"
 
 lemma %invisible append: "append xs ys zs = (xs @ ys = zs)"
   by (induct xs arbitrary: ys zs) (auto elim: append.cases intro: append.intros)
 
 lemmas lexordp_def = 
   lexordp_def [unfolded lexord_def mem_Collect_eq split]
 (*>*)
 
 section \<open>Inductive Predicates \label{sec:inductive}\<close>
 
 text \<open>
   The \<open>predicate compiler\<close> is an extension of the code generator
   which turns inductive specifications into equational ones, from
   which in turn executable code can be generated.  The mechanisms of
   this compiler are described in detail in
-  @{cite "Berghofer-Bulwahn-Haftmann:2009:TPHOL"}.
+  \<^cite>\<open>"Berghofer-Bulwahn-Haftmann:2009:TPHOL"\<close>.
 
   Consider the simple predicate \<^const>\<open>append\<close> given by these two
   introduction rules:
 \<close>
 
 text %quote \<open>
   @{thm append.intros(1)[of ys]} \\
   @{thm append.intros(2)[of xs ys zs x]}
 \<close>
 
 text \<open>
   \noindent To invoke the compiler, simply use @{command_def "code_pred"}:
 \<close>
 
 code_pred %quote append .
 
 text \<open>
   \noindent The @{command "code_pred"} command takes the name of the
   inductive predicate and then you put a period to discharge a trivial
   correctness proof.  The compiler infers possible modes for the
   predicate and produces the derived code equations.  Modes annotate
   which (parts of the) arguments are to be taken as input, and which
   output. Modes are similar to types, but use the notation \<open>i\<close>
   for input and \<open>o\<close> for output.
  
   For \<^term>\<open>append\<close>, the compiler can infer the following modes:
   \begin{itemize}
     \item \<open>i \<Rightarrow> i \<Rightarrow> i \<Rightarrow> bool\<close>
     \item \<open>i \<Rightarrow> i \<Rightarrow> o \<Rightarrow> bool\<close>
     \item \<open>o \<Rightarrow> o \<Rightarrow> i \<Rightarrow> bool\<close>
   \end{itemize}
   You can compute sets of predicates using @{command_def "values"}:
 \<close>
 
 values %quote "{zs. append [(1::nat),2,3] [4,5] zs}"
 
 text \<open>\noindent outputs \<open>{[1, 2, 3, 4, 5]}\<close>, and\<close>
 
 values %quote "{(xs, ys). append xs ys [(2::nat),3]}"
 
 text \<open>\noindent outputs \<open>{([], [2, 3]), ([2], [3]), ([2, 3], [])}\<close>.\<close>
 
 text \<open>
   \noindent If you are only interested in the first elements of the
   set comprehension (with respect to a depth-first search on the
   introduction rules), you can pass an argument to @{command "values"}
   to specify the number of elements you want:
 \<close>
 
 values %quote 1 "{(xs, ys). append xs ys [(1::nat), 2, 3, 4]}"
 values %quote 3 "{(xs, ys). append xs ys [(1::nat), 2, 3, 4]}"
 
 text \<open>
   \noindent The @{command "values"} command can only compute set
   comprehensions for which a mode has been inferred.
 
   The code equations for a predicate are made available as theorems with
   the suffix \<open>equation\<close>, and can be inspected with:
 \<close>
 
 thm %quote append.equation
 
 text \<open>
   \noindent More advanced options are described in the following subsections.
 \<close>
 
 subsection \<open>Alternative names for functions\<close>
 
 text \<open>
   By default, the functions generated from a predicate are named after
   the predicate with the mode mangled into the name (e.g., \<open>append_i_i_o\<close>).  You can specify your own names as follows:
 \<close>
 
 code_pred %quote (modes: i \<Rightarrow> i \<Rightarrow> o \<Rightarrow> bool as concat,
   o \<Rightarrow> o \<Rightarrow> i \<Rightarrow> bool as split,
   i \<Rightarrow> o \<Rightarrow> i \<Rightarrow> bool as suffix) append .
 
 subsection \<open>Alternative introduction rules\<close>
 
 text \<open>
   Sometimes the introduction rules of an predicate are not executable
   because they contain non-executable constants or specific modes
   could not be inferred.  It is also possible that the introduction
   rules yield a function that loops forever due to the execution in a
   depth-first search manner.  Therefore, you can declare alternative
   introduction rules for predicates with the attribute @{attribute
   "code_pred_intro"}.  For example, the transitive closure is defined
   by:
 \<close>
 
 text %quote \<open>
   @{lemma [source] "r a b \<Longrightarrow> tranclp r a b" by (fact tranclp.intros(1))}\\
   @{lemma [source] "tranclp r a b \<Longrightarrow> r b c \<Longrightarrow> tranclp r a c" by (fact tranclp.intros(2))}
 \<close>
 
 text \<open>
   \noindent These rules do not suit well for executing the transitive
   closure with the mode \<open>(i \<Rightarrow> o \<Rightarrow> bool) \<Rightarrow> i \<Rightarrow> o \<Rightarrow> bool\<close>, as
   the second rule will cause an infinite loop in the recursive call.
   This can be avoided using the following alternative rules which are
   declared to the predicate compiler by the attribute @{attribute
   "code_pred_intro"}:
 \<close>
 
 lemma %quote [code_pred_intro]:
   "r a b \<Longrightarrow> tranclp r a b"
   "r a b \<Longrightarrow> tranclp r b c \<Longrightarrow> tranclp r a c"
 by auto
 
 text \<open>
   \noindent After declaring all alternative rules for the transitive
   closure, you invoke @{command "code_pred"} as usual.  As you have
   declared alternative rules for the predicate, you are urged to prove
   that these introduction rules are complete, i.e., that you can
   derive an elimination rule for the alternative rules:
 \<close>
 
 code_pred %quote tranclp
 proof -
   case tranclp
   from this converse_tranclpE [OF tranclp.prems] show thesis by metis
 qed
 
 text \<open>
   \noindent Alternative rules can also be used for constants that have
   not been defined inductively. For example, the lexicographic order
   which is defined as:
 \<close>
 
 text %quote \<open>
   @{thm [display] lexordp_def [of r]}
 \<close>
 
 text \<open>
   \noindent To make it executable, you can derive the following two
   rules and prove the elimination rule:
 \<close>
 
 lemma %quote [code_pred_intro]:
   "append xs (a # v) ys \<Longrightarrow> lexordp r xs ys"
 (*<*)unfolding lexordp_def by (auto simp add: append)(*>*)
 
 lemma %quote [code_pred_intro]:
   "append u (a # v) xs \<Longrightarrow> append u (b # w) ys \<Longrightarrow> r a b
   \<Longrightarrow> lexordp r xs ys"
 (*<*)unfolding lexordp_def append apply simp
 apply (rule disjI2) by auto(*>*)
 
 code_pred %quote lexordp
 (*<*)proof -
   fix r xs ys
   assume lexord: "lexordp r xs ys"
   assume 1: "\<And>r' xs' ys' a v. r = r' \<Longrightarrow> xs = xs' \<Longrightarrow> ys = ys'
     \<Longrightarrow> append xs' (a # v) ys' \<Longrightarrow> thesis"
   assume 2: "\<And>r' xs' ys' u a v b w. r = r' \<Longrightarrow> xs = xs' \<Longrightarrow> ys = ys'
     \<Longrightarrow> append u (a # v) xs' \<Longrightarrow> append u (b # w) ys' \<Longrightarrow> r' a b \<Longrightarrow> thesis"
   {
     assume "\<exists>a v. ys = xs @ a # v"
     from this 1 have thesis
         by (fastforce simp add: append)
   } moreover
   {
     assume "\<exists>u a b v w. r a b \<and> xs = u @ a # v \<and> ys = u @ b # w"
     from this 2 have thesis by (fastforce simp add: append)
   } moreover
   note lexord
   ultimately show thesis
     unfolding lexordp_def
     by fastforce
 qed(*>*)
 
 
 subsection \<open>Options for values\<close>
 
 text \<open>
   In the presence of higher-order predicates, multiple modes for some
   predicate could be inferred that are not disambiguated by the
   pattern of the set comprehension.  To disambiguate the modes for the
   arguments of a predicate, you can state the modes explicitly in the
   @{command "values"} command.  Consider the simple predicate \<^term>\<open>succ\<close>:
 \<close>
 
 inductive %quote succ :: "nat \<Rightarrow> nat \<Rightarrow> bool" where
   "succ 0 (Suc 0)"
 | "succ x y \<Longrightarrow> succ (Suc x) (Suc y)"
 
 code_pred %quote succ .
 
 text \<open>
   \noindent For this, the predicate compiler can infer modes \<open>o
   \<Rightarrow> o \<Rightarrow> bool\<close>, \<open>i \<Rightarrow> o \<Rightarrow> bool\<close>, \<open>o \<Rightarrow> i \<Rightarrow> bool\<close> and
   \<open>i \<Rightarrow> i \<Rightarrow> bool\<close>.  The invocation of @{command "values"}
   \<open>{n. tranclp succ 10 n}\<close> loops, as multiple modes for the
   predicate \<open>succ\<close> are possible and here the first mode \<open>o \<Rightarrow> o \<Rightarrow> bool\<close> is chosen. To choose another mode for the argument,
   you can declare the mode for the argument between the @{command
   "values"} and the number of elements.
 \<close>
 
 values %quote [mode: i \<Rightarrow> o \<Rightarrow> bool] 1 "{n. tranclp succ 10 n}" (*FIXME does not terminate for n\<ge>1*)
 values %quote [mode: o \<Rightarrow> i \<Rightarrow> bool] 1 "{n. tranclp succ n 10}"
 
 
 subsection \<open>Embedding into functional code within Isabelle/HOL\<close>
 
 text \<open>
   To embed the computation of an inductive predicate into functions
   that are defined in Isabelle/HOL, you have a number of options:
 
   \begin{itemize}
 
   \item You want to use the first-order predicate with the mode
     where all arguments are input. Then you can use the predicate directly, e.g.
 
     @{text [display]
 \<open>valid_suffix ys zs =
   (if append [Suc 0, 2] ys zs then Some ys else None)\<close>}
 
   \item If you know that the execution returns only one value (it is
     deterministic), then you can use the combinator \<^term>\<open>Predicate.the\<close>, e.g., a functional concatenation of lists is
     defined with
 
     @{term [display] "functional_concat xs ys = Predicate.the (append_i_i_o xs ys)"}
 
     Note that if the evaluation does not return a unique value, it
     raises a run-time error \<^term>\<open>not_unique\<close>.
 
   \end{itemize}
 \<close>
 
 
 subsection \<open>Further Examples\<close>
 
 text \<open>
   Further examples for compiling inductive predicates can be found in
   \<^file>\<open>~~/src/HOL/Predicate_Compile_Examples/Examples.thy\<close>.  There are
   also some examples in the Archive of Formal Proofs, notably in the
   \<open>POPLmark-deBruijn\<close> and the \<open>FeatherweightJava\<close>
   sessions.
 \<close>
 
 end
 
diff --git a/src/Doc/Codegen/Introduction.thy b/src/Doc/Codegen/Introduction.thy
--- a/src/Doc/Codegen/Introduction.thy
+++ b/src/Doc/Codegen/Introduction.thy
@@ -1,256 +1,256 @@
 theory Introduction
 imports Setup
 begin (*<*)
 
 ML \<open>
   Isabelle_System.make_directory (File.tmp_path (Path.basic "examples"))
 \<close> (*>*)
 
 section \<open>Introduction\<close>
 
 text \<open>
   This tutorial introduces the code generator facilities of \<open>Isabelle/HOL\<close>.  It allows to turn (a certain class of) HOL
   specifications into corresponding executable code in the programming
-  languages \<open>SML\<close> @{cite SML}, \<open>OCaml\<close> @{cite OCaml},
-  \<open>Haskell\<close> @{cite "haskell-revised-report"} and \<open>Scala\<close>
-  @{cite "scala-overview-tech-report"}.
+  languages \<open>SML\<close> \<^cite>\<open>SML\<close>, \<open>OCaml\<close> \<^cite>\<open>OCaml\<close>,
+  \<open>Haskell\<close> \<^cite>\<open>"haskell-revised-report"\<close> and \<open>Scala\<close>
+  \<^cite>\<open>"scala-overview-tech-report"\<close>.
 
   To profit from this tutorial, some familiarity and experience with
-  Isabelle/HOL @{cite "isa-tutorial"} and its basic theories is assumed.
+  Isabelle/HOL \<^cite>\<open>"isa-tutorial"\<close> and its basic theories is assumed.
 \<close>
 
 
 subsection \<open>Code generation principle: shallow embedding \label{sec:principle}\<close>
 
 text \<open>
   The key concept for understanding Isabelle's code generation is
   \emph{shallow embedding}: logical entities like constants, types and
   classes are identified with corresponding entities in the target
   language.  In particular, the carrier of a generated program's
   semantics are \emph{equational theorems} from the logic.  If we view
   a generated program as an implementation of a higher-order rewrite
   system, then every rewrite step performed by the program can be
   simulated in the logic, which guarantees partial correctness
-  @{cite "Haftmann-Nipkow:2010:code"}.
+  \<^cite>\<open>"Haftmann-Nipkow:2010:code"\<close>.
 \<close>
 
 
 subsection \<open>A quick start with the Isabelle/HOL toolbox \label{sec:queue_example}\<close>
 
 text \<open>
   In a HOL theory, the @{command_def datatype} and @{command_def
   definition}/@{command_def primrec}/@{command_def fun} declarations
   form the core of a functional programming language.  By default
   equational theorems stemming from those are used for generated code,
   therefore \qt{naive} code generation can proceed without further
   ado.
 
   For example, here a simple \qt{implementation} of amortised queues:
 \<close>
 
 datatype %quote 'a queue = AQueue "'a list" "'a list"
 
 definition %quote empty :: "'a queue" where
   "empty = AQueue [] []"
 
 primrec %quote enqueue :: "'a \<Rightarrow> 'a queue \<Rightarrow> 'a queue" where
   "enqueue x (AQueue xs ys) = AQueue (x # xs) ys"
 
 fun %quote dequeue :: "'a queue \<Rightarrow> 'a option \<times> 'a queue" where
     "dequeue (AQueue [] []) = (None, AQueue [] [])"
   | "dequeue (AQueue xs (y # ys)) = (Some y, AQueue xs ys)"
   | "dequeue (AQueue xs []) =
       (case rev xs of y # ys \<Rightarrow> (Some y, AQueue [] ys))" (*<*)
 
 lemma %invisible dequeue_nonempty_Nil [simp]:
   "xs \<noteq> [] \<Longrightarrow> dequeue (AQueue xs []) = (case rev xs of y # ys \<Rightarrow> (Some y, AQueue [] ys))"
   by (cases xs) (simp_all split: list.splits) (*>*)
 
 text \<open>\noindent Then we can generate code e.g.~for \<open>SML\<close> as follows:\<close>
 
 export_code %quote empty dequeue enqueue in SML module_name Example
 
 text \<open>\noindent resulting in the following code:\<close>
 
 text %quote \<open>
   @{code_stmts empty enqueue dequeue (SML)}
 \<close>
 
 text \<open>
   \noindent The @{command_def export_code} command takes multiple constants
   for which code shall be generated; anything else needed for those is
   added implicitly. Then follows a target language identifier and a freely
   chosen \<^theory_text>\<open>module_name\<close>.
 
   Output is written to a logical file-system within the theory context,
   with the theory name and ``\<^verbatim>\<open>code\<close>'' as overall prefix. There is also a
   formal session export using the same name: the result may be explored in
   the Isabelle/jEdit Prover IDE using the file-browser on the URL
   ``\<^verbatim>\<open>isabelle-export:\<close>''.
 
   The file name is determined by the target language together with an
   optional \<^theory_text>\<open>file_prefix\<close> (the default is ``\<^verbatim>\<open>export\<close>'' with a consecutive
   number within the current theory). For \<open>SML\<close>, \<open>OCaml\<close> and \<open>Scala\<close>, the
   file prefix becomes a plain file with extension (e.g.\ ``\<^verbatim>\<open>.ML\<close>'' for
   SML). For \<open>Haskell\<close> the file prefix becomes a directory that is populated
   with a separate file for each module (with extension ``\<^verbatim>\<open>.hs\<close>'').
 
   Consider the following example:
 \<close>
 
 export_code %quote empty dequeue enqueue in Haskell
   module_name Example file_prefix example
 
 text \<open>
   \noindent This is the corresponding code:
 \<close>
 
 text %quote \<open>
   @{code_stmts empty enqueue dequeue (Haskell)}
 \<close>
 
 text \<open>
   \noindent For more details about @{command export_code} see
   \secref{sec:further}.
 \<close>
 
 
 subsection \<open>Type classes\<close>
 
 text \<open>
   Code can also be generated from type classes in a Haskell-like
   manner.  For illustration here an example from abstract algebra:
 \<close>
 
 class %quote semigroup =
   fixes mult :: "'a \<Rightarrow> 'a \<Rightarrow> 'a" (infixl "\<otimes>" 70)
   assumes assoc: "(x \<otimes> y) \<otimes> z = x \<otimes> (y \<otimes> z)"
 
 class %quote monoid = semigroup +
   fixes neutral :: 'a ("\<one>")
   assumes neutl: "\<one> \<otimes> x = x"
     and neutr: "x \<otimes> \<one> = x"
 
 instantiation %quote nat :: monoid
 begin
 
 primrec %quote mult_nat where
     "0 \<otimes> n = (0::nat)"
   | "Suc m \<otimes> n = n + m \<otimes> n"
 
 definition %quote neutral_nat where
   "\<one> = Suc 0"
 
 lemma %quote add_mult_distrib:
   fixes n m q :: nat
   shows "(n + m) \<otimes> q = n \<otimes> q + m \<otimes> q"
   by (induct n) simp_all
 
 instance %quote proof
   fix m n q :: nat
   show "m \<otimes> n \<otimes> q = m \<otimes> (n \<otimes> q)"
     by (induct m) (simp_all add: add_mult_distrib)
   show "\<one> \<otimes> n = n"
     by (simp add: neutral_nat_def)
   show "m \<otimes> \<one> = m"
     by (induct m) (simp_all add: neutral_nat_def)
 qed
 
 end %quote
 
 text \<open>
   \noindent We define the natural operation of the natural numbers
   on monoids:
 \<close>
 
 primrec %quote (in monoid) pow :: "nat \<Rightarrow> 'a \<Rightarrow> 'a" where
     "pow 0 a = \<one>"
   | "pow (Suc n) a = a \<otimes> pow n a"
 
 text \<open>
   \noindent This we use to define the discrete exponentiation
   function:
 \<close>
 
 definition %quote bexp :: "nat \<Rightarrow> nat" where
   "bexp n = pow n (Suc (Suc 0))"
 
 text \<open>
   \noindent The corresponding code in Haskell uses that language's
   native classes:
 \<close>
 
 text %quote \<open>
   @{code_stmts bexp (Haskell)}
 \<close>
 
 text \<open>
   \noindent This is a convenient place to show how explicit dictionary
   construction manifests in generated code -- the same example in
   \<open>SML\<close>:
 \<close>
 
 text %quote \<open>
   @{code_stmts bexp (SML)}
 \<close>
 
 text \<open>
   \noindent Note the parameters with trailing underscore (\<^verbatim>\<open>A_\<close>), which are the dictionary parameters.
 \<close>
 
 
 subsection \<open>How to continue from here\<close>
 
 text \<open>
   What you have seen so far should be already enough in a lot of
   cases.  If you are content with this, you can quit reading here.
 
   Anyway, to understand situations where problems occur or to increase
   the scope of code generation beyond default, it is necessary to gain
   some understanding how the code generator actually works:
 
   \begin{itemize}
 
     \item The foundations of the code generator are described in
       \secref{sec:foundations}.
 
     \item In particular \secref{sec:utterly_wrong} gives hints how to
       debug situations where code generation does not succeed as
       expected.
 
     \item The scope and quality of generated code can be increased
       dramatically by applying refinement techniques, which are
       introduced in \secref{sec:refinement}.
 
     \item How to define partial functions such that code can be generated
       is explained in \secref{sec:partial}.
 
     \item Inductive predicates can be turned executable using an
       extension of the code generator \secref{sec:inductive}.
 
     \item If you want to utilize code generation to obtain fast
       evaluators e.g.~for decision procedures, have a look at
       \secref{sec:evaluation}.
 
     \item You may want to skim over the more technical sections
       \secref{sec:adaptation} and \secref{sec:further}.
 
-    \item The target language Scala @{cite "scala-overview-tech-report"}
+    \item The target language Scala \<^cite>\<open>"scala-overview-tech-report"\<close>
       comes with some specialities discussed in \secref{sec:scala}.
 
     \item For exhaustive syntax diagrams etc. you should visit the
-      Isabelle/Isar Reference Manual @{cite "isabelle-isar-ref"}.
+      Isabelle/Isar Reference Manual \<^cite>\<open>"isabelle-isar-ref"\<close>.
 
   \end{itemize}
 
   \bigskip
 
   \begin{center}\fbox{\fbox{\begin{minipage}{8cm}
 
     \begin{center}\textit{Happy proving, happy hacking!}\end{center}
 
   \end{minipage}}}\end{center}
 \<close>
 
 end
 
diff --git a/src/Doc/Codegen/Partial_Functions.thy b/src/Doc/Codegen/Partial_Functions.thy
--- a/src/Doc/Codegen/Partial_Functions.thy
+++ b/src/Doc/Codegen/Partial_Functions.thy
@@ -1,261 +1,261 @@
 theory Partial_Functions
 imports Setup "HOL-Library.Monad_Syntax"
 begin
 
 section \<open>Partial Functions \label{sec:partial}\<close>
 
 text \<open>We demonstrate three approaches to defining executable partial recursive functions,
 i.e.\ functions that do not terminate for all inputs.
 The main points are the definitions of the functions and the inductive proofs about them.
 
 Our concrete example represents a typical termination problem: following a data structure that
 may contain cycles. We want to follow a mapping from \<open>nat\<close> to \<open>nat\<close> to the end
 (until we leave its domain). The mapping is represented by a list \<open>ns :: nat list\<close>
 that maps \<open>n\<close> to \<open>ns ! n\<close>.
 The details of the example are in some sense irrelevant but make the exposition more realistic.
 However, we hide most proofs or show only the characteristic opening.\<close>
 
 text \<open>The list representation of the mapping can be abstracted to a relation.
 The order @{term "(ns!n, n)"} is the order that @{const wf} expects.\<close>
 
 definition rel :: "nat list \<Rightarrow> (nat * nat) set" where
 "rel ns = set(zip ns [0..<length ns])"
 
 lemma finite_rel[simp]: "finite(rel ns)"
 (*<*)by(simp add: rel_def)(*>*)
 
 text \<open>\noindent This relation should be acyclic
  to guarantee termination of the partial functions defined below.\<close>
 
 
 subsection \<open>Tail recursion\<close>
 
 text \<open>If a function is tail-recursive, an executable definition is easy:\<close>
 
 partial_function (tailrec) follow :: "nat list \<Rightarrow> nat \<Rightarrow> nat" where
 "follow ns n = (if n < length ns then follow ns (ns!n) else n)"
 
 text \<open>Informing the code generator:\<close>
 
 declare follow.simps[code]
 
 text \<open>Now @{const follow} is executable:\<close>
 
 value "follow [1,2,3] 0"
 
 text \<open>For proofs about @{const follow} we need a @{const wf} relation on @{term "(ns,n)"} pairs
 that decreases with each recursive call. The first component stays the same but must be acyclic.
 The second component must decrease w.r.t @{const rel}:\<close>
 
 definition "rel_follow = same_fst (acyclic o rel) rel"
 
 lemma wf_follow: "wf rel_follow"
 (*<*)
 by (auto intro: wf_same_fst simp: rel_follow_def finite_acyclic_wf)
 
 text \<open>A more explicit formulation of \<open>rel_follow\<close>:
 The first component stays the same but must be acyclic.
 The second component decreases w.r.t \<open>rel\<close>:\<close>
 
 lemma rel_follow_step:
   "\<lbrakk> m < length ms; acyclic (rel ms) \<rbrakk> \<Longrightarrow> ((ms, ms ! m), (ms, m)) \<in> rel_follow"
 by(force simp: rel_follow_def rel_def in_set_zip)
 (*>*)
 
 text \<open>This is how you start an inductive proof about @{const follow} along @{const rel_follow}:\<close>
 
 lemma "acyclic(rel ms) \<Longrightarrow> follow ms m = n \<Longrightarrow> length ms \<le> n"
 proof (induction "(ms,m)" arbitrary: m n rule: wf_induct_rule[OF wf_follow])
 (*<*)
   case 1
   thus ?case using follow.simps rel_follow_step by fastforce
 qed
 (*>*)
 
 
 subsection \<open>Option\<close>
 
 text \<open>If the function is not tail-recursive, not all is lost: if we rewrite it to return an \<open>option\<close>
 type, it can still be defined. In this case @{term "Some x"} represents the result \<open>x\<close>
 and @{term None} represents represents nontermination.
 For example, counting the length of the chain represented by \<open>ns\<close> can be defined like this:\<close>
 
 partial_function (option) count :: "nat list \<Rightarrow> nat \<Rightarrow> nat option" where
 "count ns n
 = (if n < length ns then do {k \<leftarrow> count ns (ns!n); Some (k+1)} else Some 0)"
 
 text \<open>\noindent We use a Haskell-like \<open>do\<close> notation (import @{theory "HOL-Library.Monad_Syntax"})
 to abbreviate the clumsy explicit
 
 \noindent
 @{term "case count ns (ns!n) of Some k \<Rightarrow> Some(k+1) | None \<Rightarrow> None"}.
 
 \noindent
 The branch \<open>None \<Rightarrow> None\<close> represents the requirement
 that nontermination of a recursive call must lead to nontermination of the function.
 
 Now we can prove that @{const count} terminates for all acyclic maps:\<close>
 
 lemma "acyclic(rel ms) \<Longrightarrow> \<exists>k. count ms m = Some k"
 proof (induction "(ms,m)" arbitrary: ms m rule: wf_induct_rule[OF wf_follow])
 (*<*)
   case 1
   thus ?case
     by (metis bind.bind_lunit count.simps rel_follow_step)
 qed
 (*>*)
 
 
 subsection \<open>Subtype\<close>
 
 text \<open>In this approach we define a new type that contains only elements on which the function
 in question terminates.
 In our example that is the subtype of all \<open>ns :: nat list\<close> such that @{term "rel ns"} is acyclic.
 Then @{const follow} can be defined as a total function on that subtype.\<close>
 
 text \<open>The subtype is not empty:\<close>
 
 lemma acyclic_rel_Nil: "acyclic(rel [])"
 (*<*)by (simp add: rel_def acyclic_def)(*>*)
 
 text \<open>Definition of subtype \<open>acyc\<close>:\<close>
 
 typedef acyc = "{ns. acyclic(rel ns)}"
 morphisms rep_acyc abs_acyc
 using acyclic_rel_Nil by auto
 
 text \<open>\noindent This defines two functions @{term [source] "rep_acyc :: acyc \<Rightarrow> nat list"}
 and @{const abs_acyc} \<open>::\<close> \mbox{@{typ "nat list \<Rightarrow> acyc"}}.
 Function @{const abs_acyc} is only defined on acyclic lists and not executable for that reason.
 Type \<open>dlist\<close> in Section~\ref{sec:partiality} is defined in the same manner.
 
 The following command sets up infrastructure for lifting functions on @{typ "nat list"}
-to @{typ acyc} (used by @{command_def lift_definition} below) \cite{isabelle-isar-ref}.\<close>
+to @{typ acyc} (used by @{command_def lift_definition} below) \<^cite>\<open>"isabelle-isar-ref"\<close>.\<close>
 
 setup_lifting type_definition_acyc
 
 text \<open>This is how @{const follow} can be defined on @{typ acyc}:\<close>
 
 function follow2 :: "acyc \<Rightarrow> nat \<Rightarrow> nat" where
 "follow2 ac n
 = (let ns = rep_acyc ac in if n < length ns then follow2 ac (ns!n) else n)"
 by pat_completeness auto
 
 text \<open>Now we prepare for the termination proof.
  Relation \<open>rel_follow2\<close> is almost identical to @{const rel_follow}.\<close>
 
 definition "rel_follow2 = same_fst (acyclic o rel o rep_acyc) (rel o rep_acyc)"
 
 lemma wf_follow2: "wf rel_follow2"
 (*<*)
 by (auto intro: wf_same_fst simp add: rel_follow2_def finite_acyclic_wf)
 
 text \<open>A more explicit formulation of \<open>rel_follow2\<close>:\<close>
 
 lemma rel_follow2_step:
   "\<lbrakk> ns = rep_acyc ac; m < length ns; acyclic (rel ns) \<rbrakk> \<Longrightarrow> ((ac, ns ! m), (ac, m)) \<in> rel_follow2"
 by(force simp add: rel_follow2_def rel_def in_set_zip)
 (*>*)
 
 text \<open>Here comes the actual termination proof:\<close>
 
 termination follow2
 proof
   show "wf rel_follow2"
 (*<*)    by (auto intro: wf_same_fst simp add: rel_follow2_def finite_acyclic_wf)(*>*)
 
 next
   show "\<And>ac n ns. \<lbrakk> ns = rep_acyc ac; n < length ns \<rbrakk>
               \<Longrightarrow> ((ac, ns ! n), (ac, n)) \<in> rel_follow2"
 (*<*)    using rel_follow2_step rep_acyc by simp(*>*)
 
 qed
 
 text \<open>Inductive proofs about @{const follow2} can now simply use computation induction:\<close>
 
 lemma "follow2 ac m = n \<Longrightarrow> length (rep_acyc ac) \<le> n"
 proof (induction ac m arbitrary: n rule: follow2.induct)
 (*<*)
   case 1
   thus ?case by (metis (full_types) follow2.simps linorder_not_le)
 qed
 (*>*)
 
 text \<open>A complication with the subtype approach is that injection into the subtype
 (function \<open>abs_acyc\<close> in our example) is not executable. But to call @{const follow2},
 we need an argument of type \<open>acyc\<close> and we need to obtain it in an executable manner.
 There are two approaches.\<close>
 
 text \<open>In the first approach we check wellformedness (i.e. acyclicity) explicitly.
 This check needs to be executable (which @{const acyclic} and @{const rel} are).
 If the check fails, @{term "[]"} is returned (which is acyclic).\<close>
 
 lift_definition is_acyc :: "nat list \<Rightarrow> acyc" is 
   "\<lambda>ns. if acyclic(rel ns) then ns else []"
 (*<*)by (auto simp: acyclic_rel_Nil)(*>*)
 
 text \<open>\noindent This works because we can easily prove that for any \<open>ns\<close>,
  the \<open>\<lambda>\<close>-term produces an acyclic list.
 But it requires the possibly expensive check @{prop "acyclic(rel ns)"}.\<close>
 
 definition "follow_test ns n = follow2 (is_acyc ns) n"
 
 text \<open>The relation is acyclic (a chain):\<close>
 
 value "follow_test [1,2,3] 1"
 
 text \<open>In the second approach, wellformedness of the argument is guaranteed by construction.
 In our example \<open>[1..<n+1]\<close> represents an acyclic chain \<open>i \<mapsto> i+1\<close>\<close>
 
 lemma acyclic_chain: "acyclic (rel [1..<n+1])"
 (*<*)
 apply(induction n)
  apply (simp add: rel_def acyclic_def)
 apply (auto simp add: rel_def)
 by (metis atLeast_upt lessI lessThan_iff order_less_asym' rtranclE set_zip_rightD)
 (*>*)
 
 text \<open>\<close>
 lift_definition acyc_chain :: "nat \<Rightarrow> acyc" is "\<lambda>n. [1..<n+1]"
 (*<*)by (use acyclic_chain in auto)(*>*)
 
 text \<open>\<close>
 definition "follow_chain m n = follow2 (acyc_chain m) n"
 
 value "follow_chain 5 1"
 
 text \<open>The subtype approach requires neither tail-recursion nor \<open>option\<close> but you cannot easily modify
 arguments of the subtype except via existing functions on the subtype. Otherwise you need to inject
 some value into the subtype and that injection is not computable.
 \<close>
 (*<*)
 text \<open>The problem with subtypes: the Abs function must not be used explicitly.
 This can be avoided by using \<open>lift_definition\<close>. Example:\<close>
 
 typedef nat1 = "{n::nat. n > 0}"
 by auto
 print_theorems
 
 setup_lifting type_definition_nat1
 
 (* just boiler plate *)
 lift_definition mk1 :: "nat \<Rightarrow> nat1" is 
   "\<lambda>n. if n>0 then n else 1"
 by auto
 
 lift_definition g :: "nat1 \<Rightarrow> nat1" is
 "\<lambda>n. if n \<ge> 2 then n-1 else n"
 by auto
 print_theorems
 text \<open>This generates
  \<open>g.rep_eq: Rep_nat1 (g x) = (if 2 \<le> Rep_nat1 x then Rep_nat1 x - 1 else Rep_nat1 x)\<close>
 which is acceptable as an abstract code eqn. The manual definition of
  \<open>g n1 = (let n = Rep_nat1 n1 in if 2 \<le> n then Abs_nat1 (n - 1) else Abs_nat1 n)\<close>
 looks non-executable but \<open>g.rep_eq\<close> can be derived from it.\<close>
 
 value "g (mk1 3)"
 
 text \<open>However, this trick does not work when passing an Abs-term as an argument,
 eg in a recursive call, because the Abs-term is `hidden' by the function call.\<close>
 (*>*)
 end
\ No newline at end of file
diff --git a/src/Doc/Codegen/Refinement.thy b/src/Doc/Codegen/Refinement.thy
--- a/src/Doc/Codegen/Refinement.thy
+++ b/src/Doc/Codegen/Refinement.thy
@@ -1,277 +1,277 @@
 theory Refinement
 imports Setup
 begin
 
 section \<open>Program and datatype refinement \label{sec:refinement}\<close>
 
 text \<open>
   Code generation by shallow embedding (cf.~\secref{sec:principle})
   allows to choose code equations and datatype constructors freely,
   given that some very basic syntactic properties are met; this
   flexibility opens up mechanisms for refinement which allow to extend
   the scope and quality of generated code dramatically.
 \<close>
 
 
 subsection \<open>Program refinement\<close>
 
 text \<open>
   Program refinement works by choosing appropriate code equations
   explicitly (cf.~\secref{sec:equations}); as example, we use Fibonacci
   numbers:
 \<close>
 
 fun %quote fib :: "nat \<Rightarrow> nat" where
     "fib 0 = 0"
   | "fib (Suc 0) = Suc 0"
   | "fib (Suc (Suc n)) = fib n + fib (Suc n)"
 
 text \<open>
   \noindent The runtime of the corresponding code grows exponential due
   to two recursive calls:
 \<close>
 
 text %quote \<open>
   @{code_stmts fib constant: fib (Haskell)}
 \<close>
 
 text \<open>
   \noindent A more efficient implementation would use dynamic
   programming, e.g.~sharing of common intermediate results between
   recursive calls.  This idea is expressed by an auxiliary operation
   which computes a Fibonacci number and its successor simultaneously:
 \<close>
 
 definition %quote fib_step :: "nat \<Rightarrow> nat \<times> nat" where
   "fib_step n = (fib (Suc n), fib n)"
 
 text \<open>
   \noindent This operation can be implemented by recursion using
   dynamic programming:
 \<close>
 
 lemma %quote [code]:
   "fib_step 0 = (Suc 0, 0)"
   "fib_step (Suc n) = (let (m, q) = fib_step n in (m + q, m))"
   by (simp_all add: fib_step_def)
 
 text \<open>
   \noindent What remains is to implement \<^const>\<open>fib\<close> by \<^const>\<open>fib_step\<close> as follows:
 \<close>
 
 lemma %quote [code]:
   "fib 0 = 0"
   "fib (Suc n) = fst (fib_step n)"
   by (simp_all add: fib_step_def)
 
 text \<open>
   \noindent The resulting code shows only linear growth of runtime:
 \<close>
 
 text %quote \<open>
   @{code_stmts fib constant: fib fib_step (Haskell)}
 \<close>
 
 
 subsection \<open>Datatype refinement\<close>
 
 text \<open>
   Selecting specific code equations \emph{and} datatype constructors
   leads to datatype refinement.  As an example, we will develop an
   alternative representation of the queue example given in
   \secref{sec:queue_example}.  The amortised representation is
   convenient for generating code but exposes its \qt{implementation}
   details, which may be cumbersome when proving theorems about it.
   Therefore, here is a simple, straightforward representation of
   queues:
 \<close>
 
 datatype %quote 'a queue = Queue "'a list"
 
 definition %quote empty :: "'a queue" where
   "empty = Queue []"
 
 primrec %quote enqueue :: "'a \<Rightarrow> 'a queue \<Rightarrow> 'a queue" where
   "enqueue x (Queue xs) = Queue (xs @ [x])"
 
 fun %quote dequeue :: "'a queue \<Rightarrow> 'a option \<times> 'a queue" where
     "dequeue (Queue []) = (None, Queue [])"
   | "dequeue (Queue (x # xs)) = (Some x, Queue xs)"
 
 text \<open>
   \noindent This we can use directly for proving;  for executing,
   we provide an alternative characterisation:
 \<close>
 
 definition %quote AQueue :: "'a list \<Rightarrow> 'a list \<Rightarrow> 'a queue" where
   "AQueue xs ys = Queue (ys @ rev xs)"
 
 code_datatype %quote AQueue
 
 text \<open>
   \noindent Here we define a \qt{constructor} \<^const>\<open>AQueue\<close> which
   is defined in terms of \<open>Queue\<close> and interprets its arguments
   according to what the \emph{content} of an amortised queue is supposed
   to be.
 
   The prerequisite for datatype constructors is only syntactical: a
   constructor must be of type \<open>\<tau> = \<dots> \<Rightarrow> \<kappa> \<alpha>\<^sub>1 \<dots> \<alpha>\<^sub>n\<close> where \<open>{\<alpha>\<^sub>1, \<dots>, \<alpha>\<^sub>n}\<close> is exactly the set of \emph{all} type variables in
   \<open>\<tau>\<close>; then \<open>\<kappa>\<close> is its corresponding datatype.  The
   HOL datatype package by default registers any new datatype with its
   constructors, but this may be changed using @{command_def
   code_datatype}; the currently chosen constructors can be inspected
   using the @{command print_codesetup} command.
 
   Equipped with this, we are able to prove the following equations
   for our primitive queue operations which \qt{implement} the simple
   queues in an amortised fashion:
 \<close>
 
 lemma %quote empty_AQueue [code]:
   "empty = AQueue [] []"
   by (simp add: AQueue_def empty_def)
 
 lemma %quote enqueue_AQueue [code]:
   "enqueue x (AQueue xs ys) = AQueue (x # xs) ys"
   by (simp add: AQueue_def)
 
 lemma %quote dequeue_AQueue [code]:
   "dequeue (AQueue xs []) =
     (if xs = [] then (None, AQueue [] [])
     else dequeue (AQueue [] (rev xs)))"
   "dequeue (AQueue xs (y # ys)) = (Some y, AQueue xs ys)"
   by (simp_all add: AQueue_def)
 
 text \<open>
   \noindent It is good style, although no absolute requirement, to
   provide code equations for the original artefacts of the implemented
   type, if possible; in our case, these are the datatype constructor
   \<^const>\<open>Queue\<close> and the case combinator \<^const>\<open>case_queue\<close>:
 \<close>
 
 lemma %quote Queue_AQueue [code]:
   "Queue = AQueue []"
   by (simp add: AQueue_def fun_eq_iff)
 
 lemma %quote case_queue_AQueue [code]:
   "case_queue f (AQueue xs ys) = f (ys @ rev xs)"
   by (simp add: AQueue_def)
 
 text \<open>
   \noindent The resulting code looks as expected:
 \<close>
 
 text %quote \<open>
   @{code_stmts empty enqueue dequeue Queue case_queue (SML)}
 \<close>
 
 text \<open>
   The same techniques can also be applied to types which are not
   specified as datatypes, e.g.~type \<^typ>\<open>int\<close> is originally specified
   as quotient type by means of @{command_def typedef}, but for code
   generation constants allowing construction of binary numeral values
   are used as constructors for \<^typ>\<open>int\<close>.
 
   This approach however fails if the representation of a type demands
   invariants; this issue is discussed in the next section.
 \<close>
 
 
 subsection \<open>Datatype refinement involving invariants \label{sec:invariant}\<close>
 
 text \<open>
   Datatype representation involving invariants require a dedicated
   setup for the type and its primitive operations.  As a running
   example, we implement a type \<^typ>\<open>'a dlist\<close> of lists consisting
   of distinct elements.
 
   The specification of \<^typ>\<open>'a dlist\<close> itself can be found in theory
   \<^theory>\<open>HOL-Library.Dlist\<close>.
 
   The first step is to decide on which representation the abstract
   type (in our example \<^typ>\<open>'a dlist\<close>) should be implemented.
   Here we choose \<^typ>\<open>'a list\<close>.  Then a conversion from the concrete
   type to the abstract type must be specified, here:
 \<close>
 
 text %quote \<open>
   \<^term_type>\<open>Dlist\<close>
 \<close>
 
 text \<open>
   \noindent Next follows the specification of a suitable \emph{projection},
   i.e.~a conversion from abstract to concrete type:
 \<close>
 
 text %quote \<open>
   \<^term_type>\<open>list_of_dlist\<close>
 \<close>
 
 text \<open>
   \noindent This projection must be specified such that the following
   \emph{abstract datatype certificate} can be proven:
 \<close>
 
 lemma %quote [code abstype]:
   "Dlist (list_of_dlist dxs) = dxs"
   by (fact Dlist_list_of_dlist)
 
 text \<open>
   \noindent Note that so far the invariant on representations
   (\<^term_type>\<open>distinct\<close>) has never been mentioned explicitly:
   the invariant is only referred to implicitly: all values in
   set \<^term>\<open>{xs. list_of_dlist (Dlist xs) = xs}\<close> are invariant,
   and in our example this is exactly \<^term>\<open>{xs. distinct xs}\<close>.
   
   The primitive operations on \<^typ>\<open>'a dlist\<close> are specified
   indirectly using the projection \<^const>\<open>list_of_dlist\<close>.  For
   the empty \<open>dlist\<close>, \<^const>\<open>Dlist.empty\<close>, we finally want
   the code equation
 \<close>
 
 text %quote \<open>
   \<^term>\<open>Dlist.empty = Dlist []\<close>
 \<close>
 
 text \<open>
   \noindent This we have to prove indirectly as follows:
 \<close>
 
 lemma %quote [code]:
   "list_of_dlist Dlist.empty = []"
   by (fact list_of_dlist_empty)
 
 text \<open>
   \noindent This equation logically encodes both the desired code
   equation and that the expression \<^const>\<open>Dlist\<close> is applied to obeys
   the implicit invariant.  Equations for insertion and removal are
   similar:
 \<close>
 
 lemma %quote [code]:
   "list_of_dlist (Dlist.insert x dxs) = List.insert x (list_of_dlist dxs)"
   by (fact list_of_dlist_insert)
 
 lemma %quote [code]:
   "list_of_dlist (Dlist.remove x dxs) = remove1 x (list_of_dlist dxs)"
   by (fact list_of_dlist_remove)
 
 text \<open>
   \noindent Then the corresponding code is as follows:
 \<close>
 
 text %quote \<open>
   @{code_stmts Dlist.empty Dlist.insert Dlist.remove list_of_dlist (SML)}
 \<close>
 
 text \<open>
-  See further @{cite "Haftmann-Kraus-Kuncar-Nipkow:2013:data_refinement"}
+  See further \<^cite>\<open>"Haftmann-Kraus-Kuncar-Nipkow:2013:data_refinement"\<close>
   for the meta theory of datatype refinement involving invariants.
 
   Typical data structures implemented by representations involving
   invariants are available in the library, theory \<^theory>\<open>HOL-Library.Mapping\<close>
   specifies key-value-mappings (type \<^typ>\<open>('a, 'b) mapping\<close>);
   these can be implemented by red-black-trees (theory \<^theory>\<open>HOL-Library.RBT\<close>).
 \<close>
 
 end
diff --git a/src/Doc/Corec/Corec.thy b/src/Doc/Corec/Corec.thy
--- a/src/Doc/Corec/Corec.thy
+++ b/src/Doc/Corec/Corec.thy
@@ -1,971 +1,971 @@
 (*  Title:      Doc/Corec/Corec.thy
     Author:     Jasmin Blanchette, Inria, LORIA, MPII
     Author:     Aymeric Bouzy, Ecole polytechnique
     Author:     Andreas Lochbihler, ETH Zuerich
     Author:     Andrei Popescu, Middlesex University
     Author:     Dmitriy Traytel, ETH Zuerich
 
 Tutorial for nonprimitively corecursive definitions.
 *)
 
 theory Corec
 imports Main Datatypes.Setup "HOL-Library.BNF_Corec"
   "HOL-Library.FSet"
 begin
 
 section \<open>Introduction
   \label{sec:introduction}\<close>
 
 text \<open>
-Isabelle's (co)datatype package @{cite "isabelle-datatypes"} offers a convenient
+Isabelle's (co)datatype package \<^cite>\<open>"isabelle-datatypes"\<close> offers a convenient
 syntax for introducing codatatypes. For example, the type of (infinite) streams
 can be defined as follows (cf. \<^file>\<open>~~/src/HOL/Library/Stream.thy\<close>):
 \<close>
 
     codatatype 'a stream =
       SCons (shd: 'a) (stl: "'a stream")
 
 text \<open>
 \noindent
 The (co)datatype package also provides two commands, \keyw{primcorec} and
 \keyw{prim\-corec\-ur\-sive}, for defining primitively corecursive functions.
 
 This tutorial presents a definitional package for functions beyond
 primitive corecursion. It describes @{command corec} and related commands:\
 @{command corecursive}, @{command friend_of_corec}, and @{command coinduction_upto}.
 It also covers the @{method corec_unique} proof method.
 The package is not part of \<^theory>\<open>Main\<close>; it is located in
 \<^file>\<open>~~/src/HOL/Library/BNF_Corec.thy\<close>.
 
 The @{command corec} command generalizes \keyw{primcorec} in three main
 respects. First, it allows multiple constructors around corecursive calls, where
 \keyw{primcorec} expects exactly one. For example:
 \<close>
 
     corec oneTwos :: "nat stream" where
       "oneTwos = SCons 1 (SCons 2 oneTwos)"
 
 text \<open>
 Second, @{command corec} allows other functions than constructors to appear in
 the corecursive call context (i.e., around any self-calls on the right-hand side
 of the equation). The requirement on these functions is that they must be
 \emph{friendly}. Intuitively, a function is friendly if it needs to destruct
 at most one constructor of input to produce one constructor of output.
 We can register functions as friendly using the @{command friend_of_corec}
 command, or by passing the \<open>friend\<close> option to @{command corec}. The
 friendliness check relies on an internal syntactic check in combination with
 a parametricity subgoal, which must be discharged manually (typically using
 @{method transfer_prover} or @{method transfer_prover_eq}).
 
 Third, @{command corec} allows self-calls that are not guarded by a constructor,
 as long as these calls occur in a friendly context (a context consisting
 exclusively of friendly functions) and can be shown to be terminating
 (well founded). The mixture of recursive and corecursive calls in a single
 function can be quite useful in practice.
 
 Internally, the package synthesizes corecursors that take into account the
 possible call contexts. The corecursor is accompanined by a corresponding,
 equally general coinduction principle. The corecursor and the coinduction
 principle grow in expressiveness as we interact with it. In process algebra
 terminology, corecursion and coinduction take place \emph{up to} friendly
 contexts.
 
-The package fully adheres to the LCF philosophy @{cite mgordon79}: The
+The package fully adheres to the LCF philosophy \<^cite>\<open>mgordon79\<close>: The
 characteristic theorems associated with the specified corecursive functions are
 derived rather than introduced axiomatically.
 (Exceptionally, most of the internal proof obligations are omitted if the
 \<open>quick_and_dirty\<close> option is enabled.)
 The package is described in a pair of scientific papers
-@{cite "blanchette-et-al-2015-fouco" and "blanchette-et-al-201x-amico"}. Some
+\<^cite>\<open>"blanchette-et-al-2015-fouco" and "blanchette-et-al-201x-amico"\<close>. Some
 of the text and examples below originate from there.
 
 This tutorial is organized as follows:
 
 \begin{itemize}
 \setlength{\itemsep}{0pt}
 
 \item Section \ref{sec:introductory-examples}, ``Introductory Examples,''
 describes how to specify corecursive functions and to reason about them.
 
 \item Section \ref{sec:command-syntax}, ``Command Syntax,'' describes the syntax
 of the commands offered by the package.
 
 \item Section \ref{sec:generated-theorems}, ``Generated Theorems,'' lists the
 theorems produced by the package's commands.
 
 \item Section \ref{sec:proof-methods}, ``Proof Methods,'' briefly describes the
 @{method corec_unique} and @{method transfer_prover_eq} proof methods.
 
 \item Section \ref{sec:attribute}, ``Attribute,'' briefly describes the
 @{attribute friend_of_corec_simps} attribute, which can be used to strengthen
 the tactics underlying the @{command friend_of_corec} and @{command corec}
 \<open>(friend)\<close> commands.
 
 \item Section \ref{sec:known-bugs-and-limitations}, ``Known Bugs and
 Limitations,'' concludes with known open issues.
 \end{itemize}
 
 Although it is more powerful than \keyw{primcorec} in many respects,
 @{command corec} suffers from a number of limitations. Most notably, it does
 not support mutually corecursive codatatypes, and it is less efficient than
 \keyw{primcorec} because it needs to dynamically synthesize corecursors and
 corresponding coinduction principles to accommodate the friends.
 
 \newbox\boxA
 \setbox\boxA=\hbox{\texttt{NOSPAM}}
 
 \newcommand\authoremaili{\texttt{jasmin.blan{\color{white}NOSPAM}\kern-\wd\boxA{}chette@\allowbreak
 gmail.\allowbreak com}}
 
 Comments and bug reports concerning either the package or this tutorial should
 be directed to the first author at \authoremaili{} or to the
 \texttt{cl-isabelle-users} mailing list.
 \<close>
 
 
 section \<open>Introductory Examples
   \label{sec:introductory-examples}\<close>
 
 text \<open>
 The package is illustrated through concrete examples featuring different flavors
 of corecursion. More examples can be found in the directory
 \<^dir>\<open>~~/src/HOL/Corec_Examples\<close>.
 \<close>
 
 
 subsection \<open>Simple Corecursion
   \label{ssec:simple-corecursion}\<close>
 
 text \<open>
-The case studies by Rutten~@{cite rutten05} and Hinze~@{cite hinze10} on stream
+The case studies by Rutten~\<^cite>\<open>rutten05\<close> and Hinze~\<^cite>\<open>hinze10\<close> on stream
 calculi serve as our starting point. The following definition of pointwise sum
 can be performed with either \keyw{primcorec} or @{command corec}:
 \<close>
 
     primcorec ssum :: "('a :: plus) stream \<Rightarrow> 'a stream \<Rightarrow> 'a stream" where
       "ssum xs ys = SCons (shd xs + shd ys) (ssum (stl xs) (stl ys))"
 
 text \<open>
 \noindent
 Pointwise sum meets the friendliness criterion. We register it as a friend using
 the @{command friend_of_corec} command. The command requires us to give a
 specification of \<^const>\<open>ssum\<close> where a constructor (\<^const>\<open>SCons\<close>) occurs at
 the outermost position on the right-hand side. Here, we can simply reuse the
 \keyw{primcorec} specification above:
 \<close>
 
     friend_of_corec ssum :: "('a :: plus) stream \<Rightarrow> 'a stream \<Rightarrow> 'a stream" where
       "ssum xs ys = SCons (shd xs + shd ys) (ssum (stl xs) (stl ys))"
        apply (rule ssum.code)
       by transfer_prover
 
 text \<open>
 \noindent
 The command emits two subgoals. The first subgoal corresponds to the equation we
 specified and is trivial to discharge. The second subgoal is a parametricity
 property that captures the the requirement that the function may destruct at
 most one constructor of input to produce one constructor of output. This subgoal
 can usually be discharged using the \<open>transfer_prover\<close> or
 @{method transfer_prover_eq} proof method (Section~\ref{ssec:transfer-prover-eq}).
 The latter replaces equality relations by their relator terms according to the
 @{thm [source] relator_eq} theorem collection before it invokes
 @{method transfer_prover}.
 
 After registering \<^const>\<open>ssum\<close> as a friend, we can use it in the corecursive
 call context, either inside or outside the constructor guard:
 \<close>
 
     corec fibA :: "nat stream" where
       "fibA = SCons 0 (ssum (SCons 1 fibA) fibA)"
 
 text \<open>\blankline\<close>
 
     corec fibB :: "nat stream" where
       "fibB = ssum (SCons 0 (SCons 1 fibB)) (SCons 0 fibB)"
 
 text \<open>
 Using the \<open>friend\<close> option, we can simultaneously define a function and
 register it as a friend:
 \<close>
 
     corec (friend)
       sprod :: "('a :: {plus,times}) stream \<Rightarrow> 'a stream \<Rightarrow> 'a stream"
     where
       "sprod xs ys =
        SCons (shd xs * shd ys) (ssum (sprod xs (stl ys)) (sprod (stl xs) ys))"
 
 text \<open>\blankline\<close>
 
     corec (friend) sexp :: "nat stream \<Rightarrow> nat stream" where
       "sexp xs = SCons (2 ^^ shd xs) (sprod (stl xs) (sexp xs))"
 
 text \<open>
 \noindent
 The parametricity subgoal is given to \<open>transfer_prover_eq\<close>
 (Section~\ref{ssec:transfer-prover-eq}).
 
 The \<^const>\<open>sprod\<close> and \<^const>\<open>sexp\<close> functions provide shuffle product and
 exponentiation on streams. We can use them to define the stream of factorial
 numbers in two different ways:
 \<close>
 
     corec factA :: "nat stream" where
       "factA = (let zs = SCons 1 factA in sprod zs zs)"
 
 text \<open>\blankline\<close>
 
     corec factB :: "nat stream" where
       "factB = sexp (SCons 0 factB)"
 
 text \<open>
 The arguments of friendly functions can be of complex types involving the
 target codatatype. The following example defines the supremum of a finite set of
 streams by primitive corecursion and registers it as friendly:
 \<close>
 
     corec (friend) sfsup :: "nat stream fset \<Rightarrow> nat stream" where
       "sfsup X = SCons (Sup (fset (fimage shd X))) (sfsup (fimage stl X))"
 
 text \<open>
 \noindent
 In general, the arguments may be any bounded natural functor (BNF)
-@{cite "isabelle-datatypes"}, with the restriction that the target codatatype
+\<^cite>\<open>"isabelle-datatypes"\<close>, with the restriction that the target codatatype
 (\<^typ>\<open>nat stream\<close>) may occur only in a \emph{live} position of the BNF. For
 this reason, the following function, on unbounded sets, cannot be registered as
 a friend:
 \<close>
 
     primcorec ssup :: "nat stream set \<Rightarrow> nat stream" where
       "ssup X = SCons (Sup (image shd X)) (ssup (image stl X))"
 
 
 subsection \<open>Nested Corecursion
   \label{ssec:nested-corecursion}\<close>
 
 text \<open>
 The package generally supports arbitrary codatatypes with multiple constructors
 and nesting through other type constructors (BNFs). Consider the following type
 of finitely branching Rose trees of potentially infinite depth:
 \<close>
 
     codatatype 'a tree =
       Node (lab: 'a) (sub: "'a tree list")
 
 text \<open>
 We first define the pointwise sum of two trees analogously to \<^const>\<open>ssum\<close>:
 \<close>
 
     corec (friend) tsum :: "('a :: plus) tree \<Rightarrow> 'a tree \<Rightarrow> 'a tree" where
       "tsum t u =
        Node (lab t + lab u) (map (\<lambda>(t', u'). tsum t' u') (zip (sub t) (sub u)))"
 
 text \<open>
 \noindent
 Here, \<^const>\<open>map\<close> is the standard map function on lists, and \<^const>\<open>zip\<close>
 converts two parallel lists into a list of pairs. The \<^const>\<open>tsum\<close> function is
 primitively corecursive. Instead of @{command corec} \<open>(friend)\<close>, we could
 also have used \keyw{primcorec} and @{command friend_of_corec}, as we did for
 \<^const>\<open>ssum\<close>.
 
 Once \<^const>\<open>tsum\<close> is registered as friendly, we can use it in the corecursive
 call context of another function:
 \<close>
 
     corec (friend) ttimes :: "('a :: {plus,times}) tree \<Rightarrow> 'a tree \<Rightarrow> 'a tree" where
       "ttimes t u = Node (lab t * lab u)
          (map (\<lambda>(t', u'). tsum (ttimes t u') (ttimes t' u)) (zip (sub t) (sub u)))"
 
 text \<open>
 All the syntactic convenience provided by \keyw{primcorec} is also supported by
 @{command corec}, @{command corecursive}, and @{command friend_of_corec}. In
 particular, nesting through the function type can be expressed using
 \<open>\<lambda>\<close>-abstractions and function applications rather than through composition
 (\<^term>\<open>(\<circ>)\<close>, the map function for \<open>\<Rightarrow>\<close>). For example:
 \<close>
 
     codatatype 'a language =
       Lang (\<oo>: bool) (\<dd>: "'a \<Rightarrow> 'a language")
 
 text \<open>\blankline\<close>
 
     corec (friend) Plus :: "'a language \<Rightarrow> 'a language \<Rightarrow> 'a language" where
       "Plus r s = Lang (\<oo> r \<or> \<oo> s) (\<lambda>a. Plus (\<dd> r a) (\<dd> s a))"
 
 text \<open>\blankline\<close>
 
     corec (friend) Times :: "'a language \<Rightarrow> 'a language \<Rightarrow> 'a language" where
       "Times r s = Lang (\<oo> r \<and> \<oo> s)
          (\<lambda>a. if \<oo> r then Plus (Times (\<dd> r a) s) (\<dd> s a) else Times (\<dd> r a) s)"
 
 text \<open>\blankline\<close>
 
     corec (friend) Star :: "'a language \<Rightarrow> 'a language" where
       "Star r = Lang True (\<lambda>a. Times (\<dd> r a) (Star r))"
 
 text \<open>\blankline\<close>
 
     corec (friend) Inter :: "'a language \<Rightarrow> 'a language \<Rightarrow> 'a language" where
       "Inter r s = Lang (\<oo> r \<and> \<oo> s) (\<lambda>a. Inter (\<dd> r a) (\<dd> s a))"
 
 text \<open>\blankline\<close>
 
     corec (friend) PLUS :: "'a language list \<Rightarrow> 'a language" where
       "PLUS xs = Lang (\<exists>x \<in> set xs. \<oo> x) (\<lambda>a. PLUS (map (\<lambda>r. \<dd> r a) xs))"
 
 
 subsection \<open>Mixed Recursion--Corecursion
   \label{ssec:mixed-recursion-corecursion}\<close>
 
 text \<open>
 It is often convenient to let a corecursive function perform some finite
 computation before producing a constructor. With mixed recursion--corecursion, a
 finite number of unguarded recursive calls perform this calculation before
 reaching a guarded corecursive call. Intuitively, the unguarded recursive call
 can be unfolded to arbitrary finite depth, ultimately yielding a purely
 corecursive definition. An example is the \<^term>\<open>primes\<close> function from Di
-Gianantonio and Miculan @{cite "di-gianantonio-miculan-2003"}:
+Gianantonio and Miculan \<^cite>\<open>"di-gianantonio-miculan-2003"\<close>:
 \<close>
 
     corecursive primes :: "nat \<Rightarrow> nat \<Rightarrow> nat stream" where
       "primes m n =
        (if (m = 0 \<and> n > 1) \<or> coprime m n then
           SCons n (primes (m * n) (n + 1))
         else
           primes m (n + 1))"
       apply (relation "measure (\<lambda>(m, n).
         if n = 0 then 1 else if coprime m n then 0 else m - n mod m)")
        apply (auto simp: mod_Suc diff_less_mono2 intro: Suc_lessI elim!: not_coprimeE)
       apply (metis dvd_1_iff_1 dvd_eq_mod_eq_0 mod_0 mod_Suc mod_Suc_eq mod_mod_cancel)
       done
 
 text \<open>
 \noindent
 The @{command corecursive} command is a variant of @{command corec} that allows
 us to specify a termination argument for any unguarded self-call.
 
 When called with \<open>m = 1\<close> and \<open>n = 2\<close>, the \<^const>\<open>primes\<close>
 function computes the stream of prime numbers. The unguarded call in the
 \<open>else\<close> branch increments \<^term>\<open>n\<close> until it is coprime to the first
 argument \<^term>\<open>m\<close> (i.e., the greatest common divisor of \<^term>\<open>m\<close> and
 \<^term>\<open>n\<close> is \<open>1\<close>).
 
 For any positive integers \<^term>\<open>m\<close> and \<^term>\<open>n\<close>, the numbers \<^term>\<open>m\<close> and
 \<open>m * n + 1\<close> are coprime, yielding an upper bound on the number of times
 \<^term>\<open>n\<close> is increased. Hence, the function will take the \<open>else\<close> branch at
 most finitely often before taking the then branch and producing one constructor.
 There is a slight complication when \<open>m = 0 \<and> n > 1\<close>: Without the first
 disjunct in the \<open>if\<close> condition, the function could stall. (This corner
 case was overlooked in the original example
-@{cite "di-gianantonio-miculan-2003"}.)
+\<^cite>\<open>"di-gianantonio-miculan-2003"\<close>.)
 
 In the following examples, termination is discharged automatically by
 @{command corec} by invoking @{method lexicographic_order}:
 \<close>
 
     corec catalan :: "nat \<Rightarrow> nat stream" where
       "catalan n =
        (if n > 0 then ssum (catalan (n - 1)) (SCons 0 (catalan (n + 1)))
         else SCons 1 (catalan 1))"
 
 text \<open>\blankline\<close>
 
     corec collatz :: "nat \<Rightarrow> nat stream" where
       "collatz n = (if even n \<and> n > 0 then collatz (n div 2)
          else SCons n (collatz (3 * n + 1)))"
 
 text \<open>
 A more elaborate case study, revolving around the filter function on lazy lists,
 is presented in \<^file>\<open>~~/src/HOL/Corec_Examples/LFilter.thy\<close>.
 \<close>
 
 
 subsection \<open>Self-Friendship
   \label{ssec:self-friendship}\<close>
 
 text \<open>
 The package allows us to simultaneously define a function and use it as its own
 friend, as in the following definition of a ``skewed product'':
 \<close>
 
     corec (friend)
       sskew :: "('a :: {plus,times}) stream \<Rightarrow> 'a stream \<Rightarrow> 'a stream"
     where
       "sskew xs ys =
        SCons (shd xs * shd ys) (sskew (sskew xs (stl ys)) (sskew (stl xs) ys))"
 
 text \<open>
 \noindent
 Such definitions, with nested self-calls on the right-hand side, cannot be
 separated into a @{command corec} part and a @{command friend_of_corec} part.
 \<close>
 
 
 subsection \<open>Coinduction
   \label{ssec:coinduction}\<close>
 
 text \<open>
 Once a corecursive specification has been accepted, we normally want to reason
 about it. The \<open>codatatype\<close> command generates a structural coinduction
 principle that matches primitively corecursive functions. For nonprimitive
 specifications, our package provides the more advanced proof principle of
 \emph{coinduction up to congruence}---or simply \emph{coinduction up-to}.
 
 The structural coinduction principle for \<^typ>\<open>'a stream\<close>, called
 @{thm [source] stream.coinduct}, is as follows:
 %
 \begin{indentblock}
 @{thm stream.coinduct[no_vars]}
 \end{indentblock}
 %
 Coinduction allows us to prove an equality \<open>l = r\<close> on streams by
 providing a relation \<open>R\<close> that relates \<open>l\<close> and \<open>r\<close> (first
 premise) and that constitutes a bisimulation (second premise). Streams that are
 related by a bisimulation cannot be distinguished by taking observations (via
 the selectors \<^const>\<open>shd\<close> and \<^const>\<open>stl\<close>); hence they must be equal.
 
 The coinduction up-to principle after registering \<^const>\<open>sskew\<close> as friendly is
 available as @{thm [source] sskew.coinduct} and as one of the components of
 the theorem collection @{thm [source] stream.coinduct_upto}:
 %
 \begin{indentblock}
 @{thm sskew.coinduct[no_vars]}
 \end{indentblock}
 %
 This rule is almost identical to structural coinduction, except that the
 corecursive application of \<^term>\<open>R\<close> is generalized to
 \<^term>\<open>stream.v5.congclp R\<close>.
 
 The \<^const>\<open>stream.v5.congclp\<close> predicate is equipped with the following
 introduction rules:
 
 \begin{indentblock}
 \begin{description}
 
 \item[@{thm [source] sskew.cong_base}\rm:] ~ \\
 @{thm sskew.cong_base[no_vars]}
 
 \item[@{thm [source] sskew.cong_refl}\rm:] ~ \\
 @{thm sskew.cong_refl[no_vars]}
 
 \item[@{thm [source] sskew.cong_sym}\rm:] ~ \\
 @{thm sskew.cong_sym[no_vars]}
 
 \item[@{thm [source] sskew.cong_trans}\rm:] ~ \\
 @{thm sskew.cong_trans[no_vars]}
 
 \item[@{thm [source] sskew.cong_SCons}\rm:] ~ \\
 @{thm sskew.cong_SCons[no_vars]}
 
 \item[@{thm [source] sskew.cong_ssum}\rm:] ~ \\
 @{thm sskew.cong_ssum[no_vars]}
 
 \item[@{thm [source] sskew.cong_sprod}\rm:] ~ \\
 @{thm sskew.cong_sprod[no_vars]}
 
 \item[@{thm [source] sskew.cong_sskew}\rm:] ~ \\
 @{thm sskew.cong_sskew[no_vars]}
 
 \end{description}
 \end{indentblock}
 %
 The introduction rules are also available as
 @{thm [source] sskew.cong_intros}.
 
 Notice that there is no introduction rule corresponding to \<^const>\<open>sexp\<close>,
 because \<^const>\<open>sexp\<close> has a more restrictive result type than \<^const>\<open>sskew\<close>
 (\<^typ>\<open>nat stream\<close> vs. \<^typ>\<open>('a :: {plus,times}) stream\<close>.
 
 The version numbers, here \<open>v5\<close>, distinguish the different congruence
 closures generated for a given codatatype as more friends are registered. As
 much as possible, it is recommended to avoid referring to them in proof
 documents.
 
 Since the package maintains a set of incomparable corecursors, there is also a
 set of associated coinduction principles and a set of sets of introduction
 rules. A technically subtle point is to make Isabelle choose the right rules in
 most situations. For this purpose, the package maintains the collection
 @{thm [source] stream.coinduct_upto} of coinduction principles ordered by
 increasing generality, which works well with Isabelle's philosophy of applying
 the first rule that matches. For example, after registering \<^const>\<open>ssum\<close> as a
 friend, proving the equality \<^term>\<open>l = r\<close> on \<^typ>\<open>nat stream\<close> might
 require coinduction principle for \<^term>\<open>nat stream\<close>, which is up to
 \<^const>\<open>ssum\<close>.
 
 The collection @{thm [source] stream.coinduct_upto} is guaranteed to be complete
 and up to date with respect to the type instances of definitions considered so
 far, but occasionally it may be necessary to take the union of two incomparable
 coinduction principles. This can be done using the @{command coinduction_upto}
 command. Consider the following definitions:
 \<close>
 
     codatatype ('a, 'b) tllist =
       TNil (terminal: 'b)
     | TCons (thd: 'a) (ttl: "('a, 'b) tllist")
 
 text \<open>\blankline\<close>
 
     corec (friend) square_elems :: "(nat, 'b) tllist \<Rightarrow> (nat, 'b) tllist" where
       "square_elems xs =
        (case xs of
          TNil z \<Rightarrow> TNil z
        | TCons y ys \<Rightarrow> TCons (y ^^ 2) (square_elems ys))"
 
 text \<open>\blankline\<close>
 
     corec (friend) square_terminal :: "('a, int) tllist \<Rightarrow> ('a, int) tllist" where
       "square_terminal xs =
        (case xs of
          TNil z \<Rightarrow> TNil (z ^^ 2)
        | TCons y ys \<Rightarrow> TCons y (square_terminal ys))"
 
 text \<open>
 At this point, @{thm [source] tllist.coinduct_upto} contains three variants of the
 coinduction principles:
 %
 \begin{itemize}
 \item \<^typ>\<open>('a, int) tllist\<close> up to \<^const>\<open>TNil\<close>, \<^const>\<open>TCons\<close>, and
   \<^const>\<open>square_terminal\<close>;
 \item \<^typ>\<open>(nat, 'b) tllist\<close> up to \<^const>\<open>TNil\<close>, \<^const>\<open>TCons\<close>, and
   \<^const>\<open>square_elems\<close>;
 \item \<^typ>\<open>('a, 'b) tllist\<close> up to \<^const>\<open>TNil\<close> and \<^const>\<open>TCons\<close>.
 \end{itemize}
 %
 The following variant is missing:
 %
 \begin{itemize}
 \item \<^typ>\<open>(nat, int) tllist\<close> up to \<^const>\<open>TNil\<close>, \<^const>\<open>TCons\<close>,
   \<^const>\<open>square_elems\<close>, and \<^const>\<open>square_terminal\<close>.
 \end{itemize}
 %
 To generate it without having to define a new function with @{command corec},
 we can use the following command:
 \<close>
 
     coinduction_upto nat_int_tllist: "(nat, int) tllist"
 
 text \<open>
 \noindent
 This produces the theorems
 %
 \begin{indentblock}
 @{thm [source] nat_int_tllist.coinduct_upto} \\
 @{thm [source] nat_int_tllist.cong_intros}
 \end{indentblock}
 %
 (as well as the individually named introduction rules) and extends
 the dynamic collections @{thm [source] tllist.coinduct_upto} and
 @{thm [source] tllist.cong_intros}.
 \<close>
 
 
 subsection \<open>Uniqueness Reasoning
   \label{ssec:uniqueness-reasoning}\<close>
 
 text \<open>
 It is sometimes possible to achieve better automation by using a more
 specialized proof method than coinduction. Uniqueness principles maintain a good
 balance between expressiveness and automation. They exploit the property that a
 corecursive definition is the unique solution to a fixpoint equation.
 
 The @{command corec}, @{command corecursive}, and @{command friend_of_corec}
 commands generate a property \<open>f.unique\<close> about the function of interest
 \<^term>\<open>f\<close> that can be used to prove that any function that satisfies
 \<^term>\<open>f\<close>'s corecursive specification must be equal to~\<^term>\<open>f\<close>. For example:
 \[@{thm ssum.unique[no_vars]}\]
 
 The uniqueness principles are not restricted to functions defined using
 @{command corec} or @{command corecursive} or registered with
 @{command friend_of_corec}. Suppose \<^term>\<open>t x\<close> is an arbitrary term
 depending on \<^term>\<open>x\<close>. The @{method corec_unique} proof method, provided by our
 tool, transforms subgoals of the form
 \[\<^term>\<open>(\<forall>x. f x = H x f) \<Longrightarrow> f x = t x\<close>\]
 into
 \[\<^term>\<open>\<forall>x. t x = H x t\<close>\]
 The higher-order functional \<^term>\<open>H\<close> must be such that \<^term>\<open>f x = H x f\<close>
 would be a valid @{command corec} specification, but without nested self-calls
 or unguarded (recursive) calls. Thus, @{method corec_unique} proves uniqueness
 of \<^term>\<open>t\<close> with respect to the given corecursive equation regardless of how
 \<^term>\<open>t\<close> was defined. For example:
 \<close>
 
     lemma
       fixes f :: "nat stream \<Rightarrow> nat stream \<Rightarrow> nat stream"
       assumes "\<forall>xs ys. f xs ys =
         SCons (shd ys * shd xs) (ssum (f xs (stl ys)) (f (stl xs) ys))"
       shows "f = sprod"
         using assms
       proof corec_unique
         show "sprod = (\<lambda>xs ys :: nat stream.
             SCons (shd ys * shd xs) (ssum (sprod xs (stl ys)) (sprod (stl xs) ys)))"
           apply (rule ext)+
           apply (subst sprod.code)
           by simp
       qed
 
 text \<open>
 The proof method relies on some theorems generated by the package. If no function
 over a given codatatype has been defined using @{command corec} or
 @{command corecursive} or registered as friendly using @{command friend_of_corec},
 the theorems will not be available yet. In such cases, the theorems can be
 explicitly generated using the command
 \<close>
 
     coinduction_upto stream: "'a stream"
 
 
 section \<open>Command Syntax
   \label{sec:command-syntax}\<close>
 
 subsection \<open>\keyw{corec} and \keyw{corecursive}
   \label{ssec:corec-and-corecursive-syntax}\<close>
 
 text \<open>
 \begin{matharray}{rcl}
   @{command_def "corec"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
   @{command_def "corecursive"} & : & \<open>local_theory \<rightarrow> proof(prove)\<close>
 \end{matharray}
 
 \<^rail>\<open>
   (@@{command corec} | @@{command corecursive}) target? \<newline>
     @{syntax cr_options}? fix @'where' prop
   ;
   @{syntax_def cr_options}: '(' ((@{syntax plugins} | 'friend' | 'transfer') + ',') ')'
 \<close>
 
 \medskip
 
 \noindent
 The @{command corec} and @{command corecursive} commands introduce a corecursive
 function over a codatatype.
 
 The syntactic entity \synt{target} can be used to specify a local context,
 \synt{fix} denotes name with an optional type signature, and \synt{prop} denotes
-a HOL proposition @{cite "isabelle-isar-ref"}.
+a HOL proposition \<^cite>\<open>"isabelle-isar-ref"\<close>.
 
 The optional target is optionally followed by a combination of the following
 options:
 
 \begin{itemize}
 \setlength{\itemsep}{0pt}
 
 \item
 The \<open>plugins\<close> option indicates which plugins should be enabled
 (\<open>only\<close>) or disabled (\<open>del\<close>). By default, all plugins are enabled.
 
 \item
 The \<open>friend\<close> option indicates that the defined function should be
 registered as a friend. This gives rise to additional proof obligations.
 
 \item
 The \<open>transfer\<close> option indicates that an unconditional transfer rule
 should be generated and proved \<open>by transfer_prover\<close>. The
 \<open>[transfer_rule]\<close> attribute is set on the generated theorem.
 \end{itemize}
 
 The @{command corec} command is an abbreviation for @{command corecursive}
 with appropriate applications of @{method transfer_prover_eq}
 (Section~\ref{ssec:transfer-prover-eq}) and @{method lexicographic_order} to
 discharge any emerging proof obligations.
 \<close>
 
 
 subsection \<open>\keyw{friend_of_corec}
   \label{ssec:friend-of-corec-syntax}\<close>
 
 text \<open>
 \begin{matharray}{rcl}
   @{command_def "friend_of_corec"} & : & \<open>local_theory \<rightarrow> proof(prove)\<close>
 \end{matharray}
 
 \<^rail>\<open>
   @@{command friend_of_corec} target? \<newline>
     @{syntax foc_options}? fix @'where' prop
   ;
   @{syntax_def foc_options}: '(' ((@{syntax plugins} | 'transfer') + ',') ')'
 \<close>
 
 \medskip
 
 \noindent
 The @{command friend_of_corec} command registers a corecursive function as
 friendly.
 
 The syntactic entity \synt{target} can be used to specify a local context,
 \synt{fix} denotes name with an optional type signature, and \synt{prop} denotes
-a HOL proposition @{cite "isabelle-isar-ref"}.
+a HOL proposition \<^cite>\<open>"isabelle-isar-ref"\<close>.
 
 The optional target is optionally followed by a combination of the following
 options:
 
 \begin{itemize}
 \setlength{\itemsep}{0pt}
 
 \item
 The \<open>plugins\<close> option indicates which plugins should be enabled
 (\<open>only\<close>) or disabled (\<open>del\<close>). By default, all plugins are enabled.
 
 \item
 The \<open>transfer\<close> option indicates that an unconditional transfer rule
 should be generated and proved \<open>by transfer_prover\<close>. The
 \<open>[transfer_rule]\<close> attribute is set on the generated theorem.
 \end{itemize}
 \<close>
 
 
 subsection \<open>\keyw{coinduction_upto}
   \label{ssec:coinduction-upto-syntax}\<close>
 
 text \<open>
 \begin{matharray}{rcl}
   @{command_def "coinduction_upto"} & : & \<open>local_theory \<rightarrow> local_theory\<close>
 \end{matharray}
 
 \<^rail>\<open>
   @@{command coinduction_upto} target? name ':' type
 \<close>
 
 \medskip
 
 \noindent
 The @{command coinduction_upto} generates a coinduction up-to rule for a given
 instance of a (possibly polymorphic) codatatype and notes the result with the
 specified prefix.
 
 The syntactic entity \synt{name} denotes an identifier and \synt{type} denotes a
-type @{cite "isabelle-isar-ref"}.
+type \<^cite>\<open>"isabelle-isar-ref"\<close>.
 \<close>
 
 
 section \<open>Generated Theorems
   \label{sec:generated-theorems}\<close>
 
 text \<open>
 The full list of named theorems generated by the package can be obtained by
 issuing the command \keyw{print_theorems} immediately after the datatype definition.
 This list excludes low-level theorems that reveal internal constructions. To
 make these accessible, add the line
 \<close>
 
     declare [[bnf_internals]]
 (*<*)
     declare [[bnf_internals = false]]
 (*>*)
 
 text \<open>
 In addition to the theorem listed below for each command provided by the
 package, all commands update the dynamic theorem collections
 
 \begin{indentblock}
 \begin{description}
 
 \item[\<open>t.\<close>\hthm{coinduct_upto}]
 
 \item[\<open>t.\<close>\hthm{cong_intros}]
 
 \end{description}
 \end{indentblock}
 %
 for the corresponding codatatype \<open>t\<close> so that they always contain the most
 powerful coinduction up-to principles derived so far.
 \<close>
 
 
 subsection \<open>\keyw{corec} and \keyw{corecursive}
   \label{ssec:corec-and-corecursive-theorems}\<close>
 
 text \<open>
 For a function \<^term>\<open>f\<close> over codatatype \<open>t\<close>, the @{command corec} and
 @{command corecursive} commands generate the following properties (listed for
 \<^const>\<open>sexp\<close>, cf. Section~\ref{ssec:simple-corecursion}):
 
 \begin{indentblock}
 \begin{description}
 
 \item[\<open>f.\<close>\hthm{code} \<open>[code]\<close>\rm:] ~ \\
 @{thm sexp.code[no_vars]} \\
 The \<open>[code]\<close> attribute is set by the \<open>code\<close> plugin
-@{cite "isabelle-datatypes"}.
+\<^cite>\<open>"isabelle-datatypes"\<close>.
 
 \item[\<open>f.\<close>\hthm{coinduct} \<open>[consumes 1, case_names t, case_conclusion D\<^sub>1 \<dots>
   D\<^sub>n]\<close>\rm:] ~ \\
 @{thm sexp.coinduct[no_vars]}
 
 \item[\<open>f.\<close>\hthm{cong_intros}\rm:] ~ \\
 @{thm sexp.cong_intros[no_vars]}
 
 \item[\<open>f.\<close>\hthm{unique}\rm:] ~ \\
 @{thm sexp.unique[no_vars]} \\
 This property is not generated for mixed recursive--corecursive definitions.
 
 \item[\<open>f.\<close>\hthm{inner_induct}\rm:] ~ \\
 This property is only generated for mixed recursive--corecursive definitions.
 For \<^const>\<open>primes\<close> (Section~\ref{ssec:mixed-recursion-corecursion}, it reads as
 follows: \\[\jot]
 @{thm primes.inner_induct[no_vars]}
 
 \end{description}
 \end{indentblock}
 
 \noindent
 The individual rules making up \<open>f.cong_intros\<close> are available as
 
 \begin{indentblock}
 \begin{description}
 
 \item[\<open>f.\<close>\hthm{cong_base}]
 
 \item[\<open>f.\<close>\hthm{cong_refl}]
 
 \item[\<open>f.\<close>\hthm{cong_sym}]
 
 \item[\<open>f.\<close>\hthm{cong_trans}]
 
 \item[\<open>f.\<close>\hthm{cong_C}\<open>\<^sub>1\<close>, \ldots, \<open>f.\<close>\hthm{cong_C}\<open>\<^sub>n\<close>] ~ \\
 where \<open>C\<^sub>1\<close>, \<open>\<dots>\<close>, \<open>C\<^sub>n\<close> are \<open>t\<close>'s
 constructors
 
 \item[\<open>f.\<close>\hthm{cong_f}\<open>\<^sub>1\<close>, \ldots, \<open>f.\<close>\hthm{cong_f}\<open>\<^sub>m\<close>] ~ \\
 where \<open>f\<^sub>1\<close>, \<open>\<dots>\<close>, \<open>f\<^sub>m\<close> are the available
 friends for \<open>t\<close>
 
 \end{description}
 \end{indentblock}
 \<close>
 
 
 subsection \<open>\keyw{friend_of_corec}
   \label{ssec:friend-of-corec-theorems}\<close>
 
 text \<open>
 The @{command friend_of_corec} command generates the same theorems as
 @{command corec} and @{command corecursive}, except that it adds an optional
 \<open>friend.\<close> component to the names to prevent potential clashes (e.g.,
 \<open>f.friend.code\<close>).
 \<close>
 
 
 subsection \<open>\keyw{coinduction_upto}
   \label{ssec:coinduction-upto-theorems}\<close>
 
 text \<open>
 The @{command coinduction_upto} command generates the following properties
 (listed for \<open>nat_int_tllist\<close>):
 
 \begin{indentblock}
 \begin{description}
 
 \item[\begin{tabular}{@ {}l@ {}}
   \<open>t.\<close>\hthm{coinduct_upto} \<open>[consumes 1, case_names t,\<close> \\
   \phantom{\<open>t.\<close>\hthm{coinduct_upto} \<open>[\<close>}\<open>case_conclusion D\<^sub>1 \<dots>
   D\<^sub>n]\<close>\rm:
 \end{tabular}] ~ \\
 @{thm nat_int_tllist.coinduct_upto[no_vars]}
 
 \item[\<open>t.\<close>\hthm{cong_intros}\rm:] ~ \\
 @{thm nat_int_tllist.cong_intros[no_vars]}
 
 \end{description}
 \end{indentblock}
 
 \noindent
 The individual rules making up \<open>t.cong_intros\<close> are available
 separately as \<open>t.cong_base\<close>, \<open>t.cong_refl\<close>, etc.\
 (Section~\ref{ssec:corec-and-corecursive-theorems}).
 \<close>
 
 
 section \<open>Proof Methods
   \label{sec:proof-methods}\<close>
 
 subsection \<open>\textit{corec_unique}
   \label{ssec:corec-unique}\<close>
 
 text \<open>
 The @{method corec_unique} proof method can be used to prove the uniqueness of
 a corecursive specification. See Section~\ref{ssec:uniqueness-reasoning} for
 details.
 \<close>
 
 
 subsection \<open>\textit{transfer_prover_eq}
   \label{ssec:transfer-prover-eq}\<close>
 
 text \<open>
 The @{method transfer_prover_eq} proof method replaces the equality relation
 \<^term>\<open>(=)\<close> with compound relator expressions according to
 @{thm [source] relator_eq} before calling @{method transfer_prover} on the
 current subgoal. It tends to work better than plain @{method transfer_prover} on
 the parametricity proof obligations of @{command corecursive} and
 @{command friend_of_corec}, because they often contain equality relations on
 complex types, which @{method transfer_prover} cannot reason about.
 \<close>
 
 
 section \<open>Attribute
   \label{sec:attribute}\<close>
 
 
 subsection \<open>\textit{friend_of_corec_simps}
   \label{ssec:friend-of-corec-simps}\<close>
 
 text \<open>
 The @{attribute friend_of_corec_simps} attribute declares naturality theorems
 to be used by @{command friend_of_corec} and @{command corec} \<open>(friend)\<close> in
 deriving the user specification from reduction to primitive corecursion.
 Internally, these commands derive naturality theorems from the parametricity proof
 obligations dischared by the user or the @{method transfer_prover_eq} method, but
 this derivation fails if in the arguments of a higher-order constant a type variable
 occurs on both sides of the function type constructor. The required naturality
 theorem can then be declared with @{attribute friend_of_corec_simps}. See
 \<^file>\<open>~~/src/HOL/Corec_Examples/Tests/Iterate_GPV.thy\<close> for an example.
 \<close>
 
 
 section \<open>Known Bugs and Limitations
   \label{sec:known-bugs-and-limitations}\<close>
 
 text \<open>
 This section lists the known bugs and limitations of the corecursion package at
 the time of this writing.
 
 \begin{enumerate}
 \setlength{\itemsep}{0pt}
 
 \item
 \emph{Mutually corecursive codatatypes are not supported.}
 
 \item
 \emph{The signature of friend functions may not depend on type variables beyond
 those that appear in the codatatype.}
 
 \item
 \emph{The internal tactics may fail on legal inputs.}
 In some cases, this limitation can be circumvented using the
 @{attribute friend_of_corec_simps} attribute
 (Section~\ref{ssec:friend-of-corec-simps}).
 
 \item
 \emph{The \<open>transfer\<close> option is not implemented yet.}
 
 \item
 \emph{The constructor and destructor views offered by {\upshape\keyw{primcorec}}
 are not supported by @{command corec} and @{command corecursive}.}
 
 \item
 \emph{There is no mechanism for registering custom plugins.}
 
 \item
 \emph{The package does not interact well with locales.}
 
 \item
 \emph{The undocumented \<open>corecUU_transfer\<close> theorem is not as polymorphic as
 it could be.}
 
 \item
 \emph{All type variables occurring in the arguments of a friendly function must occur
 as direct arguments of the type constructor of the resulting type.}
 
 \end{enumerate}
 \<close>
 
 end
diff --git a/src/Doc/Datatypes/Datatypes.thy b/src/Doc/Datatypes/Datatypes.thy
--- a/src/Doc/Datatypes/Datatypes.thy
+++ b/src/Doc/Datatypes/Datatypes.thy
@@ -1,3688 +1,3687 @@
 (*  Title:      Doc/Datatypes/Datatypes.thy
     Author:     Julian Biendarra, TU Muenchen
     Author:     Jasmin Blanchette, TU Muenchen
     Author:     Martin Desharnais, Ecole de technologie superieure
     Author:     Lorenz Panny, TU Muenchen
     Author:     Andrei Popescu, TU Muenchen
     Author:     Dmitriy Traytel, TU Muenchen
 
 Tutorial for (co)datatype definitions.
 *)
 
 theory Datatypes
 imports
   Setup
   "HOL-Library.BNF_Axiomatization"
   "HOL-Library.Countable"
   "HOL-Library.FSet"
   "HOL-Library.Simps_Case_Conv"
 begin
 
 
 (*<*)
 unbundle cardinal_syntax
 (*>*)
 
 section \<open>Introduction
   \label{sec:introduction}\<close>
 
 text \<open>
 The 2013 edition of Isabelle introduced a definitional package for freely
 generated datatypes and codatatypes. This package replaces the earlier
-implementation due to Berghofer and Wenzel @{cite "Berghofer-Wenzel:1999:TPHOL"}.
+implementation due to Berghofer and Wenzel \<^cite>\<open>"Berghofer-Wenzel:1999:TPHOL"\<close>.
 Perhaps the main advantage of the new package is that it supports recursion
 through a large class of non-datatypes, such as finite sets:
 \<close>
 
     datatype 'a tree\<^sub>f\<^sub>s = Node\<^sub>f\<^sub>s (lbl\<^sub>f\<^sub>s: 'a) (sub\<^sub>f\<^sub>s: "'a tree\<^sub>f\<^sub>s fset")
 
 text \<open>
 \noindent
 Another strong point is the support for local definitions:
 \<close>
 
     context linorder
     begin
     datatype flag = Less | Eq | Greater
     end
 
 text \<open>
 \noindent
 Furthermore, the package provides a lot of convenience, including automatically
 generated discriminators, selectors, and relators as well as a wealth of
 properties about them.
 
 In addition to inductive datatypes, the package supports coinductive
 datatypes, or \emph{codatatypes}, which allow infinite values. For example, the
 following command introduces the type of lazy lists, which comprises both finite
 and infinite values:
 \<close>
 
 (*<*)
     locale early
     locale late
 (*>*)
     codatatype (*<*)(in early) (*>*)'a llist = LNil | LCons 'a "'a llist"
 
 text \<open>
 \noindent
 Mixed inductive--coinductive recursion is possible via nesting. Compare the
 following four Rose tree examples:
 \<close>
 
     datatype (*<*)(in early) (*>*)'a tree\<^sub>f\<^sub>f = Node\<^sub>f\<^sub>f 'a "'a tree\<^sub>f\<^sub>f list"
     datatype (*<*)(in early) (*>*)'a tree\<^sub>f\<^sub>i = Node\<^sub>f\<^sub>i 'a "'a tree\<^sub>f\<^sub>i llist"
     codatatype (*<*)(in early) (*>*)'a tree\<^sub>i\<^sub>f = Node\<^sub>i\<^sub>f 'a "'a tree\<^sub>i\<^sub>f list"
     codatatype (*<*)(in early) (*>*)'a tree\<^sub>i\<^sub>i = Node\<^sub>i\<^sub>i 'a "'a tree\<^sub>i\<^sub>i llist"
 
 text \<open>
 The first two tree types allow only paths of finite length, whereas the last two
 allow infinite paths. Orthogonally, the nodes in the first and third types have
 finitely many direct subtrees, whereas those of the second and fourth may have
 infinite branching.
 
 The package is part of \<^theory>\<open>Main\<close>. Additional functionality is provided by
 the theory \<^file>\<open>~~/src/HOL/Library/BNF_Axiomatization.thy\<close>.
 
 The package, like its predecessor, fully adheres to the LCF philosophy
-@{cite mgordon79}: The characteristic theorems associated with the specified
+\<^cite>\<open>mgordon79\<close>: The characteristic theorems associated with the specified
 (co)datatypes are derived rather than introduced axiomatically.%
 \footnote{However, some of the
 internal constructions and most of the internal proof obligations are omitted
 if the \<open>quick_and_dirty\<close> option is enabled.}
 The package is described in a number of scientific papers
-@{cite "traytel-et-al-2012" and "blanchette-et-al-2014-impl" and
-"panny-et-al-2014" and "blanchette-et-al-2015-wit"}.
+\<^cite>\<open>"traytel-et-al-2012" and "blanchette-et-al-2014-impl" and
+"panny-et-al-2014" and "blanchette-et-al-2015-wit"\<close>.
 The central notion is that of a \emph{bounded natural functor} (BNF)---a
 well-behaved type constructor for which nested (co)recursion is supported.
 
 This tutorial is organized as follows:
 
 \begin{itemize}
 \setlength{\itemsep}{0pt}
 
 \item Section \ref{sec:defining-datatypes}, ``Defining Datatypes,''
 describes how to specify datatypes using the @{command datatype} command.
 
 \item Section \ref{sec:defining-primitively-recursive-functions}, ``Defining
 Primitively Recursive Functions,'' describes how to specify functions
-using @{command primrec}. (A separate tutorial @{cite "isabelle-function"}
+using @{command primrec}. (A separate tutorial \<^cite>\<open>"isabelle-function"\<close>
 describes the more powerful \keyw{fun} and \keyw{function} commands.)
 
 \item Section \ref{sec:defining-codatatypes}, ``Defining Codatatypes,''
 describes how to specify codatatypes using the @{command codatatype} command.
 
 \item Section \ref{sec:defining-primitively-corecursive-functions},
 ``Defining Primitively Corecursive Functions,'' describes how to specify
 functions using the @{command primcorec} and
 @{command primcorecursive} commands. (A separate tutorial
-@{cite "isabelle-corec"} describes the more powerful \keyw{corec} and
+\<^cite>\<open>"isabelle-corec"\<close> describes the more powerful \keyw{corec} and
 \keyw{corecursive} commands.)
 
 \item Section \ref{sec:registering-bounded-natural-functors}, ``Registering
 Bounded Natural Functors,'' explains how to use the @{command bnf} command
 to register arbitrary type constructors as BNFs.
 
 \item Section
 \ref{sec:deriving-destructors-and-constructor-theorems},
 ``Deriving Destructors and Constructor Theorems,'' explains how to
 use the command @{command free_constructors} to derive destructor constants
 and theorems for freely generated types, as performed internally by
 @{command datatype} and @{command codatatype}.
 
 %\item Section \ref{sec:using-the-standard-ml-interface}, ``Using the Standard
 %ML Interface,'' describes the package's programmatic interface.
 
 \item Section \ref{sec:selecting-plugins}, ``Selecting Plugins,'' is concerned
 with the package's interoperability with other Isabelle packages and tools, such
 as the code generator, Transfer, Lifting, and Quickcheck.
 
 \item Section \ref{sec:known-bugs-and-limitations}, ``Known Bugs and
 Limitations,'' concludes with known open issues.
 \end{itemize}
 
 \newbox\boxA
 \setbox\boxA=\hbox{\texttt{NOSPAM}}
 
 \newcommand\authoremaili{\texttt{jasmin.blan{\color{white}NOSPAM}\kern-\wd\boxA{}chette@\allowbreak
 gmail.\allowbreak com}}
 
 Comments and bug reports concerning either the package or this tutorial should
 be directed to the second author at \authoremaili{} or to the
 \texttt{cl-isabelle-users} mailing list.
 \<close>
 
 
 section \<open>Defining Datatypes
   \label{sec:defining-datatypes}\<close>
 
 text \<open>
 Datatypes can be specified using the @{command datatype} command.
 \<close>
 
 
 subsection \<open>Introductory Examples
   \label{ssec:datatype-introductory-examples}\<close>
 
 text \<open>
 Datatypes are illustrated through concrete examples featuring different flavors
 of recursion. More examples can be found in the directory
 \<^dir>\<open>~~/src/HOL/Datatype_Examples\<close>.
 \<close>
 
 
 subsubsection \<open>Nonrecursive Types
   \label{sssec:datatype-nonrecursive-types}\<close>
 
 text \<open>
 Datatypes are introduced by specifying the desired names and argument types for
 their constructors. \emph{Enumeration} types are the simplest form of datatype.
 All their constructors are nullary:
 \<close>
 
     datatype trool = Truue | Faalse | Perhaaps
 
 text \<open>
 \noindent
 \<^const>\<open>Truue\<close>, \<^const>\<open>Faalse\<close>, and \<^const>\<open>Perhaaps\<close> have the type \<^typ>\<open>trool\<close>.
 
 Polymorphic types are possible, such as the following option type, modeled after
 its homologue from the \<^theory>\<open>HOL.Option\<close> theory:
 \<close>
 
 (*<*)
     hide_const None Some map_option
     hide_type option
 (*>*)
     datatype 'a option = None | Some 'a
 
 text \<open>
 \noindent
 The constructors are \<open>None :: 'a option\<close> and
 \<open>Some :: 'a \<Rightarrow> 'a option\<close>.
 
 The next example has three type parameters:
 \<close>
 
     datatype ('a, 'b, 'c) triple = Triple 'a 'b 'c
 
 text \<open>
 \noindent
 The constructor is
 \<open>Triple :: 'a \<Rightarrow> 'b \<Rightarrow> 'c \<Rightarrow> ('a, 'b, 'c) triple\<close>.
 Unlike in Standard ML, curried constructors are supported. The uncurried variant
 is also possible:
 \<close>
 
     datatype ('a, 'b, 'c) triple\<^sub>u = Triple\<^sub>u "'a * 'b * 'c"
 
 text \<open>
 \noindent
 Occurrences of nonatomic types on the right-hand side of the equal sign must be
 enclosed in double quotes, as is customary in Isabelle.
 \<close>
 
 
 subsubsection \<open>Simple Recursion
   \label{sssec:datatype-simple-recursion}\<close>
 
 text \<open>
 Natural numbers are the simplest example of a recursive type:
 \<close>
 
     datatype nat = Zero | Succ nat
 
 text \<open>
 \noindent
 Lists were shown in the introduction. Terminated lists are a variant that
 stores a value of type \<^typ>\<open>'b\<close> at the very end:
 \<close>
 
     datatype (*<*)(in early) (*>*)('a, 'b) tlist = TNil 'b | TCons 'a "('a, 'b) tlist"
 
 
 subsubsection \<open>Mutual Recursion
   \label{sssec:datatype-mutual-recursion}\<close>
 
 text \<open>
 \emph{Mutually recursive} types are introduced simultaneously and may refer to
 each other. The example below introduces a pair of types for even and odd
 natural numbers:
 \<close>
 
     datatype even_nat = Even_Zero | Even_Succ odd_nat
     and odd_nat = Odd_Succ even_nat
 
 text \<open>
 \noindent
 Arithmetic expressions are defined via terms, terms via factors, and factors via
 expressions:
 \<close>
 
     datatype ('a, 'b) exp =
       Term "('a, 'b) trm" | Sum "('a, 'b) trm" "('a, 'b) exp"
     and ('a, 'b) trm =
       Factor "('a, 'b) fct" | Prod "('a, 'b) fct" "('a, 'b) trm"
     and ('a, 'b) fct =
       Const 'a | Var 'b | Expr "('a, 'b) exp"
 
 
 subsubsection \<open>Nested Recursion
   \label{sssec:datatype-nested-recursion}\<close>
 
 text \<open>
 \emph{Nested recursion} occurs when recursive occurrences of a type appear under
 a type constructor. The introduction showed some examples of trees with nesting
 through lists. A more complex example, that reuses our \<^type>\<open>option\<close> type,
 follows:
 \<close>
 
     datatype 'a btree =
       BNode 'a "'a btree option" "'a btree option"
 
 text \<open>
 \noindent
 Not all nestings are admissible. For example, this command will fail:
 \<close>
 
     datatype 'a wrong = W1 | W2 (*<*)'a
     typ (*>*)"'a wrong \<Rightarrow> 'a"
 
 text \<open>
 \noindent
 The issue is that the function arrow \<open>\<Rightarrow>\<close> allows recursion
 only through its right-hand side. This issue is inherited by polymorphic
 datatypes defined in terms of~\<open>\<Rightarrow>\<close>:
 \<close>
 
     datatype ('a, 'b) fun_copy = Fun "'a \<Rightarrow> 'b"
     datatype 'a also_wrong = W1 | W2 (*<*)'a
     typ (*>*)"('a also_wrong, 'a) fun_copy"
 
 text \<open>
 \noindent
 The following definition of \<^typ>\<open>'a\<close>-branching trees is legal:
 \<close>
 
     datatype 'a ftree = FTLeaf 'a | FTNode "'a \<Rightarrow> 'a ftree"
 
 text \<open>
 \noindent
 And so is the definition of hereditarily finite sets:
 \<close>
 
     datatype hfset = HFSet "hfset fset"
 
 text \<open>
 \noindent
 In general, type constructors \<open>('a\<^sub>1, \<dots>, 'a\<^sub>m) t\<close>
 allow recursion on a subset of their type arguments \<open>'a\<^sub>1\<close>, \ldots,
 \<open>'a\<^sub>m\<close>. These type arguments are called \emph{live}; the remaining
 type arguments are called \emph{dead}. In \<^typ>\<open>'a \<Rightarrow> 'b\<close> and
 \<^typ>\<open>('a, 'b) fun_copy\<close>, the type variable \<^typ>\<open>'a\<close> is dead and
 \<^typ>\<open>'b\<close> is live.
 
 Type constructors must be registered as BNFs to have live arguments. This is
 done automatically for datatypes and codatatypes introduced by the
 @{command datatype} and @{command codatatype} commands.
 Section~\ref{sec:registering-bounded-natural-functors} explains how to
 register arbitrary type constructors as BNFs.
 
 Here is another example that fails:
 \<close>
 
     datatype 'a pow_list = PNil 'a (*<*)'a
     datatype 'a pow_list' = PNil' 'a (*>*)| PCons "('a * 'a) pow_list"
 
 text \<open>
 \noindent
 This attempted definition features a different flavor of nesting, where the
 recursive call in the type specification occurs around (rather than inside)
 another type constructor.
 \<close>
 
 
 subsubsection \<open>Auxiliary Constants
   \label{sssec:datatype-auxiliary-constants}\<close>
 
 text \<open>
 The @{command datatype} command introduces various constants in addition to
 the constructors. With each datatype are associated set functions, a map
 function, a predicator, a relator, discriminators, and selectors, all of which can be given
 custom names. In the example below, the familiar names \<open>null\<close>, \<open>hd\<close>,
 \<open>tl\<close>, \<open>set\<close>, \<open>map\<close>, and \<open>list_all2\<close> override the
 default names \<open>is_Nil\<close>, \<open>un_Cons1\<close>, \<open>un_Cons2\<close>,
 \<open>set_list\<close>, \<open>map_list\<close>, and \<open>rel_list\<close>:
 \<close>
 
 (*<*)
     no_translations
       "[x, xs]" == "x # [xs]"
       "[x]" == "x # []"
 
     no_notation
       Nil ("[]") and
       Cons (infixr "#" 65)
 
     hide_type list
     hide_const Nil Cons case_list hd tl set map list_all2 rec_list size_list list_all
 
     context early
     begin
 (*>*)
     datatype (set: 'a) list =
       null: Nil
     | Cons (hd: 'a) (tl: "'a list")
     for
       map: map
       rel: list_all2
       pred: list_all
     where
       "tl Nil = Nil"
 
 text \<open>
 \noindent
 The types of the constants that appear in the specification are listed below.
 
 \medskip
 
 \begin{tabular}{@ {}ll@ {}}
 Constructors: &
   \<open>Nil :: 'a list\<close> \\
 &
   \<open>Cons :: 'a \<Rightarrow> 'a list \<Rightarrow> 'a list\<close> \\
 Discriminator: &
   \<open>null :: 'a list \<Rightarrow> bool\<close> \\
 Selectors: &
   \<open>hd :: 'a list \<Rightarrow> 'a\<close> \\
 &
   \<open>tl :: 'a list \<Rightarrow> 'a list\<close> \\
 Set function: &
   \<open>set :: 'a list \<Rightarrow> 'a set\<close> \\
 Map function: &
   \<open>map :: ('a \<Rightarrow> 'b) \<Rightarrow> 'a list \<Rightarrow> 'b list\<close> \\
 Relator: &
   \<open>list_all2 :: ('a \<Rightarrow> 'b \<Rightarrow> bool) \<Rightarrow> 'a list \<Rightarrow> 'b list \<Rightarrow> bool\<close>
 \end{tabular}
 
 \medskip
 
 The discriminator \<^const>\<open>null\<close> and the selectors \<^const>\<open>hd\<close> and \<^const>\<open>tl\<close>
 are characterized by the following conditional equations:
 %
 \[@{thm list.collapse(1)[of xs, no_vars]}
   \qquad @{thm list.collapse(2)[of xs, no_vars]}\]
 %
 For two-constructor datatypes, a single discriminator constant is sufficient.
 The discriminator associated with \<^const>\<open>Cons\<close> is simply
 \<^term>\<open>\<lambda>xs. \<not> null xs\<close>.
 
 The \keyw{where} clause at the end of the command specifies a default value for
 selectors applied to constructors on which they are not a priori specified.
 In the example, it is used to ensure that the tail of the empty list is itself
 (instead of being left unspecified).
 
 Because \<^const>\<open>Nil\<close> is nullary, it is also possible to use
 \<^term>\<open>\<lambda>xs. xs = Nil\<close> as a discriminator. This is the default behavior
 if we omit the identifier \<^const>\<open>null\<close> and the associated colon. Some users
 argue against this, because the mixture of constructors and selectors in the
 characteristic theorems can lead Isabelle's automation to switch between the
 constructor and the destructor view in surprising ways.
 
 The usual mixfix syntax annotations are available for both types and
 constructors. For example:
 \<close>
 
 (*<*)
     end
 (*>*)
     datatype ('a, 'b) prod (infixr "*" 20) = Pair 'a 'b
 
 text \<open>\blankline\<close>
 
     datatype (set: 'a) list =
       null: Nil ("[]")
     | Cons (hd: 'a) (tl: "'a list") (infixr "#" 65)
     for
       map: map
       rel: list_all2
       pred: list_all
 
 text \<open>
 \noindent
 Incidentally, this is how the traditional syntax can be set up:
 \<close>
 
     syntax "_list" :: "args \<Rightarrow> 'a list" ("[(_)]")
 
 text \<open>\blankline\<close>
 
     translations
       "[x, xs]" == "x # [xs]"
       "[x]" == "x # []"
 
 
 subsection \<open>Command Syntax
   \label{ssec:datatype-command-syntax}\<close>
 
 subsubsection \<open>\keyw{datatype}
   \label{sssec:datatype}\<close>
 
 text \<open>
 \begin{matharray}{rcl}
   @{command_def "datatype"} & : & \<open>local_theory \<rightarrow> local_theory\<close>
 \end{matharray}
 
 \<^rail>\<open>
   @@{command datatype} target? @{syntax dt_options}? @{syntax dt_spec}
   ;
   @{syntax_def dt_options}: '(' ((@{syntax plugins} | 'discs_sels') + ',') ')'
   ;
   @{syntax_def plugins}: 'plugins' ('only' | 'del') ':' (name +)
   ;
   @{syntax_def dt_spec}: (@{syntax dt_name} '=' (@{syntax dt_ctor} + '|') \<newline>
      @{syntax map_rel_pred}? (@'where' (prop + '|'))? + @'and')
   ;
   @{syntax_def map_rel_pred}: @'for' ((('map' | 'rel' | 'pred') ':' name) +)
 \<close>
 
 \medskip
 
 \noindent
 The @{command datatype} command introduces a set of mutually recursive
 datatypes specified by their constructors.
 
 The syntactic entity \synt{target} can be used to specify a local
-context (e.g., \<open>(in linorder)\<close> @{cite "isabelle-isar-ref"}),
+context (e.g., \<open>(in linorder)\<close> \<^cite>\<open>"isabelle-isar-ref"\<close>),
 and \synt{prop} denotes a HOL proposition.
 
 The optional target is optionally followed by a combination of the following
 options:
 
 \begin{itemize}
 \setlength{\itemsep}{0pt}
 
 \item
 The \<open>plugins\<close> option indicates which plugins should be enabled
 (\<open>only\<close>) or disabled (\<open>del\<close>). By default, all plugins are enabled.
 
 \item
 The \<open>discs_sels\<close> option indicates that discriminators and selectors
 should be generated. The option is implicitly enabled if names are specified for
 discriminators or selectors.
 \end{itemize}
 
 The optional \keyw{where} clause specifies default values for selectors.
 Each proposition must be an equation of the form
 \<open>un_D (C \<dots>) = \<dots>\<close>, where \<open>C\<close> is a constructor and
 \<open>un_D\<close> is a selector.
 
 The left-hand sides of the datatype equations specify the name of the type to
 define, its type parameters, and additional information:
 
 \<^rail>\<open>
   @{syntax_def dt_name}: @{syntax tyargs}? name mixfix?
   ;
   @{syntax_def tyargs}: typefree | '(' (('dead' | name ':')? typefree + ',') ')'
 \<close>
 
 \medskip
 
 \noindent
 The syntactic entity \synt{name} denotes an identifier, \synt{mixfix} denotes
 the usual parenthesized mixfix notation, and \synt{typefree} denotes fixed type
-variable (\<^typ>\<open>'a\<close>, \<^typ>\<open>'b\<close>, \ldots) @{cite "isabelle-isar-ref"}.
+variable (\<^typ>\<open>'a\<close>, \<^typ>\<open>'b\<close>, \ldots) \<^cite>\<open>"isabelle-isar-ref"\<close>.
 
 The optional names preceding the type variables allow to override the default
 names of the set functions (\<open>set\<^sub>1_t\<close>, \ldots, \<open>set\<^sub>m_t\<close>). Type
 arguments can be marked as dead by entering \<open>dead\<close> in front of the
 type variable (e.g., \<open>(dead 'a)\<close>); otherwise, they are live or dead
 (and a set function is generated or not) depending on where they occur in the
 right-hand sides of the definition. Declaring a type argument as dead can speed
 up the type definition but will prevent any later (co)recursion through that
 type argument.
 
 Inside a mutually recursive specification, all defined datatypes must
 mention exactly the same type variables in the same order.
 
 \<^rail>\<open>
   @{syntax_def dt_ctor}: (name ':')? name (@{syntax dt_ctor_arg} * ) mixfix?
 \<close>
 
 \medskip
 
 \noindent
 The main constituents of a constructor specification are the name of the
 constructor and the list of its argument types. An optional discriminator name
 can be supplied at the front. If discriminators are enabled (cf.\ the
 \<open>discs_sels\<close> option) but no name is supplied, the default is
 \<open>\<lambda>x. x = C\<^sub>j\<close> for nullary constructors and
 \<open>t.is_C\<^sub>j\<close> otherwise.
 
 \<^rail>\<open>
   @{syntax_def dt_ctor_arg}: type | '(' name ':' type ')'
 \<close>
 
 \medskip
 
 \noindent
-The syntactic entity \synt{type} denotes a HOL type @{cite "isabelle-isar-ref"}.
+The syntactic entity \synt{type} denotes a HOL type \<^cite>\<open>"isabelle-isar-ref"\<close>.
 
 In addition to the type of a constructor argument, it is possible to specify a
 name for the corresponding selector. The same selector name can be reused for
 arguments to several constructors as long as the arguments share the same type.
 If selectors are enabled (cf.\ the \<open>discs_sels\<close> option) but no name is
 supplied, the default name is \<open>un_C\<^sub>ji\<close>.
 \<close>
 
 
 subsubsection \<open>\keyw{datatype_compat}
   \label{sssec:datatype-compat}\<close>
 
 text \<open>
 \begin{matharray}{rcl}
   @{command_def "datatype_compat"} & : & \<open>local_theory \<rightarrow> local_theory\<close>
 \end{matharray}
 
 \<^rail>\<open>
   @@{command datatype_compat} (name +)
 \<close>
 
 \medskip
 
 \noindent
 The @{command datatype_compat} command registers new-style datatypes as
 old-style datatypes and invokes the old-style plugins. For example:
 \<close>
 
     datatype_compat even_nat odd_nat
 
 text \<open>\blankline\<close>
 
     ML \<open>Old_Datatype_Data.get_info \<^theory> \<^type_name>\<open>even_nat\<close>\<close>
 
 text \<open>
-The syntactic entity \synt{name} denotes an identifier @{cite "isabelle-isar-ref"}.
+The syntactic entity \synt{name} denotes an identifier \<^cite>\<open>"isabelle-isar-ref"\<close>.
 
 The command is sometimes useful when migrating from the old datatype package to
 the new one.
 
 A few remarks concern nested recursive datatypes:
 
 \begin{itemize}
 \setlength{\itemsep}{0pt}
 
 \item The old-style, nested-as-mutual induction rule and recursor theorems are
 generated under their usual names but with ``\<open>compat_\<close>'' prefixed
 (e.g., \<open>compat_tree.induct\<close>, \<open>compat_tree.inducts\<close>, and
 \<open>compat_tree.rec\<close>). These theorems should be identical to the ones
 generated by the old datatype package, \emph{up to the order of the
 premises}---meaning that the subgoals generated by the \<open>induct\<close> or
 \<open>induction\<close> method may be in a different order than before.
 
 \item All types through which recursion takes place must be new-style datatypes
 or the function type.
 \end{itemize}
 \<close>
 
 
 subsection \<open>Generated Constants
   \label{ssec:datatype-generated-constants}\<close>
 
 text \<open>
 Given a datatype \<open>('a\<^sub>1, \<dots>, 'a\<^sub>m) t\<close> with $m$ live type variables
 and $n$ constructors \<open>t.C\<^sub>1\<close>, \ldots, \<open>t.C\<^sub>n\<close>, the following
 auxiliary constants are introduced:
 
 \medskip
 
 \begin{tabular}{@ {}ll@ {}}
 Case combinator: &
   \<open>t.case_t\<close> (rendered using the familiar \<open>case\<close>--\<open>of\<close> syntax) \\
 Discriminators: &
   \<open>t.is_C\<^sub>1\<close>$, \ldots, $\<open>t.is_C\<^sub>n\<close> \\
 Selectors: &
   \<open>t.un_C\<^sub>11\<close>$, \ldots, $\<open>t.un_C\<^sub>1k\<^sub>1\<close> \\
 & \quad\vdots \\
 & \<open>t.un_C\<^sub>n1\<close>$, \ldots, $\<open>t.un_C\<^sub>nk\<^sub>n\<close> \\
 Set functions: &
   \<open>t.set\<^sub>1_t\<close>, \ldots, \<open>t.set\<^sub>m_t\<close> \\
 Map function: &
   \<open>t.map_t\<close> \\
 Relator: &
   \<open>t.rel_t\<close> \\
 Recursor: &
   \<open>t.rec_t\<close>
 \end{tabular}
 
 \medskip
 
 \noindent
 The discriminators and selectors are generated only if the \<open>discs_sels\<close>
 option is enabled or if names are specified for discriminators or selectors.
 The set functions, map function, predicator, and relator are generated only if $m > 0$.
 
 In addition, some of the plugins introduce their own constants
 (Section~\ref{sec:selecting-plugins}). The case combinator, discriminators,
 and selectors are collectively called \emph{destructors}. The prefix
 ``\<open>t.\<close>'' is an optional component of the names and is normally hidden.
 \<close>
 
 
 subsection \<open>Generated Theorems
   \label{ssec:datatype-generated-theorems}\<close>
 
 text \<open>
 The characteristic theorems generated by @{command datatype} are grouped in
 three broad categories:
 
 \begin{itemize}
 \setlength{\itemsep}{0pt}
 
 \item The \emph{free constructor theorems}
 (Section~\ref{sssec:free-constructor-theorems}) are properties of the
 constructors and destructors that can be derived for any freely generated type.
 Internally, the derivation is performed by @{command free_constructors}.
 
 \item The \emph{functorial theorems} (Section~\ref{sssec:functorial-theorems})
 are properties of datatypes related to their BNF nature.
 
 \item The \emph{inductive theorems} (Section~\ref{sssec:inductive-theorems})
 are properties of datatypes related to their inductive nature.
 
 \end{itemize}
 
 \noindent
 The full list of named theorems can be obtained by issuing the command
 \keyw{print_theorems} immediately after the datatype definition. This list
 includes theorems produced by plugins (Section~\ref{sec:selecting-plugins}),
 but normally excludes low-level theorems that reveal internal constructions.
 To make these accessible, add the line
 \<close>
 
     declare [[bnf_internals]]
 (*<*)
     declare [[bnf_internals = false]]
 (*>*)
 
 
 subsubsection \<open>Free Constructor Theorems
   \label{sssec:free-constructor-theorems}\<close>
 
 (*<*)
     consts nonnull :: 'a
 (*>*)
 
 text \<open>
 The free constructor theorems are partitioned in three subgroups. The first
 subgroup of properties is concerned with the constructors. They are listed below
 for \<^typ>\<open>'a list\<close>:
 
 \begin{indentblock}
 \begin{description}
 
 \item[\<open>t.\<close>\hthm{inject} \<open>[iff, induct_simp]\<close>\rm:] ~ \\
 @{thm list.inject[no_vars]}
 
 \item[\<open>t.\<close>\hthm{distinct} \<open>[simp, induct_simp]\<close>\rm:] ~ \\
 @{thm list.distinct(1)[no_vars]} \\
 @{thm list.distinct(2)[no_vars]}
 
 \item[\<open>t.\<close>\hthm{exhaust} \<open>[cases t, case_names C\<^sub>1 \<dots> C\<^sub>n]\<close>\rm:] ~ \\
 @{thm list.exhaust[no_vars]}
 
 \item[\<open>t.\<close>\hthm{nchotomy}\rm:] ~ \\
 @{thm list.nchotomy[no_vars]}
 
 \end{description}
 \end{indentblock}
 
 \noindent
 In addition, these nameless theorems are registered as safe elimination rules:
 
 \begin{indentblock}
 \begin{description}
 
 \item[\<open>t.\<close>\hthm{distinct {\upshape[}THEN notE}\<open>, elim!\<close>\hthm{\upshape]}\rm:] ~ \\
 @{thm list.distinct(1)[THEN notE, elim!, no_vars]} \\
 @{thm list.distinct(2)[THEN notE, elim!, no_vars]}
 
 \end{description}
 \end{indentblock}
 
 \noindent
 The next subgroup is concerned with the case combinator:
 
 \begin{indentblock}
 \begin{description}
 
 \item[\<open>t.\<close>\hthm{case} \<open>[simp, code]\<close>\rm:] ~ \\
 @{thm list.case(1)[no_vars]} \\
 @{thm list.case(2)[no_vars]} \\
 The \<open>[code]\<close> attribute is set by the \<open>code\<close> plugin
 (Section~\ref{ssec:code-generator}).
 
 \item[\<open>t.\<close>\hthm{case_cong} \<open>[fundef_cong]\<close>\rm:] ~ \\
 @{thm list.case_cong[no_vars]}
 
 \item[\<open>t.\<close>\hthm{case_cong_weak} \<open>[cong]\<close>\rm:] ~ \\
 @{thm list.case_cong_weak[no_vars]}
 
 \item[\<open>t.\<close>\hthm{case_distrib}\rm:] ~ \\
 @{thm list.case_distrib[no_vars]}
 
 \item[\<open>t.\<close>\hthm{split}\rm:] ~ \\
 @{thm list.split[no_vars]}
 
 \item[\<open>t.\<close>\hthm{split_asm}\rm:] ~ \\
 @{thm list.split_asm[no_vars]}
 
 \item[\<open>t.\<close>\hthm{splits} = \<open>split split_asm\<close>]
 
 \end{description}
 \end{indentblock}
 
 \noindent
 The third subgroup revolves around discriminators and selectors:
 
 \begin{indentblock}
 \begin{description}
 
 \item[\<open>t.\<close>\hthm{disc} \<open>[simp]\<close>\rm:] ~ \\
 @{thm list.disc(1)[no_vars]} \\
 @{thm list.disc(2)[no_vars]}
 
 \item[\<open>t.\<close>\hthm{discI}\rm:] ~ \\
 @{thm list.discI(1)[no_vars]} \\
 @{thm list.discI(2)[no_vars]}
 
 \item[\<open>t.\<close>\hthm{sel} \<open>[simp, code]\<close>\rm:] ~ \\
 @{thm list.sel(1)[no_vars]} \\
 @{thm list.sel(2)[no_vars]} \\
 The \<open>[code]\<close> attribute is set by the \<open>code\<close> plugin
 (Section~\ref{ssec:code-generator}).
 
 \item[\<open>t.\<close>\hthm{collapse} \<open>[simp]\<close>\rm:] ~ \\
 @{thm list.collapse(1)[no_vars]} \\
 @{thm list.collapse(2)[no_vars]} \\
 The \<open>[simp]\<close> attribute is exceptionally omitted for datatypes equipped
 with a single nullary constructor, because a property of the form
 \<^prop>\<open>x = C\<close> is not suitable as a simplification rule.
 
 \item[\<open>t.\<close>\hthm{distinct_disc} \<open>[dest]\<close>\rm:] ~ \\
 These properties are missing for \<^typ>\<open>'a list\<close> because there is only one
 proper discriminator. If the datatype had been introduced with a second
 discriminator called \<^const>\<open>nonnull\<close>, they would have read as follows: \\[\jot]
 \<^prop>\<open>null list \<Longrightarrow> \<not> nonnull list\<close> \\
 \<^prop>\<open>nonnull list \<Longrightarrow> \<not> null list\<close>
 
 \item[\<open>t.\<close>\hthm{exhaust_disc} \<open>[case_names C\<^sub>1 \<dots> C\<^sub>n]\<close>\rm:] ~ \\
 @{thm list.exhaust_disc[no_vars]}
 
 \item[\<open>t.\<close>\hthm{exhaust_sel} \<open>[case_names C\<^sub>1 \<dots> C\<^sub>n]\<close>\rm:] ~ \\
 @{thm list.exhaust_sel[no_vars]}
 
 \item[\<open>t.\<close>\hthm{expand}\rm:] ~ \\
 @{thm list.expand[no_vars]}
 
 \item[\<open>t.\<close>\hthm{split_sel}\rm:] ~ \\
 @{thm list.split_sel[no_vars]}
 
 \item[\<open>t.\<close>\hthm{split_sel_asm}\rm:] ~ \\
 @{thm list.split_sel_asm[no_vars]}
 
 \item[\<open>t.\<close>\hthm{split_sels} = \<open>split_sel split_sel_asm\<close>]
 
 \item[\<open>t.\<close>\hthm{case_eq_if}\rm:] ~ \\
 @{thm list.case_eq_if[no_vars]}
 
 \item[\<open>t.\<close>\hthm{disc_eq_case}\rm:] ~ \\
 @{thm list.disc_eq_case(1)[no_vars]} \\
 @{thm list.disc_eq_case(2)[no_vars]}
 
 \end{description}
 \end{indentblock}
 
 \noindent
 In addition, equational versions of \<open>t.disc\<close> are registered with the
 \<open>[code]\<close> attribute. The \<open>[code]\<close> attribute is set by the
 \<open>code\<close> plugin (Section~\ref{ssec:code-generator}).
 \<close>
 
 
 subsubsection \<open>Functorial Theorems
   \label{sssec:functorial-theorems}\<close>
 
 text \<open>
 The functorial theorems are generated for type constructors with at least
 one live type argument (e.g., \<^typ>\<open>'a list\<close>). They are partitioned in two
 subgroups. The first subgroup consists of properties involving the
 constructors or the destructors and either a set function, the map function,
 the predicator, or the relator:
 
 \begin{indentblock}
 \begin{description}
 
 \item[\<open>t.\<close>\hthm{case_transfer} \<open>[transfer_rule]\<close>\rm:] ~ \\
 @{thm list.case_transfer[no_vars]} \\
 This property is generated by the \<open>transfer\<close> plugin
 (Section~\ref{ssec:transfer}).
 %The \<open>[transfer_rule]\<close> attribute is set by the \<open>transfer\<close> plugin
 %(Section~\ref{ssec:transfer}).
 
 \item[\<open>t.\<close>\hthm{sel_transfer} \<open>[transfer_rule]\<close>\rm:] ~ \\
 This property is missing for \<^typ>\<open>'a list\<close> because there is no common
 selector to all constructors. \\
 The \<open>[transfer_rule]\<close> attribute is set by the \<open>transfer\<close> plugin
 (Section~\ref{ssec:transfer}).
 
 \item[\<open>t.\<close>\hthm{ctr_transfer} \<open>[transfer_rule]\<close>\rm:] ~ \\
 @{thm list.ctr_transfer(1)[no_vars]} \\
 @{thm list.ctr_transfer(2)[no_vars]} \\
 The \<open>[transfer_rule]\<close> attribute is set by the \<open>transfer\<close> plugin
 (Section~\ref{ssec:transfer}) .
 
 \item[\<open>t.\<close>\hthm{disc_transfer} \<open>[transfer_rule]\<close>\rm:] ~ \\
 @{thm list.disc_transfer(1)[no_vars]} \\
 @{thm list.disc_transfer(2)[no_vars]} \\
 The \<open>[transfer_rule]\<close> attribute is set by the \<open>transfer\<close> plugin
 (Section~\ref{ssec:transfer}).
 
 \item[\<open>t.\<close>\hthm{set} \<open>[simp, code]\<close>\rm:] ~ \\
 @{thm list.set(1)[no_vars]} \\
 @{thm list.set(2)[no_vars]} \\
 The \<open>[code]\<close> attribute is set by the \<open>code\<close> plugin
 (Section~\ref{ssec:code-generator}).
 
 \item[\<open>t.\<close>\hthm{set_cases} \<open>[consumes 1, cases set: set\<^sub>i_t]\<close>\rm:] ~ \\
 @{thm list.set_cases[no_vars]}
 
 \item[\<open>t.\<close>\hthm{set_intros}\rm:] ~ \\
 @{thm list.set_intros(1)[no_vars]} \\
 @{thm list.set_intros(2)[no_vars]}
 
 \item[\<open>t.\<close>\hthm{set_sel}\rm:] ~ \\
 @{thm list.set_sel[no_vars]}
 
 \item[\<open>t.\<close>\hthm{map} \<open>[simp, code]\<close>\rm:] ~ \\
 @{thm list.map(1)[no_vars]} \\
 @{thm list.map(2)[no_vars]} \\
 The \<open>[code]\<close> attribute is set by the \<open>code\<close> plugin
 (Section~\ref{ssec:code-generator}).
 
 \item[\<open>t.\<close>\hthm{map_disc_iff} \<open>[simp]\<close>\rm:] ~ \\
 @{thm list.map_disc_iff[no_vars]}
 
 \item[\<open>t.\<close>\hthm{map_sel}\rm:] ~ \\
 @{thm list.map_sel[no_vars]}
 
 \item[\<open>t.\<close>\hthm{pred_inject} \<open>[simp]\<close>\rm:] ~ \\
 @{thm list.pred_inject(1)[no_vars]} \\
 @{thm list.pred_inject(2)[no_vars]}
 
 \item[\<open>t.\<close>\hthm{rel_inject} \<open>[simp]\<close>\rm:] ~ \\
 @{thm list.rel_inject(1)[no_vars]} \\
 @{thm list.rel_inject(2)[no_vars]}
 
 \item[\<open>t.\<close>\hthm{rel_distinct} \<open>[simp]\<close>\rm:] ~ \\
 @{thm list.rel_distinct(1)[no_vars]} \\
 @{thm list.rel_distinct(2)[no_vars]}
 
 \item[\<open>t.\<close>\hthm{rel_intros}\rm:] ~ \\
 @{thm list.rel_intros(1)[no_vars]} \\
 @{thm list.rel_intros(2)[no_vars]}
 
 \item[\<open>t.\<close>\hthm{rel_cases} \<open>[consumes 1, case_names t\<^sub>1 \<dots> t\<^sub>m, cases pred]\<close>\rm:] ~ \\
 @{thm list.rel_cases[no_vars]}
 
 \item[\<open>t.\<close>\hthm{rel_sel}\rm:] ~ \\
 @{thm list.rel_sel[no_vars]}
 
 \end{description}
 \end{indentblock}
 
 \noindent
 In addition, equational versions of \<open>t.rel_inject\<close> and \<open>rel_distinct\<close> are registered with the \<open>[code]\<close> attribute. The
 \<open>[code]\<close> attribute is set by the \<open>code\<close> plugin
 (Section~\ref{ssec:code-generator}).
 
 The second subgroup consists of more abstract properties of the set functions,
 the map function, the predicator, and the relator:
 
 \begin{indentblock}
 \begin{description}
 
 \item[\<open>t.\<close>\hthm{inj_map}\rm:] ~ \\
 @{thm list.inj_map[no_vars]}
 
 \item[\<open>t.\<close>\hthm{inj_map_strong}\rm:] ~ \\
 @{thm list.inj_map_strong[no_vars]}
 
 \item[\<open>t.\<close>\hthm{map_comp}\rm:] ~ \\
 @{thm list.map_comp[no_vars]}
 
 \item[\<open>t.\<close>\hthm{map_cong0}\rm:] ~ \\
 @{thm list.map_cong0[no_vars]}
 
 \item[\<open>t.\<close>\hthm{map_cong} \<open>[fundef_cong]\<close>\rm:] ~ \\
 @{thm list.map_cong[no_vars]}
 
 \item[\<open>t.\<close>\hthm{map_cong_pred}\rm:] ~ \\
 @{thm list.map_cong_pred[no_vars]}
 
 \item[\<open>t.\<close>\hthm{map_cong_simp}\rm:] ~ \\
 @{thm list.map_cong_simp[no_vars]}
 
 \item[\<open>t.\<close>\hthm{map_id0}\rm:] ~ \\
 @{thm list.map_id0[no_vars]}
 
 \item[\<open>t.\<close>\hthm{map_id}\rm:] ~ \\
 @{thm list.map_id[no_vars]}
 
 \item[\<open>t.\<close>\hthm{map_ident}\rm:] ~ \\
 @{thm list.map_ident[no_vars]}
 
 \item[\<open>t.\<close>\hthm{map_ident_strong}\rm:] ~ \\
 @{thm list.map_ident_strong[no_vars]}
 
 \item[\<open>t.\<close>\hthm{map_transfer} \<open>[transfer_rule]\<close>\rm:] ~ \\
 @{thm list.map_transfer[no_vars]} \\
 The \<open>[transfer_rule]\<close> attribute is set by the \<open>transfer\<close> plugin
 (Section~\ref{ssec:transfer}) for type constructors with no dead type arguments.
 
 \item[\<open>t.\<close>\hthm{pred_cong} \<open>[fundef_cong]\<close>\rm:] ~ \\
 @{thm list.pred_cong[no_vars]}
 
 \item[\<open>t.\<close>\hthm{pred_cong_simp}\rm:] ~ \\
 @{thm list.pred_cong_simp[no_vars]}
 
 \item[\<open>t.\<close>\hthm{pred_map}\rm:] ~ \\
 @{thm list.pred_map[no_vars]}
 
 \item[\<open>t.\<close>\hthm{pred_mono} \<open>[mono]\<close>\rm:] ~ \\
 @{thm list.pred_mono[no_vars]}
 
 \item[\<open>t.\<close>\hthm{pred_mono_strong}\rm:] ~ \\
 @{thm list.pred_mono_strong[no_vars]}
 
 \item[\<open>t.\<close>\hthm{pred_rel}\rm:] ~ \\
 @{thm list.pred_rel[no_vars]}
 
 \item[\<open>t.\<close>\hthm{pred_set}\rm:] ~ \\
 @{thm list.pred_set[no_vars]}
 
 \item[\<open>t.\<close>\hthm{pred_transfer} \<open>[transfer_rule]\<close>\rm:] ~ \\
 @{thm list.pred_transfer[no_vars]} \\
 The \<open>[transfer_rule]\<close> attribute is set by the \<open>transfer\<close> plugin
 (Section~\ref{ssec:transfer}) for type constructors with no dead type arguments.
 
 \item[\<open>t.\<close>\hthm{pred_True}\rm:] ~ \\
 @{thm list.pred_True[no_vars]}
 
 \item[\<open>t.\<close>\hthm{set_map}\rm:] ~ \\
 @{thm list.set_map[no_vars]}
 
 \item[\<open>t.\<close>\hthm{set_transfer} \<open>[transfer_rule]\<close>\rm:] ~ \\
 @{thm list.set_transfer[no_vars]} \\
 The \<open>[transfer_rule]\<close> attribute is set by the \<open>transfer\<close> plugin
 (Section~\ref{ssec:transfer}) for type constructors with no dead type arguments.
 
 \item[\<open>t.\<close>\hthm{rel_compp} \<open>[relator_distr]\<close>\rm:] ~ \\
 @{thm list.rel_compp[no_vars]} \\
 The \<open>[relator_distr]\<close> attribute is set by the \<open>lifting\<close> plugin
 (Section~\ref{ssec:lifting}).
 
 \item[\<open>t.\<close>\hthm{rel_conversep}\rm:] ~ \\
 @{thm list.rel_conversep[no_vars]}
 
 \item[\<open>t.\<close>\hthm{rel_eq}\rm:] ~ \\
 @{thm list.rel_eq[no_vars]}
 
 \item[\<open>t.\<close>\hthm{rel_eq_onp}\rm:] ~ \\
 @{thm list.rel_eq_onp[no_vars]}
 
 \item[\<open>t.\<close>\hthm{rel_flip}\rm:] ~ \\
 @{thm list.rel_flip[no_vars]}
 
 \item[\<open>t.\<close>\hthm{rel_map}\rm:] ~ \\
 @{thm list.rel_map(1)[no_vars]} \\
 @{thm list.rel_map(2)[no_vars]}
 
 \item[\<open>t.\<close>\hthm{rel_mono} \<open>[mono, relator_mono]\<close>\rm:] ~ \\
 @{thm list.rel_mono[no_vars]} \\
 The \<open>[relator_mono]\<close> attribute is set by the \<open>lifting\<close> plugin
 (Section~\ref{ssec:lifting}).
 
 \item[\<open>t.\<close>\hthm{rel_mono_strong}\rm:] ~ \\
 @{thm list.rel_mono_strong[no_vars]}
 
 \item[\<open>t.\<close>\hthm{rel_cong} \<open>[fundef_cong]\<close>\rm:] ~ \\
 @{thm list.rel_cong[no_vars]}
 
 \item[\<open>t.\<close>\hthm{rel_cong_simp}\rm:] ~ \\
 @{thm list.rel_cong_simp[no_vars]}
 
 \item[\<open>t.\<close>\hthm{rel_refl}\rm:] ~ \\
 @{thm list.rel_refl[no_vars]}
 
 \item[\<open>t.\<close>\hthm{rel_refl_strong}\rm:] ~ \\
 @{thm list.rel_refl_strong[no_vars]}
 
 \item[\<open>t.\<close>\hthm{rel_reflp}\rm:] ~ \\
 @{thm list.rel_reflp[no_vars]}
 
 \item[\<open>t.\<close>\hthm{rel_symp}\rm:] ~ \\
 @{thm list.rel_symp[no_vars]}
 
 \item[\<open>t.\<close>\hthm{rel_transp}\rm:] ~ \\
 @{thm list.rel_transp[no_vars]}
 
 \item[\<open>t.\<close>\hthm{rel_transfer} \<open>[transfer_rule]\<close>\rm:] ~ \\
 @{thm list.rel_transfer[no_vars]} \\
 The \<open>[transfer_rule]\<close> attribute is set by the \<open>transfer\<close> plugin
 (Section~\ref{ssec:transfer}) for type constructors with no dead type arguments.
 
 \end{description}
 \end{indentblock}
 \<close>
 
 
 subsubsection \<open>Inductive Theorems
   \label{sssec:inductive-theorems}\<close>
 
 text \<open>
 The inductive theorems are as follows:
 
 \begin{indentblock}
 \begin{description}
 
 \item[\<open>t.\<close>\hthm{induct} \<open>[case_names C\<^sub>1 \<dots> C\<^sub>n, induct t]\<close>\rm:] ~ \\
 @{thm list.induct[no_vars]}
 
 \item[\<open>t.\<close>\hthm{rel_induct} \<open>[case_names C\<^sub>1 \<dots> C\<^sub>n, induct pred]\<close>\rm:] ~ \\
 @{thm list.rel_induct[no_vars]}
 
 \item[\begin{tabular}{@ {}l@ {}}
   \<open>t\<^sub>1_\<dots>_t\<^sub>m.\<close>\hthm{induct} \<open>[case_names C\<^sub>1 \<dots> C\<^sub>n]\<close>\rm: \\
   \<open>t\<^sub>1_\<dots>_t\<^sub>m.\<close>\hthm{rel_induct} \<open>[case_names C\<^sub>1 \<dots> C\<^sub>n]\<close>\rm: \\
 \end{tabular}] ~ \\
 Given $m > 1$ mutually recursive datatypes, this induction rule can be used to
 prove $m$ properties simultaneously.
 
 \item[\<open>t.\<close>\hthm{rec} \<open>[simp, code]\<close>\rm:] ~ \\
 @{thm list.rec(1)[no_vars]} \\
 @{thm list.rec(2)[no_vars]} \\
 The \<open>[code]\<close> attribute is set by the \<open>code\<close> plugin
 (Section~\ref{ssec:code-generator}).
 
 \item[\<open>t.\<close>\hthm{rec_o_map}\rm:] ~ \\
 @{thm list.rec_o_map[no_vars]}
 
 \item[\<open>t.\<close>\hthm{rec_transfer} \<open>[transfer_rule]\<close>\rm:] ~ \\
 @{thm list.rec_transfer[no_vars]} \\
 The \<open>[transfer_rule]\<close> attribute is set by the \<open>transfer\<close> plugin
 (Section~\ref{ssec:transfer}) for type constructors with no dead type arguments.
 
 \end{description}
 \end{indentblock}
 
 \noindent
 For convenience, @{command datatype} also provides the following collection:
 
 \begin{indentblock}
 \begin{description}
 
 \item[\<open>t.\<close>\hthm{simps}] = \<open>t.inject\<close> \<open>t.distinct\<close> \<open>t.case\<close> \<open>t.rec\<close> \<open>t.map\<close> \<open>t.rel_inject\<close> \\
 \<open>t.rel_distinct\<close> \<open>t.set\<close>
 
 \end{description}
 \end{indentblock}
 \<close>
 
 
 subsection \<open>Proof Method
   \label{ssec:datatype-proof-method}\<close>
 
 subsubsection \<open>\textit{countable_datatype}
   \label{sssec:datatype-compat}\<close>
 
 text \<open>
 The theory \<^file>\<open>~~/src/HOL/Library/Countable.thy\<close> provides a
 proof method called @{method countable_datatype} that can be used to prove the
 countability of many datatypes, building on the countability of the types
 appearing in their definitions and of any type arguments. For example:
 \<close>
 
     instance list :: (countable) countable
       by countable_datatype
 
 
 subsection \<open>Antiquotation
   \label{ssec:datatype-antiquotation}\<close>
 
 subsubsection \<open>\textit{datatype}
   \label{sssec:datatype-datatype}\<close>
 
 text \<open>
 The \textit{datatype} antiquotation, written
 \texttt{\char`\\\char`<\char`^}\verb|datatype>|\guilsinglleft\textit{t}\guilsinglright{}
 or \texttt{@}\verb|{datatype| \textit{t}\verb|}|, where \textit{t} is a type
 name, expands to \LaTeX{} code for the definition of the datatype, with each
 constructor listed with its argument types. For example, if \textit{t} is
 @{type option}:
 
 \begin{quote}
 \<^datatype>\<open>option\<close>
 \end{quote}
 \<close>
 
 
 subsection \<open>Compatibility Issues
   \label{ssec:datatype-compatibility-issues}\<close>
 
 text \<open>
 The command @{command datatype} has been designed to be highly compatible with
 the old, pre-Isabelle2015 command, to ease migration. There are nonetheless a
 few incompatibilities that may arise when porting:
 
 \begin{itemize}
 \setlength{\itemsep}{0pt}
 
 \item \emph{The Standard ML interfaces are different.} Tools and extensions
 written to call the old ML interfaces will need to be adapted to the new
 interfaces. The \<open>BNF_LFP_Compat\<close> structure provides convenience functions
 that simulate the old interfaces in terms of the new ones.
 
 \item \emph{The recursor \<open>rec_t\<close> has a different signature for nested
 recursive datatypes.} In the old package, nested recursion through non-functions
 was internally reduced to mutual recursion. This reduction was visible in the
 type of the recursor, used by \keyw{primrec}. Recursion through functions was
 handled specially. In the new package, nested recursion (for functions and
 non-functions) is handled in a more modular fashion. The old-style recursor can
 be generated on demand using @{command primrec} if the recursion is via
 new-style datatypes, as explained in
 Section~\ref{sssec:primrec-nested-as-mutual-recursion}, or using
 @{command datatype_compat}.
 
 \item \emph{Accordingly, the induction rule is different for nested recursive
 datatypes.} Again, the old-style induction rule can be generated on demand
 using @{command primrec} if the recursion is via new-style datatypes, as
 explained in Section~\ref{sssec:primrec-nested-as-mutual-recursion}, or using
 @{command datatype_compat}. For recursion through functions, the old-style
 induction rule can be obtained by applying the \<open>[unfolded
 all_mem_range]\<close> attribute on \<open>t.induct\<close>.
 
 \item \emph{The \<^const>\<open>size\<close> function has a slightly different definition.}
 The new function returns \<open>1\<close> instead of \<open>0\<close> for some nonrecursive
 constructors. This departure from the old behavior made it possible to implement
 \<^const>\<open>size\<close> in terms of the generic function \<open>t.size_t\<close>. Moreover,
 the new function considers nested occurrences of a value, in the nested
 recursive case. The old behavior can be obtained by disabling the \<open>size\<close>
 plugin (Section~\ref{sec:selecting-plugins}) and instantiating the
 \<open>size\<close> type class manually.
 
 \item \emph{The internal constructions are completely different.} Proof texts
 that unfold the definition of constants introduced by the old command will
 be difficult to port.
 
 \item \emph{Some constants and theorems have different names.}
 For non-mutually recursive datatypes,
 the alias \<open>t.inducts\<close> for \<open>t.induct\<close> is no longer generated.
 For $m > 1$ mutually recursive datatypes,
 \<open>rec_t\<^sub>1_\<dots>_t\<^sub>m_i\<close> has been renamed
 \<open>rec_t\<^sub>i\<close> for each \<open>i \<in> {1, \<dots>, m}\<close>,
 \<open>t\<^sub>1_\<dots>_t\<^sub>m.inducts(i)\<close> has been renamed
 \<open>t\<^sub>i.induct\<close> for each \<open>i \<in> {1, \<dots>, m}\<close>, and the
 collection \<open>t\<^sub>1_\<dots>_t\<^sub>m.size\<close> (generated by the
 \<open>size\<close> plugin, Section~\ref{ssec:size}) has been divided into
 \<open>t\<^sub>1.size\<close>, \ldots, \<open>t\<^sub>m.size\<close>.
 
 \item \emph{The \<open>t.simps\<close> collection has been extended.}
 Previously available theorems are available at the same index as before.
 
 \item \emph{Variables in generated properties have different names.} This is
 rarely an issue, except in proof texts that refer to variable names in the
 \<open>[where \<dots>]\<close> attribute. The solution is to use the more robust
 \<open>[of \<dots>]\<close> syntax.
 \end{itemize}
 \<close>
 
 
 section \<open>Defining Primitively Recursive Functions
   \label{sec:defining-primitively-recursive-functions}\<close>
 
 text \<open>
 Recursive functions over datatypes can be specified using the @{command primrec}
 command, which supports primitive recursion, or using the \keyw{fun},
 \keyw{function}, and \keyw{partial_function} commands. In this tutorial, the
 focus is on @{command primrec}; \keyw{fun} and \keyw{function} are described in
-a separate tutorial @{cite "isabelle-function"}.
+a separate tutorial \<^cite>\<open>"isabelle-function"\<close>.
 
 Because it is restricted to primitive recursion, @{command primrec} is less
 powerful than \keyw{fun} and \keyw{function}. However, there are primitively
 recursive specifications (e.g., based on infinitely branching or mutually
 recursive datatypes) for which \keyw{fun}'s termination check fails. It is also
 good style to use the simpler @{command primrec} mechanism when it works, both
 as an optimization and as documentation.
 \<close>
 
 
 subsection \<open>Introductory Examples
   \label{ssec:primrec-introductory-examples}\<close>
 
 text \<open>
 Primitive recursion is illustrated through concrete examples based on the
 datatypes defined in Section~\ref{ssec:datatype-introductory-examples}. More
 examples can be found in the directory \<^dir>\<open>~~/src/HOL/Datatype_Examples\<close>.
 \<close>
 
 
 subsubsection \<open>Nonrecursive Types
   \label{sssec:primrec-nonrecursive-types}\<close>
 
 text \<open>
 Primitive recursion removes one layer of constructors on the left-hand side in
 each equation. For example:
 \<close>
 
     primrec (nonexhaustive) bool_of_trool :: "trool \<Rightarrow> bool" where
       "bool_of_trool Faalse \<longleftrightarrow> False"
     | "bool_of_trool Truue \<longleftrightarrow> True"
 
 text \<open>\blankline\<close>
 
     primrec the_list :: "'a option \<Rightarrow> 'a list" where
       "the_list None = []"
     | "the_list (Some a) = [a]"
 
 text \<open>\blankline\<close>
 
     primrec the_default :: "'a \<Rightarrow> 'a option \<Rightarrow> 'a" where
       "the_default d None = d"
     | "the_default _ (Some a) = a"
 
 text \<open>\blankline\<close>
 
     primrec mirrror :: "('a, 'b, 'c) triple \<Rightarrow> ('c, 'b, 'a) triple" where
       "mirrror (Triple a b c) = Triple c b a"
 
 text \<open>
 \noindent
 The equations can be specified in any order, and it is acceptable to leave out
 some cases, which are then unspecified. Pattern matching on the left-hand side
 is restricted to a single datatype, which must correspond to the same argument
 in all equations.
 \<close>
 
 
 subsubsection \<open>Simple Recursion
   \label{sssec:primrec-simple-recursion}\<close>
 
 text \<open>
 For simple recursive types, recursive calls on a constructor argument are
 allowed on the right-hand side:
 \<close>
 
     primrec replicate :: "nat \<Rightarrow> 'a \<Rightarrow> 'a list" where
       "replicate Zero _ = []"
     | "replicate (Succ n) x = x # replicate n x"
 
 text \<open>\blankline\<close>
 
     primrec (nonexhaustive) at :: "'a list \<Rightarrow> nat \<Rightarrow> 'a" where
       "at (x # xs) j =
          (case j of
             Zero \<Rightarrow> x
           | Succ j' \<Rightarrow> at xs j')"
 
 text \<open>\blankline\<close>
 
     primrec (*<*)(in early) (transfer) (*>*)tfold :: "('a \<Rightarrow> 'b \<Rightarrow> 'b) \<Rightarrow> ('a, 'b) tlist \<Rightarrow> 'b" where
       "tfold _ (TNil y) = y"
     | "tfold f (TCons x xs) = f x (tfold f xs)"
 
 text \<open>
 \noindent
 Pattern matching is only available for the argument on which the recursion takes
 place. Fortunately, it is easy to generate pattern-maching equations using the
 @{command simps_of_case} command provided by the theory
 \<^file>\<open>~~/src/HOL/Library/Simps_Case_Conv.thy\<close>.
 \<close>
 
     simps_of_case at_simps_alt: at.simps
 
 text \<open>
 This generates the lemma collection @{thm [source] at_simps_alt}:
 %
 \[@{thm at_simps_alt(1)[no_vars]}
   \qquad @{thm at_simps_alt(2)[no_vars]}\]
 %
 The next example is defined using \keyw{fun} to escape the syntactic
 restrictions imposed on primitively recursive functions:
 \<close>
 
     fun at_least_two :: "nat \<Rightarrow> bool" where
       "at_least_two (Succ (Succ _)) \<longleftrightarrow> True"
     | "at_least_two _ \<longleftrightarrow> False"
 
 
 subsubsection \<open>Mutual Recursion
   \label{sssec:primrec-mutual-recursion}\<close>
 
 text \<open>
 The syntax for mutually recursive functions over mutually recursive datatypes
 is straightforward:
 \<close>
 
     primrec
       nat_of_even_nat :: "even_nat \<Rightarrow> nat" and
       nat_of_odd_nat :: "odd_nat \<Rightarrow> nat"
     where
       "nat_of_even_nat Even_Zero = Zero"
     | "nat_of_even_nat (Even_Succ n) = Succ (nat_of_odd_nat n)"
     | "nat_of_odd_nat (Odd_Succ n) = Succ (nat_of_even_nat n)"
 
 text \<open>\blankline\<close>
 
     primrec
       eval\<^sub>e :: "('a \<Rightarrow> int) \<Rightarrow> ('b \<Rightarrow> int) \<Rightarrow> ('a, 'b) exp \<Rightarrow> int" and
       eval\<^sub>t :: "('a \<Rightarrow> int) \<Rightarrow> ('b \<Rightarrow> int) \<Rightarrow> ('a, 'b) trm \<Rightarrow> int" and
       eval\<^sub>f :: "('a \<Rightarrow> int) \<Rightarrow> ('b \<Rightarrow> int) \<Rightarrow> ('a, 'b) fct \<Rightarrow> int"
     where
       "eval\<^sub>e \<gamma> \<xi> (Term t) = eval\<^sub>t \<gamma> \<xi> t"
     | "eval\<^sub>e \<gamma> \<xi> (Sum t e) = eval\<^sub>t \<gamma> \<xi> t + eval\<^sub>e \<gamma> \<xi> e"
     | "eval\<^sub>t \<gamma> \<xi> (Factor f) = eval\<^sub>f \<gamma> \<xi> f"
     | "eval\<^sub>t \<gamma> \<xi> (Prod f t) = eval\<^sub>f \<gamma> \<xi> f + eval\<^sub>t \<gamma> \<xi> t"
     | "eval\<^sub>f \<gamma> _ (Const a) = \<gamma> a"
     | "eval\<^sub>f _ \<xi> (Var b) = \<xi> b"
     | "eval\<^sub>f \<gamma> \<xi> (Expr e) = eval\<^sub>e \<gamma> \<xi> e"
 
 text \<open>
 \noindent
 Mutual recursion is possible within a single type, using \keyw{fun}:
 \<close>
 
     fun
       even :: "nat \<Rightarrow> bool" and
       odd :: "nat \<Rightarrow> bool"
     where
       "even Zero = True"
     | "even (Succ n) = odd n"
     | "odd Zero = False"
     | "odd (Succ n) = even n"
 
 
 subsubsection \<open>Nested Recursion
   \label{sssec:primrec-nested-recursion}\<close>
 
 text \<open>
 In a departure from the old datatype package, nested recursion is normally
 handled via the map functions of the nesting type constructors. For example,
 recursive calls are lifted to lists using \<^const>\<open>map\<close>:
 \<close>
 
 (*<*)
     datatype 'a tree\<^sub>f\<^sub>f = Node\<^sub>f\<^sub>f (lbl\<^sub>f\<^sub>f: 'a) (sub\<^sub>f\<^sub>f: "'a tree\<^sub>f\<^sub>f list")
 (*>*)
     primrec at\<^sub>f\<^sub>f :: "'a tree\<^sub>f\<^sub>f \<Rightarrow> nat list \<Rightarrow> 'a" where
       "at\<^sub>f\<^sub>f (Node\<^sub>f\<^sub>f a ts) js =
          (case js of
             [] \<Rightarrow> a
           | j # js' \<Rightarrow> at (map (\<lambda>t. at\<^sub>f\<^sub>f t js') ts) j)"
 
 text \<open>
 \noindent
 The next example features recursion through the \<open>option\<close> type. Although
 \<open>option\<close> is not a new-style datatype, it is registered as a BNF with the
 map function \<^const>\<open>map_option\<close>:
 \<close>
 
     primrec (*<*)(in early) (*>*)sum_btree :: "('a::{zero,plus}) btree \<Rightarrow> 'a" where
       "sum_btree (BNode a lt rt) =
          a + the_default 0 (map_option sum_btree lt) +
            the_default 0 (map_option sum_btree rt)"
 
 text \<open>
 \noindent
 The same principle applies for arbitrary type constructors through which
 recursion is possible. Notably, the map function for the function type
 (\<open>\<Rightarrow>\<close>) is simply composition (\<open>(\<circ>)\<close>):
 \<close>
 
     primrec (*<*)(in early) (*>*)relabel_ft :: "('a \<Rightarrow> 'a) \<Rightarrow> 'a ftree \<Rightarrow> 'a ftree" where
       "relabel_ft f (FTLeaf x) = FTLeaf (f x)"
     | "relabel_ft f (FTNode g) = FTNode (relabel_ft f \<circ> g)"
 
 text \<open>
 \noindent
 For convenience, recursion through functions can also be expressed using
 $\lambda$-abstractions and function application rather than through composition.
 For example:
 \<close>
 
     primrec relabel_ft :: "('a \<Rightarrow> 'a) \<Rightarrow> 'a ftree \<Rightarrow> 'a ftree" where
       "relabel_ft f (FTLeaf x) = FTLeaf (f x)"
     | "relabel_ft f (FTNode g) = FTNode (\<lambda>x. relabel_ft f (g x))"
 
 text \<open>\blankline\<close>
 
     primrec (nonexhaustive) subtree_ft :: "'a \<Rightarrow> 'a ftree \<Rightarrow> 'a ftree" where
       "subtree_ft x (FTNode g) = g x"
 
 text \<open>
 \noindent
 For recursion through curried $n$-ary functions, $n$ applications of
 \<^term>\<open>(\<circ>)\<close> are necessary. The examples below illustrate the case where
 $n = 2$:
 \<close>
 
     datatype 'a ftree2 = FTLeaf2 'a | FTNode2 "'a \<Rightarrow> 'a \<Rightarrow> 'a ftree2"
 
 text \<open>\blankline\<close>
 
     primrec (*<*)(in early) (*>*)relabel_ft2 :: "('a \<Rightarrow> 'a) \<Rightarrow> 'a ftree2 \<Rightarrow> 'a ftree2" where
       "relabel_ft2 f (FTLeaf2 x) = FTLeaf2 (f x)"
     | "relabel_ft2 f (FTNode2 g) = FTNode2 ((\<circ>) ((\<circ>) (relabel_ft2 f)) g)"
 
 text \<open>\blankline\<close>
 
     primrec relabel_ft2 :: "('a \<Rightarrow> 'a) \<Rightarrow> 'a ftree2 \<Rightarrow> 'a ftree2" where
       "relabel_ft2 f (FTLeaf2 x) = FTLeaf2 (f x)"
     | "relabel_ft2 f (FTNode2 g) = FTNode2 (\<lambda>x y. relabel_ft2 f (g x y))"
 
 text \<open>\blankline\<close>
 
     primrec (nonexhaustive) subtree_ft2 :: "'a \<Rightarrow> 'a \<Rightarrow> 'a ftree2 \<Rightarrow> 'a ftree2" where
       "subtree_ft2 x y (FTNode2 g) = g x y"
 
 text \<open>
 For any datatype featuring nesting, the predicator can be used instead of the
 map function, typically when defining predicates. For example:
 \<close>
 
     primrec increasing_tree :: "int \<Rightarrow> int tree\<^sub>f\<^sub>f \<Rightarrow> bool" where
       "increasing_tree m (Node\<^sub>f\<^sub>f n ts) \<longleftrightarrow>
        n \<ge> m \<and> list_all (increasing_tree (n + 1)) ts"
 
 
 subsubsection \<open>Nested-as-Mutual Recursion
   \label{sssec:primrec-nested-as-mutual-recursion}\<close>
 
 (*<*)
     locale n2m
     begin
 (*>*)
 
 text \<open>
 For compatibility with the old package, but also because it is sometimes
 convenient in its own right, it is possible to treat nested recursive datatypes
 as mutually recursive ones if the recursion takes place though new-style
 datatypes. For example:
 \<close>
 
     primrec (nonexhaustive)
       at\<^sub>f\<^sub>f :: "'a tree\<^sub>f\<^sub>f \<Rightarrow> nat list \<Rightarrow> 'a" and
       ats\<^sub>f\<^sub>f :: "'a tree\<^sub>f\<^sub>f list \<Rightarrow> nat \<Rightarrow> nat list \<Rightarrow> 'a"
     where
       "at\<^sub>f\<^sub>f (Node\<^sub>f\<^sub>f a ts) js =
          (case js of
             [] \<Rightarrow> a
           | j # js' \<Rightarrow> ats\<^sub>f\<^sub>f ts j js')"
     | "ats\<^sub>f\<^sub>f (t # ts) j =
          (case j of
             Zero \<Rightarrow> at\<^sub>f\<^sub>f t
           | Succ j' \<Rightarrow> ats\<^sub>f\<^sub>f ts j')"
 
 text \<open>
 \noindent
 Appropriate induction rules are generated as
 @{thm [source] at\<^sub>f\<^sub>f.induct},
 @{thm [source] ats\<^sub>f\<^sub>f.induct}, and
 @{thm [source] at\<^sub>f\<^sub>f_ats\<^sub>f\<^sub>f.induct}. The
 induction rules and the underlying recursors are generated dynamically
 and are kept in a cache to speed up subsequent definitions.
 
 Here is a second example:
 \<close>
 
     primrec
       sum_btree :: "('a::{zero,plus}) btree \<Rightarrow> 'a" and
       sum_btree_option :: "'a btree option \<Rightarrow> 'a"
     where
       "sum_btree (BNode a lt rt) =
          a + sum_btree_option lt + sum_btree_option rt"
     | "sum_btree_option None = 0"
     | "sum_btree_option (Some t) = sum_btree t"
 
 text \<open>
 %  * can pretend a nested type is mutually recursive (if purely inductive)
 %  * avoids the higher-order map
 %  * e.g.
 
 %  * this can always be avoided;
 %     * e.g. in our previous example, we first mapped the recursive
 %       calls, then we used a generic at function to retrieve the result
 %
 %  * there's no hard-and-fast rule of when to use one or the other,
 %    just like there's no rule when to use fold and when to use
 %    primrec
 %
 %  * higher-order approach, considering nesting as nesting, is more
 %    compositional -- e.g. we saw how we could reuse an existing polymorphic
 %    at or the_default, whereas \<^const>\<open>ats\<^sub>f\<^sub>f\<close> is much more specific
 %
 %  * but:
 %     * is perhaps less intuitive, because it requires higher-order thinking
 %     * may seem inefficient, and indeed with the code generator the
 %       mutually recursive version might be nicer
 %     * is somewhat indirect -- must apply a map first, then compute a result
 %       (cannot mix)
 %     * the auxiliary functions like \<^const>\<open>ats\<^sub>f\<^sub>f\<close> are sometimes useful in own right
 %
 %  * impact on automation unclear
 %
 \<close>
 (*<*)
     end
 (*>*)
 
 
 subsection \<open>Command Syntax
   \label{ssec:primrec-command-syntax}\<close>
 
 subsubsection \<open>\keyw{primrec}
   \label{sssec:primrec}\<close>
 
 text \<open>
 \begin{matharray}{rcl}
   @{command_def "primrec"} & : & \<open>local_theory \<rightarrow> local_theory\<close>
 \end{matharray}
 
 \<^rail>\<open>
   @@{command primrec} target? @{syntax pr_options}? fixes \<newline>
   @'where' (@{syntax pr_equation} + '|')
   ;
   @{syntax_def pr_options}: '(' ((@{syntax plugins} | 'nonexhaustive' | 'transfer') + ',') ')'
   ;
   @{syntax_def pr_equation}: thmdecl? prop
 \<close>
 
 \medskip
 
 \noindent
 The @{command primrec} command introduces a set of mutually recursive functions
 over datatypes.
 
 The syntactic entity \synt{target} can be used to specify a local context,
 \synt{fixes} denotes a list of names with optional type signatures,
 \synt{thmdecl} denotes an optional name for the formula that follows, and
-\synt{prop} denotes a HOL proposition @{cite "isabelle-isar-ref"}.
+\synt{prop} denotes a HOL proposition \<^cite>\<open>"isabelle-isar-ref"\<close>.
 
 The optional target is optionally followed by a combination of the following
 options:
 
 \begin{itemize}
 \setlength{\itemsep}{0pt}
 
 \item
 The \<open>plugins\<close> option indicates which plugins should be enabled
 (\<open>only\<close>) or disabled (\<open>del\<close>). By default, all plugins are enabled.
 
 \item
 The \<open>nonexhaustive\<close> option indicates that the functions are not
 necessarily specified for all constructors. It can be used to suppress the
 warning that is normally emitted when some constructors are missing.
 
 \item
 The \<open>transfer\<close> option indicates that an unconditional transfer rule
 should be generated and proved \<open>by transfer_prover\<close>. The
 \<open>[transfer_rule]\<close> attribute is set on the generated theorem.
 \end{itemize}
 
 %%% TODO: elaborate on format of the equations
 %%% TODO: elaborate on mutual and nested-to-mutual
 \<close>
 
 
 subsection \<open>Generated Theorems
   \label{ssec:primrec-generated-theorems}\<close>
 
 (*<*)
     context early
     begin
 (*>*)
 
 text \<open>
 The @{command primrec} command generates the following properties (listed
 for \<^const>\<open>tfold\<close>):
 
 \begin{indentblock}
 \begin{description}
 
 \item[\<open>f.\<close>\hthm{simps} \<open>[simp, code]\<close>\rm:] ~ \\
 @{thm tfold.simps(1)[no_vars]} \\
 @{thm tfold.simps(2)[no_vars]} \\
 The \<open>[code]\<close> attribute is set by the \<open>code\<close> plugin
 (Section~\ref{ssec:code-generator}).
 
 \item[\<open>f.\<close>\hthm{transfer} \<open>[transfer_rule]\<close>\rm:] ~ \\
 @{thm tfold.transfer[no_vars]} \\
 This theorem is generated by the \<open>transfer\<close> plugin
 (Section~\ref{ssec:transfer}) for functions declared with the \<open>transfer\<close>
 option enabled.
 
 \item[\<open>f.\<close>\hthm{induct} \<open>[case_names C\<^sub>1 \<dots> C\<^sub>n]\<close>\rm:] ~ \\
 This induction rule is generated for nested-as-mutual recursive functions
 (Section~\ref{sssec:primrec-nested-as-mutual-recursion}).
 
 \item[\<open>f\<^sub>1_\<dots>_f\<^sub>m.\<close>\hthm{induct} \<open>[case_names C\<^sub>1 \<dots> C\<^sub>n]\<close>\rm:] ~ \\
 This induction rule is generated for nested-as-mutual recursive functions
 (Section~\ref{sssec:primrec-nested-as-mutual-recursion}). Given $m > 1$ mutually
 recursive functions, this rule can be used to prove $m$ properties
 simultaneously.
 
 \end{description}
 \end{indentblock}
 \<close>
 
 (*<*)
     end
 (*>*)
 
 
 subsection \<open>Recursive Default Values for Selectors
   \label{ssec:primrec-recursive-default-values-for-selectors}\<close>
 
 text \<open>
 A datatype selector \<open>un_D\<close> can have a default value for each constructor
 on which it is not otherwise specified. Occasionally, it is useful to have the
 default value be defined recursively. This leads to a chicken-and-egg
 situation, because the datatype is not introduced yet at the moment when the
 selectors are introduced. Of course, we can always define the selectors
 manually afterward, but we then have to state and prove all the characteristic
 theorems ourselves instead of letting the package do it.
 
 Fortunately, there is a workaround that relies on overloading to relieve us
 from the tedium of manual derivations:
 
 \begin{enumerate}
 \setlength{\itemsep}{0pt}
 
 \item
 Introduce a fully unspecified constant \<open>un_D\<^sub>0 :: 'a\<close> using
 @{command consts}.
 
 \item
 Define the datatype, specifying \<open>un_D\<^sub>0\<close> as the selector's default
 value.
 
 \item
 Define the behavior of \<open>un_D\<^sub>0\<close> on values of the newly introduced
 datatype using the \keyw{overloading} command.
 
 \item
 Derive the desired equation on \<open>un_D\<close> from the characteristic equations
 for \<open>un_D\<^sub>0\<close>.
 \end{enumerate}
 
 \noindent
 The following example illustrates this procedure:
 \<close>
 
 (*<*)
     hide_const termi
 (*>*)
     consts termi\<^sub>0 :: 'a
 
 text \<open>\blankline\<close>
 
     datatype ('a, 'b) tlist =
       TNil (termi: 'b)
     | TCons (thd: 'a) (ttl: "('a, 'b) tlist")
     where
       "ttl (TNil y) = TNil y"
     | "termi (TCons _ xs) = termi\<^sub>0 xs"
 
 text \<open>\blankline\<close>
 
     overloading
       termi\<^sub>0 \<equiv> "termi\<^sub>0 :: ('a, 'b) tlist \<Rightarrow> 'b"
     begin
     primrec termi\<^sub>0 :: "('a, 'b) tlist \<Rightarrow> 'b" where
       "termi\<^sub>0 (TNil y) = y"
     | "termi\<^sub>0 (TCons x xs) = termi\<^sub>0 xs"
     end
 
 text \<open>\blankline\<close>
 
     lemma termi_TCons[simp]: "termi (TCons x xs) = termi xs"
       by (cases xs) auto
 
 
 subsection \<open>Compatibility Issues
   \label{ssec:primrec-compatibility-issues}\<close>
 
 text \<open>
 The command @{command primrec}'s behavior on new-style datatypes has been
 designed to be highly compatible with that for old, pre-Isabelle2015 datatypes,
 to ease migration. There is nonetheless at least one incompatibility that may
 arise when porting to the new package:
 
 \begin{itemize}
 \setlength{\itemsep}{0pt}
 
 \item \emph{Some theorems have different names.}
 For $m > 1$ mutually recursive functions,
 \<open>f\<^sub>1_\<dots>_f\<^sub>m.simps\<close> has been broken down into separate
 subcollections \<open>f\<^sub>i.simps\<close>.
 \end{itemize}
 \<close>
 
 
 section \<open>Defining Codatatypes
   \label{sec:defining-codatatypes}\<close>
 
 text \<open>
 Codatatypes can be specified using the @{command codatatype} command. The
 command is first illustrated through concrete examples featuring different
 flavors of corecursion. More examples can be found in the directory
 \<^dir>\<open>~~/src/HOL/Datatype_Examples\<close>. The \emph{Archive of Formal Proofs} also
-includes some useful codatatypes, notably for lazy lists @{cite
-"lochbihler-2010"}.
+includes some useful codatatypes, notably for lazy lists \<^cite>\<open>"lochbihler-2010"\<close>.
 \<close>
 
 
 subsection \<open>Introductory Examples
   \label{ssec:codatatype-introductory-examples}\<close>
 
 subsubsection \<open>Simple Corecursion
   \label{sssec:codatatype-simple-corecursion}\<close>
 
 text \<open>
 Non-corecursive codatatypes coincide with the corresponding datatypes, so they
 are rarely used in practice. \emph{Corecursive codatatypes} have the same syntax
 as recursive datatypes, except for the command name. For example, here is the
 definition of lazy lists:
 \<close>
 
     codatatype (lset: 'a) llist =
       lnull: LNil
     | LCons (lhd: 'a) (ltl: "'a llist")
     for
       map: lmap
       rel: llist_all2
       pred: llist_all
     where
       "ltl LNil = LNil"
 
 text \<open>
 \noindent
 Lazy lists can be infinite, such as \<open>LCons 0 (LCons 0 (\<dots>))\<close> and
 \<open>LCons 0 (LCons 1 (LCons 2 (\<dots>)))\<close>. Here is a related type, that of
 infinite streams:
 \<close>
 
     codatatype (sset: 'a) stream =
       SCons (shd: 'a) (stl: "'a stream")
     for
       map: smap
       rel: stream_all2
 
 text \<open>
 \noindent
 Another interesting type that can
 be defined as a codatatype is that of the extended natural numbers:
 \<close>
 
     codatatype enat = EZero | ESucc enat
 
 text \<open>
 \noindent
 This type has exactly one infinite element, \<open>ESucc (ESucc (ESucc (\<dots>)))\<close>,
 that represents $\infty$. In addition, it has finite values of the form
 \<open>ESucc (\<dots> (ESucc EZero)\<dots>)\<close>.
 
 Here is an example with many constructors:
 \<close>
 
     codatatype 'a process =
       Fail
     | Skip (cont: "'a process")
     | Action (prefix: 'a) (cont: "'a process")
     | Choice (left: "'a process") (right: "'a process")
 
 text \<open>
 \noindent
 Notice that the \<^const>\<open>cont\<close> selector is associated with both \<^const>\<open>Skip\<close>
 and \<^const>\<open>Action\<close>.
 \<close>
 
 
 subsubsection \<open>Mutual Corecursion
   \label{sssec:codatatype-mutual-corecursion}\<close>
 
 text \<open>
 \noindent
 The example below introduces a pair of \emph{mutually corecursive} types:
 \<close>
 
     codatatype even_enat = Even_EZero | Even_ESucc odd_enat
     and odd_enat = Odd_ESucc even_enat
 
 
 subsubsection \<open>Nested Corecursion
   \label{sssec:codatatype-nested-corecursion}\<close>
 
 text \<open>
 \noindent
 The next examples feature \emph{nested corecursion}:
 \<close>
 
     codatatype 'a tree\<^sub>i\<^sub>i = Node\<^sub>i\<^sub>i (lbl\<^sub>i\<^sub>i: 'a) (sub\<^sub>i\<^sub>i: "'a tree\<^sub>i\<^sub>i llist")
 
 text \<open>\blankline\<close>
 
     codatatype 'a tree\<^sub>i\<^sub>s = Node\<^sub>i\<^sub>s (lbl\<^sub>i\<^sub>s: 'a) (sub\<^sub>i\<^sub>s: "'a tree\<^sub>i\<^sub>s fset")
 
 text \<open>\blankline\<close>
 
     codatatype 'a sm = SM (accept: bool) (trans: "'a \<Rightarrow> 'a sm")
 
 
 subsection \<open>Command Syntax
   \label{ssec:codatatype-command-syntax}\<close>
 
 subsubsection \<open>\keyw{codatatype}
   \label{sssec:codatatype}\<close>
 
 text \<open>
 \begin{matharray}{rcl}
   @{command_def "codatatype"} & : & \<open>local_theory \<rightarrow> local_theory\<close>
 \end{matharray}
 
 \<^rail>\<open>
   @@{command codatatype} target? @{syntax dt_options}? @{syntax dt_spec}
 \<close>
 
 \medskip
 
 \noindent
 Definitions of codatatypes have almost exactly the same syntax as for datatypes
 (Section~\ref{ssec:datatype-command-syntax}). The \<open>discs_sels\<close> option
 is superfluous because discriminators and selectors are always generated for
 codatatypes.
 \<close>
 
 
 subsection \<open>Generated Constants
   \label{ssec:codatatype-generated-constants}\<close>
 
 text \<open>
 Given a codatatype \<open>('a\<^sub>1, \<dots>, 'a\<^sub>m) t\<close>
 with $m > 0$ live type variables and $n$ constructors \<open>t.C\<^sub>1\<close>,
 \ldots, \<open>t.C\<^sub>n\<close>, the same auxiliary constants are generated as for
 datatypes (Section~\ref{ssec:datatype-generated-constants}), except that the
 recursor is replaced by a dual concept:
 
 \medskip
 
 \begin{tabular}{@ {}ll@ {}}
 Corecursor: &
   \<open>t.corec_t\<close>
 \end{tabular}
 \<close>
 
 
 subsection \<open>Generated Theorems
   \label{ssec:codatatype-generated-theorems}\<close>
 
 text \<open>
 The characteristic theorems generated by @{command codatatype} are grouped in
 three broad categories:
 
 \begin{itemize}
 \setlength{\itemsep}{0pt}
 
 \item The \emph{free constructor theorems}
 (Section~\ref{sssec:free-constructor-theorems}) are properties of the
 constructors and destructors that can be derived for any freely generated type.
 
 \item The \emph{functorial theorems}
 (Section~\ref{sssec:functorial-theorems}) are properties of datatypes related to
 their BNF nature.
 
 \item The \emph{coinductive theorems} (Section~\ref{sssec:coinductive-theorems})
 are properties of datatypes related to their coinductive nature.
 \end{itemize}
 
 \noindent
 The first two categories are exactly as for datatypes.
 \<close>
 
 
 subsubsection \<open>Coinductive Theorems
   \label{sssec:coinductive-theorems}\<close>
 
 text \<open>
 The coinductive theorems are listed below for \<^typ>\<open>'a llist\<close>:
 
 \begin{indentblock}
 \begin{description}
 
 \item[\begin{tabular}{@ {}l@ {}}
   \<open>t.\<close>\hthm{coinduct} \<open>[consumes m, case_names t\<^sub>1 \<dots> t\<^sub>m,\<close> \\
   \phantom{\<open>t.\<close>\hthm{coinduct} \<open>[\<close>}\<open>case_conclusion D\<^sub>1 \<dots>
   D\<^sub>n, coinduct t]\<close>\rm:
 \end{tabular}] ~ \\
 @{thm llist.coinduct[no_vars]}
 
 \item[\begin{tabular}{@ {}l@ {}}
   \<open>t.\<close>\hthm{coinduct_strong} \<open>[consumes m, case_names t\<^sub>1 \<dots> t\<^sub>m,\<close> \\
   \phantom{\<open>t.\<close>\hthm{coinduct_strong} \<open>[\<close>}\<open>case_conclusion D\<^sub>1 \<dots> D\<^sub>n]\<close>\rm:
 \end{tabular}] ~ \\
 @{thm llist.coinduct_strong[no_vars]}
 
 \item[\begin{tabular}{@ {}l@ {}}
   \<open>t.\<close>\hthm{rel_coinduct} \<open>[consumes m, case_names t\<^sub>1 \<dots> t\<^sub>m,\<close> \\
   \phantom{\<open>t.\<close>\hthm{rel_coinduct} \<open>[\<close>}\<open>case_conclusion D\<^sub>1 \<dots>
   D\<^sub>n, coinduct pred]\<close>\rm:
 \end{tabular}] ~ \\
 @{thm llist.rel_coinduct[no_vars]}
 
 \item[\begin{tabular}{@ {}l@ {}}
   \<open>t\<^sub>1_\<dots>_t\<^sub>m.\<close>\hthm{coinduct} \<open>[case_names t\<^sub>1 \<dots> t\<^sub>m, case_conclusion D\<^sub>1 \<dots> D\<^sub>n]\<close> \\
   \<open>t\<^sub>1_\<dots>_t\<^sub>m.\<close>\hthm{coinduct_strong} \<open>[case_names t\<^sub>1 \<dots> t\<^sub>m,\<close> \\
   \phantom{\<open>t\<^sub>1_\<dots>_t\<^sub>m.\<close>\hthm{coinduct_strong} \<open>[\<close>}\<open>case_conclusion D\<^sub>1 \<dots> D\<^sub>n]\<close>\rm: \\
   \<open>t\<^sub>1_\<dots>_t\<^sub>m.\<close>\hthm{rel_coinduct} \<open>[case_names t\<^sub>1 \<dots> t\<^sub>m,\<close> \\
   \phantom{\<open>t\<^sub>1_\<dots>_t\<^sub>m.\<close>\hthm{rel_coinduct} \<open>[\<close>}\<open>case_conclusion D\<^sub>1 \<dots> D\<^sub>n]\<close>\rm: \\
 \end{tabular}] ~ \\
 Given $m > 1$ mutually corecursive codatatypes, these coinduction rules can be
 used to prove $m$ properties simultaneously.
 
 \item[\begin{tabular}{@ {}l@ {}}
   \<open>t\<^sub>1_\<dots>_t\<^sub>m.\<close>\hthm{set_induct} \<open>[case_names C\<^sub>1 \<dots> C\<^sub>n,\<close> \\
   \phantom{\<open>t\<^sub>1_\<dots>_t\<^sub>m.\<close>\hthm{set_induct} \<open>[\<close>}\<open>induct set: set\<^sub>j_t\<^sub>1, \<dots>, induct set: set\<^sub>j_t\<^sub>m]\<close>\rm: \\
 \end{tabular}] ~ \\
 @{thm llist.set_induct[no_vars]} \\
 If $m = 1$, the attribute \<open>[consumes 1]\<close> is generated as well.
 
 \item[\<open>t.\<close>\hthm{corec}\rm:] ~ \\
 @{thm llist.corec(1)[no_vars]} \\
 @{thm llist.corec(2)[no_vars]}
 
 \item[\<open>t.\<close>\hthm{corec_code} \<open>[code]\<close>\rm:] ~ \\
 @{thm llist.corec_code[no_vars]} \\
 The \<open>[code]\<close> attribute is set by the \<open>code\<close> plugin
 (Section~\ref{ssec:code-generator}).
 
 \item[\<open>t.\<close>\hthm{corec_disc}\rm:] ~ \\
 @{thm llist.corec_disc(1)[no_vars]} \\
 @{thm llist.corec_disc(2)[no_vars]}
 
 \item[\<open>t.\<close>\hthm{corec_disc_iff} \<open>[simp]\<close>\rm:] ~ \\
 @{thm llist.corec_disc_iff(1)[no_vars]} \\
 @{thm llist.corec_disc_iff(2)[no_vars]}
 
 \item[\<open>t.\<close>\hthm{corec_sel} \<open>[simp]\<close>\rm:] ~ \\
 @{thm llist.corec_sel(1)[no_vars]} \\
 @{thm llist.corec_sel(2)[no_vars]}
 
 \item[\<open>t.\<close>\hthm{map_o_corec}\rm:] ~ \\
 @{thm llist.map_o_corec[no_vars]}
 
 \item[\<open>t.\<close>\hthm{corec_transfer} \<open>[transfer_rule]\<close>\rm:] ~ \\
 @{thm llist.corec_transfer[no_vars]} \\
 The \<open>[transfer_rule]\<close> attribute is set by the \<open>transfer\<close> plugin
 (Section~\ref{ssec:transfer}) for type constructors with no dead type arguments.
 
 \end{description}
 \end{indentblock}
 
 \noindent
 For convenience, @{command codatatype} also provides the following collection:
 
 \begin{indentblock}
 \begin{description}
 
 \item[\<open>t.\<close>\hthm{simps}] = \<open>t.inject\<close> \<open>t.distinct\<close> \<open>t.case\<close> \<open>t.corec_disc_iff\<close> \<open>t.corec_sel\<close> \\
 \<open>t.map\<close> \<open>t.rel_inject\<close> \<open>t.rel_distinct\<close> \<open>t.set\<close>
 
 \end{description}
 \end{indentblock}
 \<close>
 
 
 subsection \<open>Antiquotation
   \label{ssec:codatatype-antiquotation}\<close>
 
 subsubsection \<open>\textit{codatatype}
   \label{sssec:codatatype-codatatype}\<close>
 
 text \<open>
 The \textit{codatatype} antiquotation, written
 \texttt{\char`\\\char`<\char`^}\verb|codatatype>|\guilsinglleft\textit{t}\guilsinglright{}
 or \texttt{@}\verb|{codatatype| \textit{t}\verb|}|, where \textit{t} is a type
 name, expands to \LaTeX{} code for the definition of the codatatype, with each
 constructor listed with its argument types. For example, if \textit{t} is
 @{type llist}:
 
 \begin{quote}
 \<^codatatype>\<open>llist\<close>
 \end{quote}
 \<close>
 
 
 section \<open>Defining Primitively Corecursive Functions
   \label{sec:defining-primitively-corecursive-functions}\<close>
 
 text \<open>
 Corecursive functions can be specified using the @{command primcorec} and
 \keyw{prim\-corec\-ursive} commands, which support primitive corecursion.
 Other approaches include the more general \keyw{partial_function} command, the
 \keyw{corec} and \keyw{corecursive} commands, and techniques based on domains
-and topologies @{cite "lochbihler-hoelzl-2014"}. In this tutorial, the focus is
+and topologies \<^cite>\<open>"lochbihler-hoelzl-2014"\<close>. In this tutorial, the focus is
 on @{command primcorec} and @{command primcorecursive}; \keyw{corec} and
 \keyw{corecursive} are described in a separate tutorial
-@{cite "isabelle-corec"}. More examples can be found in the directories
+\<^cite>\<open>"isabelle-corec"\<close>. More examples can be found in the directories
 \<^dir>\<open>~~/src/HOL/Datatype_Examples\<close> and \<^dir>\<open>~~/src/HOL/Corec_Examples\<close>.
 
 Whereas recursive functions consume datatypes one constructor at a time,
 corecursive functions construct codatatypes one constructor at a time.
 Partly reflecting a lack of agreement among proponents of coalgebraic methods,
 Isabelle supports three competing syntaxes for specifying a function $f$:
 
 \begin{itemize}
 \setlength{\itemsep}{0pt}
 
 \abovedisplayskip=.5\abovedisplayskip
 \belowdisplayskip=.5\belowdisplayskip
 
 \item The \emph{destructor view} specifies $f$ by implications of the form
 \[\<open>\<dots> \<Longrightarrow> is_C\<^sub>j (f x\<^sub>1 \<dots> x\<^sub>n)\<close>\] and
 equations of the form
 \[\<open>un_C\<^sub>ji (f x\<^sub>1 \<dots> x\<^sub>n) = \<dots>\<close>\]
 This style is popular in the coalgebraic literature.
 
 \item The \emph{constructor view} specifies $f$ by equations of the form
 \[\<open>\<dots> \<Longrightarrow> f x\<^sub>1 \<dots> x\<^sub>n = C\<^sub>j \<dots>\<close>\]
 This style is often more concise than the previous one.
 
 \item The \emph{code view} specifies $f$ by a single equation of the form
 \[\<open>f x\<^sub>1 \<dots> x\<^sub>n = \<dots>\<close>\]
 with restrictions on the format of the right-hand side. Lazy functional
 programming languages such as Haskell support a generalized version of this
 style.
 \end{itemize}
 
 All three styles are available as input syntax. Whichever syntax is chosen,
 characteristic theorems for all three styles are generated.
 
 %%% TODO: partial_function? E.g. for defining tail recursive function on lazy
 %%% lists (cf. terminal0 in TLList.thy)
 \<close>
 
 
 subsection \<open>Introductory Examples
   \label{ssec:primcorec-introductory-examples}\<close>
 
 text \<open>
 Primitive corecursion is illustrated through concrete examples based on the
 codatatypes defined in Section~\ref{ssec:codatatype-introductory-examples}. More
 examples can be found in the directory \<^dir>\<open>~~/src/HOL/Datatype_Examples\<close>.
 The code view is favored in the examples below. Sections
 \ref{ssec:primrec-constructor-view} and \ref{ssec:primrec-destructor-view}
 present the same examples expressed using the constructor and destructor views.
 \<close>
 
 
 subsubsection \<open>Simple Corecursion
   \label{sssec:primcorec-simple-corecursion}\<close>
 
 text \<open>
 Following the code view, corecursive calls are allowed on the right-hand side as
 long as they occur under a constructor, which itself appears either directly to
 the right of the equal sign or in a conditional expression:
 \<close>
 
     primcorec (*<*)(transfer) (*>*)literate :: "('a \<Rightarrow> 'a) \<Rightarrow> 'a \<Rightarrow> 'a llist" where
       "literate g x = LCons x (literate g (g x))"
 
 text \<open>\blankline\<close>
 
     primcorec siterate :: "('a \<Rightarrow> 'a) \<Rightarrow> 'a \<Rightarrow> 'a stream" where
       "siterate g x = SCons x (siterate g (g x))"
 
 text \<open>
 \noindent
 The constructor ensures that progress is made---i.e., the function is
 \emph{productive}. The above functions compute the infinite lazy list or stream
 \<open>[x, g x, g (g x), \<dots>]\<close>. Productivity guarantees that prefixes
 \<open>[x, g x, g (g x), \<dots>, (g ^^ k) x]\<close> of arbitrary finite length
 \<open>k\<close> can be computed by unfolding the code equation a finite number of
 times.
 
 Corecursive functions construct codatatype values, but nothing prevents them
 from also consuming such values. The following function drops every second
 element in a stream:
 \<close>
 
     primcorec every_snd :: "'a stream \<Rightarrow> 'a stream" where
       "every_snd s = SCons (shd s) (stl (stl s))"
 
 text \<open>
 \noindent
 Constructs such as \<open>let\<close>--\<open>in\<close>, \<open>if\<close>--\<open>then\<close>--\<open>else\<close>, and \<open>case\<close>--\<open>of\<close> may
 appear around constructors that guard corecursive calls:
 \<close>
 
     primcorec lapp :: "'a llist \<Rightarrow> 'a llist \<Rightarrow> 'a llist" where
       "lapp xs ys =
          (case xs of
             LNil \<Rightarrow> ys
           | LCons x xs' \<Rightarrow> LCons x (lapp xs' ys))"
 
 text \<open>
 \noindent
 For technical reasons, \<open>case\<close>--\<open>of\<close> is only supported for
 case distinctions on (co)datatypes that provide discriminators and selectors.
 
 Pattern matching is not supported by @{command primcorec}. Fortunately, it is
 easy to generate pattern-maching equations using the @{command simps_of_case}
 command provided by the theory \<^file>\<open>~~/src/HOL/Library/Simps_Case_Conv.thy\<close>.
 \<close>
 
     simps_of_case lapp_simps: lapp.code
 
 text \<open>
 This generates the lemma collection @{thm [source] lapp_simps}:
 %
 \begin{gather*}
   @{thm lapp_simps(1)[no_vars]} \\
   @{thm lapp_simps(2)[no_vars]}
 \end{gather*}
 %
 Corecursion is useful to specify not only functions but also infinite objects:
 \<close>
 
     primcorec infty :: enat where
       "infty = ESucc infty"
 
 text \<open>
 \noindent
 The example below constructs a pseudorandom process value. It takes a stream of
 actions (\<open>s\<close>), a pseudorandom function generator (\<open>f\<close>), and a
 pseudorandom seed (\<open>n\<close>):
 \<close>
 
 (*<*)
     context early
     begin
 (*>*)
     primcorec
       random_process :: "'a stream \<Rightarrow> (int \<Rightarrow> int) \<Rightarrow> int \<Rightarrow> 'a process"
     where
       "random_process s f n =
          (if n mod 4 = 0 then
             Fail
           else if n mod 4 = 1 then
             Skip (random_process s f (f n))
           else if n mod 4 = 2 then
             Action (shd s) (random_process (stl s) f (f n))
           else
             Choice (random_process (every_snd s) (f \<circ> f) (f n))
               (random_process (every_snd (stl s)) (f \<circ> f) (f (f n))))"
 (*<*)
     end
 (*>*)
 
 text \<open>
 \noindent
 The main disadvantage of the code view is that the conditions are tested
 sequentially. This is visible in the generated theorems. The constructor and
 destructor views offer nonsequential alternatives.
 \<close>
 
 
 subsubsection \<open>Mutual Corecursion
   \label{sssec:primcorec-mutual-corecursion}\<close>
 
 text \<open>
 The syntax for mutually corecursive functions over mutually corecursive
 datatypes is unsurprising:
 \<close>
 
     primcorec
       even_infty :: even_enat and
       odd_infty :: odd_enat
     where
       "even_infty = Even_ESucc odd_infty"
     | "odd_infty = Odd_ESucc even_infty"
 
 
 subsubsection \<open>Nested Corecursion
   \label{sssec:primcorec-nested-corecursion}\<close>
 
 text \<open>
 The next pair of examples generalize the \<^const>\<open>literate\<close> and \<^const>\<open>siterate\<close>
 functions (Section~\ref{sssec:primcorec-nested-corecursion}) to possibly
 infinite trees in which subnodes are organized either as a lazy list (\<open>tree\<^sub>i\<^sub>i\<close>) or as a finite set (\<open>tree\<^sub>i\<^sub>s\<close>). They rely on the map functions of
 the nesting type constructors to lift the corecursive calls:
 \<close>
 
     primcorec iterate\<^sub>i\<^sub>i :: "('a \<Rightarrow> 'a llist) \<Rightarrow> 'a \<Rightarrow> 'a tree\<^sub>i\<^sub>i" where
       "iterate\<^sub>i\<^sub>i g x = Node\<^sub>i\<^sub>i x (lmap (iterate\<^sub>i\<^sub>i g) (g x))"
 
 text \<open>\blankline\<close>
 
     primcorec iterate\<^sub>i\<^sub>s :: "('a \<Rightarrow> 'a fset) \<Rightarrow> 'a \<Rightarrow> 'a tree\<^sub>i\<^sub>s" where
       "iterate\<^sub>i\<^sub>s g x = Node\<^sub>i\<^sub>s x (fimage (iterate\<^sub>i\<^sub>s g) (g x))"
 
 text \<open>
 \noindent
 Both examples follow the usual format for constructor arguments associated
 with nested recursive occurrences of the datatype. Consider
 \<^const>\<open>iterate\<^sub>i\<^sub>i\<close>. The term \<^term>\<open>g x\<close> constructs an \<^typ>\<open>'a llist\<close>
 value, which is turned into an \<^typ>\<open>'a tree\<^sub>i\<^sub>i llist\<close> value using
 \<^const>\<open>lmap\<close>.
 
 This format may sometimes feel artificial. The following function constructs
 a tree with a single, infinite branch from a stream:
 \<close>
 
     primcorec tree\<^sub>i\<^sub>i_of_stream :: "'a stream \<Rightarrow> 'a tree\<^sub>i\<^sub>i" where
       "tree\<^sub>i\<^sub>i_of_stream s =
          Node\<^sub>i\<^sub>i (shd s) (lmap tree\<^sub>i\<^sub>i_of_stream (LCons (stl s) LNil))"
 
 text \<open>
 \noindent
 A more natural syntax, also supported by Isabelle, is to move corecursive calls
 under constructors:
 \<close>
 
     primcorec (*<*)(in late) (*>*)tree\<^sub>i\<^sub>i_of_stream :: "'a stream \<Rightarrow> 'a tree\<^sub>i\<^sub>i" where
       "tree\<^sub>i\<^sub>i_of_stream s =
          Node\<^sub>i\<^sub>i (shd s) (LCons (tree\<^sub>i\<^sub>i_of_stream (stl s)) LNil)"
 
 text \<open>
 The next example illustrates corecursion through functions, which is a bit
 special. Deterministic finite automata (DFAs) are traditionally defined as
 5-tuples \<open>(Q, \<Sigma>, \<delta>, q\<^sub>0, F)\<close>, where \<open>Q\<close> is a finite set of states,
 \<open>\<Sigma>\<close> is a finite alphabet, \<open>\<delta>\<close> is a transition function, \<open>q\<^sub>0\<close>
 is an initial state, and \<open>F\<close> is a set of final states. The following
 function translates a DFA into a state machine:
 \<close>
 
     primcorec (*<*)(in early) (*>*)sm_of_dfa :: "('q \<Rightarrow> 'a \<Rightarrow> 'q) \<Rightarrow> 'q set \<Rightarrow> 'q \<Rightarrow> 'a sm" where
       "sm_of_dfa \<delta> F q = SM (q \<in> F) (sm_of_dfa \<delta> F \<circ> \<delta> q)"
 
 text \<open>
 \noindent
 The map function for the function type (\<open>\<Rightarrow>\<close>) is composition
 (\<open>(\<circ>)\<close>). For convenience, corecursion through functions can
 also be expressed using $\lambda$-abstractions and function application rather
 than through composition. For example:
 \<close>
 
     primcorec sm_of_dfa :: "('q \<Rightarrow> 'a \<Rightarrow> 'q) \<Rightarrow> 'q set \<Rightarrow> 'q \<Rightarrow> 'a sm" where
       "sm_of_dfa \<delta> F q = SM (q \<in> F) (\<lambda>a. sm_of_dfa \<delta> F (\<delta> q a))"
 
 text \<open>\blankline\<close>
 
     primcorec empty_sm :: "'a sm" where
       "empty_sm = SM False (\<lambda>_. empty_sm)"
 
 text \<open>\blankline\<close>
 
     primcorec not_sm :: "'a sm \<Rightarrow> 'a sm" where
       "not_sm M = SM (\<not> accept M) (\<lambda>a. not_sm (trans M a))"
 
 text \<open>\blankline\<close>
 
     primcorec or_sm :: "'a sm \<Rightarrow> 'a sm \<Rightarrow> 'a sm" where
       "or_sm M N =
          SM (accept M \<or> accept N) (\<lambda>a. or_sm (trans M a) (trans N a))"
 
 text \<open>
 \noindent
 For recursion through curried $n$-ary functions, $n$ applications of
 \<^term>\<open>(\<circ>)\<close> are necessary. The examples below illustrate the case where
 $n = 2$:
 \<close>
 
     codatatype ('a, 'b) sm2 =
       SM2 (accept2: bool) (trans2: "'a \<Rightarrow> 'b \<Rightarrow> ('a, 'b) sm2")
 
 text \<open>\blankline\<close>
 
     primcorec
       (*<*)(in early) (*>*)sm2_of_dfa :: "('q \<Rightarrow> 'a \<Rightarrow> 'b \<Rightarrow> 'q) \<Rightarrow> 'q set \<Rightarrow> 'q \<Rightarrow> ('a, 'b) sm2"
     where
       "sm2_of_dfa \<delta> F q = SM2 (q \<in> F) ((\<circ>) ((\<circ>) (sm2_of_dfa \<delta> F)) (\<delta> q))"
 
 text \<open>\blankline\<close>
 
     primcorec
       sm2_of_dfa :: "('q \<Rightarrow> 'a \<Rightarrow> 'b \<Rightarrow> 'q) \<Rightarrow> 'q set \<Rightarrow> 'q \<Rightarrow> ('a, 'b) sm2"
     where
       "sm2_of_dfa \<delta> F q = SM2 (q \<in> F) (\<lambda>a b. sm2_of_dfa \<delta> F (\<delta> q a b))"
 
 
 subsubsection \<open>Nested-as-Mutual Corecursion
   \label{sssec:primcorec-nested-as-mutual-corecursion}\<close>
 
 text \<open>
 Just as it is possible to recurse over nested recursive datatypes as if they
 were mutually recursive
 (Section~\ref{sssec:primrec-nested-as-mutual-recursion}), it is possible to
 pretend that nested codatatypes are mutually corecursive. For example:
 \<close>
 
 (*<*)
     context late
     begin
 (*>*)
     primcorec
       iterate\<^sub>i\<^sub>i :: "('a \<Rightarrow> 'a llist) \<Rightarrow> 'a \<Rightarrow> 'a tree\<^sub>i\<^sub>i" and
       iterates\<^sub>i\<^sub>i :: "('a \<Rightarrow> 'a llist) \<Rightarrow> 'a llist \<Rightarrow> 'a tree\<^sub>i\<^sub>i llist"
     where
       "iterate\<^sub>i\<^sub>i g x = Node\<^sub>i\<^sub>i x (iterates\<^sub>i\<^sub>i g (g x))"
     | "iterates\<^sub>i\<^sub>i g xs =
          (case xs of
             LNil \<Rightarrow> LNil
           | LCons x xs' \<Rightarrow> LCons (iterate\<^sub>i\<^sub>i g x) (iterates\<^sub>i\<^sub>i g xs'))"
 
 text \<open>
 \noindent
 Coinduction rules are generated as
 @{thm [source] iterate\<^sub>i\<^sub>i.coinduct},
 @{thm [source] iterates\<^sub>i\<^sub>i.coinduct}, and
 @{thm [source] iterate\<^sub>i\<^sub>i_iterates\<^sub>i\<^sub>i.coinduct}
 and analogously for \<open>coinduct_strong\<close>. These rules and the
 underlying corecursors are generated dynamically and are kept in a cache
 to speed up subsequent definitions.
 \<close>
 
 (*<*)
     end
 (*>*)
 
 
 subsubsection \<open>Constructor View
   \label{ssec:primrec-constructor-view}\<close>
 
 (*<*)
     locale ctr_view
     begin
 (*>*)
 
 text \<open>
 The constructor view is similar to the code view, but there is one separate
 conditional equation per constructor rather than a single unconditional
 equation. Examples that rely on a single constructor, such as \<^const>\<open>literate\<close>
 and \<^const>\<open>siterate\<close>, are identical in both styles.
 
 Here is an example where there is a difference:
 \<close>
 
     primcorec lapp :: "'a llist \<Rightarrow> 'a llist \<Rightarrow> 'a llist" where
       "lnull xs \<Longrightarrow> lnull ys \<Longrightarrow> lapp xs ys = LNil"
     | "_ \<Longrightarrow> lapp xs ys = LCons (lhd (if lnull xs then ys else xs))
          (if xs = LNil then ltl ys else lapp (ltl xs) ys)"
 
 text \<open>
 \noindent
 With the constructor view, we must distinguish between the \<^const>\<open>LNil\<close> and
 the \<^const>\<open>LCons\<close> case. The condition for \<^const>\<open>LCons\<close> is
 left implicit, as the negation of that for \<^const>\<open>LNil\<close>.
 
 For this example, the constructor view is slightly more involved than the
 code equation. Recall the code view version presented in
 Section~\ref{sssec:primcorec-simple-corecursion}.
 % TODO: \[{thm code_view.lapp.code}\]
 The constructor view requires us to analyze the second argument (\<^term>\<open>ys\<close>).
 The code equation generated from the constructor view also suffers from this.
 % TODO: \[{thm lapp.code}\]
 
 In contrast, the next example is arguably more naturally expressed in the
 constructor view:
 \<close>
 
     primcorec
       random_process :: "'a stream \<Rightarrow> (int \<Rightarrow> int) \<Rightarrow> int \<Rightarrow> 'a process"
     where
       "n mod 4 = 0 \<Longrightarrow> random_process s f n = Fail"
     | "n mod 4 = 1 \<Longrightarrow>
          random_process s f n = Skip (random_process s f (f n))"
     | "n mod 4 = 2 \<Longrightarrow>
          random_process s f n = Action (shd s) (random_process (stl s) f (f n))"
     | "n mod 4 = 3 \<Longrightarrow>
          random_process s f n = Choice (random_process (every_snd s) f (f n))
            (random_process (every_snd (stl s)) f (f n))"
 (*<*)
     end
 (*>*)
 
 text \<open>
 \noindent
 Since there is no sequentiality, we can apply the equation for \<^const>\<open>Choice\<close>
 without having first to discharge \<^term>\<open>n mod (4::int) \<noteq> 0\<close>,
 \<^term>\<open>n mod (4::int) \<noteq> 1\<close>, and
 \<^term>\<open>n mod (4::int) \<noteq> 2\<close>.
 The price to pay for this elegance is that we must discharge exclusiveness proof
 obligations, one for each pair of conditions
 \<^term>\<open>(n mod (4::int) = i, n mod (4::int) = j)\<close>
 with \<^term>\<open>i < j\<close>. If we prefer not to discharge any obligations, we can
 enable the \<open>sequential\<close> option. This pushes the problem to the users of
 the generated properties.
 %Here are more examples to conclude:
 \<close>
 
 
 subsubsection \<open>Destructor View
   \label{ssec:primrec-destructor-view}\<close>
 
 (*<*)
     locale dtr_view
     begin
 (*>*)
 
 text \<open>
 The destructor view is in many respects dual to the constructor view. Conditions
 determine which constructor to choose, and these conditions are interpreted
 sequentially or not depending on the \<open>sequential\<close> option.
 Consider the following examples:
 \<close>
 
     primcorec literate :: "('a \<Rightarrow> 'a) \<Rightarrow> 'a \<Rightarrow> 'a llist" where
       "\<not> lnull (literate _ x)"
     | "lhd (literate _ x) = x"
     | "ltl (literate g x) = literate g (g x)"
 
 text \<open>\blankline\<close>
 
     primcorec siterate :: "('a \<Rightarrow> 'a) \<Rightarrow> 'a \<Rightarrow> 'a stream" where
       "shd (siterate _ x) = x"
     | "stl (siterate g x) = siterate g (g x)"
 
 text \<open>\blankline\<close>
 
     primcorec every_snd :: "'a stream \<Rightarrow> 'a stream" where
       "shd (every_snd s) = shd s"
     | "stl (every_snd s) = stl (stl s)"
 
 text \<open>
 \noindent
 The first formula in the \<^const>\<open>literate\<close> specification indicates which
 constructor to choose. For \<^const>\<open>siterate\<close> and \<^const>\<open>every_snd\<close>, no such
 formula is necessary, since the type has only one constructor. The last two
 formulas are equations specifying the value of the result for the relevant
 selectors. Corecursive calls appear directly to the right of the equal sign.
 Their arguments are unrestricted.
 
 The next example shows how to specify functions that rely on more than one
 constructor:
 \<close>
 
     primcorec lapp :: "'a llist \<Rightarrow> 'a llist \<Rightarrow> 'a llist" where
       "lnull xs \<Longrightarrow> lnull ys \<Longrightarrow> lnull (lapp xs ys)"
     | "lhd (lapp xs ys) = lhd (if lnull xs then ys else xs)"
     | "ltl (lapp xs ys) = (if xs = LNil then ltl ys else lapp (ltl xs) ys)"
 
 text \<open>
 \noindent
 For a codatatype with $n$ constructors, it is sufficient to specify $n - 1$
 discriminator formulas. The command will then assume that the remaining
 constructor should be taken otherwise. This can be made explicit by adding
 \<close>
 
 (*<*)
     end
 
     locale dtr_view2
     begin
 
     primcorec lapp :: "'a llist \<Rightarrow> 'a llist \<Rightarrow> 'a llist" where
       "lnull xs \<Longrightarrow> lnull ys \<Longrightarrow> lnull (lapp xs ys)"
     | "lhd (lapp xs ys) = lhd (if lnull xs then ys else xs)"
     | "ltl (lapp xs ys) = (if xs = LNil then ltl ys else lapp (ltl xs) ys)" |
 (*>*)
       "_ \<Longrightarrow> \<not> lnull (lapp xs ys)"
 
 text \<open>
 \noindent
 to the specification. The generated selector theorems are conditional.
 
 The next example illustrates how to cope with selectors defined for several
 constructors:
 \<close>
 
     primcorec
       random_process :: "'a stream \<Rightarrow> (int \<Rightarrow> int) \<Rightarrow> int \<Rightarrow> 'a process"
     where
       "n mod 4 = 0 \<Longrightarrow> random_process s f n = Fail"
     | "n mod 4 = 1 \<Longrightarrow> is_Skip (random_process s f n)"
     | "n mod 4 = 2 \<Longrightarrow> is_Action (random_process s f n)"
     | "n mod 4 = 3 \<Longrightarrow> is_Choice (random_process s f n)"
     | "cont (random_process s f n) = random_process s f (f n)" of Skip
     | "prefix (random_process s f n) = shd s"
     | "cont (random_process s f n) = random_process (stl s) f (f n)" of Action
     | "left (random_process s f n) = random_process (every_snd s) f (f n)"
     | "right (random_process s f n) = random_process (every_snd (stl s)) f (f n)"
 
 text \<open>
 \noindent
 Using the \<open>of\<close> keyword, different equations are specified for \<^const>\<open>cont\<close> depending on which constructor is selected.
 
 Here are more examples to conclude:
 \<close>
 
     primcorec
       even_infty :: even_enat and
       odd_infty :: odd_enat
     where
       "even_infty \<noteq> Even_EZero"
     | "un_Even_ESucc even_infty = odd_infty"
     | "un_Odd_ESucc odd_infty = even_infty"
 
 text \<open>\blankline\<close>
 
     primcorec iterate\<^sub>i\<^sub>i :: "('a \<Rightarrow> 'a llist) \<Rightarrow> 'a \<Rightarrow> 'a tree\<^sub>i\<^sub>i" where
       "lbl\<^sub>i\<^sub>i (iterate\<^sub>i\<^sub>i g x) = x"
     | "sub\<^sub>i\<^sub>i (iterate\<^sub>i\<^sub>i g x) = lmap (iterate\<^sub>i\<^sub>i g) (g x)"
 (*<*)
     end
 (*>*)
 
 
 subsection \<open>Command Syntax
   \label{ssec:primcorec-command-syntax}\<close>
 
 subsubsection \<open>\keyw{primcorec} and \keyw{primcorecursive}
   \label{sssec:primcorecursive-and-primcorec}\<close>
 
 text \<open>
 \begin{matharray}{rcl}
   @{command_def "primcorec"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
   @{command_def "primcorecursive"} & : & \<open>local_theory \<rightarrow> proof(prove)\<close>
 \end{matharray}
 
 \<^rail>\<open>
   (@@{command primcorec} | @@{command primcorecursive}) target? \<newline>
     @{syntax pcr_options}? fixes @'where' (@{syntax pcr_formula} + '|')
   ;
   @{syntax_def pcr_options}: '(' ((@{syntax plugins} | 'sequential' | 'exhaustive' | 'transfer') + ',') ')'
   ;
   @{syntax_def pcr_formula}: thmdecl? prop (@'of' (term * ))?
 \<close>
 
 \medskip
 
 \noindent
 The @{command primcorec} and @{command primcorecursive} commands introduce a set
 of mutually corecursive functions over codatatypes.
 
 The syntactic entity \synt{target} can be used to specify a local context,
 \synt{fixes} denotes a list of names with optional type signatures,
 \synt{thmdecl} denotes an optional name for the formula that follows, and
-\synt{prop} denotes a HOL proposition @{cite "isabelle-isar-ref"}.
+\synt{prop} denotes a HOL proposition \<^cite>\<open>"isabelle-isar-ref"\<close>.
 
 The optional target is optionally followed by a combination of the following
 options:
 
 \begin{itemize}
 \setlength{\itemsep}{0pt}
 
 \item
 The \<open>plugins\<close> option indicates which plugins should be enabled
 (\<open>only\<close>) or disabled (\<open>del\<close>). By default, all plugins are enabled.
 
 \item
 The \<open>sequential\<close> option indicates that the conditions in specifications
 expressed using the constructor or destructor view are to be interpreted
 sequentially.
 
 \item
 The \<open>exhaustive\<close> option indicates that the conditions in specifications
 expressed using the constructor or destructor view cover all possible cases.
 This generally gives rise to an additional proof obligation.
 
 \item
 The \<open>transfer\<close> option indicates that an unconditional transfer rule
 should be generated and proved \<open>by transfer_prover\<close>. The
 \<open>[transfer_rule]\<close> attribute is set on the generated theorem.
 \end{itemize}
 
 The @{command primcorec} command is an abbreviation for @{command
 primcorecursive} with \<open>by auto?\<close> to discharge any emerging proof
 obligations.
 
 %%% TODO: elaborate on format of the propositions
 %%% TODO: elaborate on mutual and nested-to-mutual
 \<close>
 
 
 subsection \<open>Generated Theorems
   \label{ssec:primcorec-generated-theorems}\<close>
 
 text \<open>
 The @{command primcorec} and @{command primcorecursive} commands generate the
 following properties (listed for \<^const>\<open>literate\<close>):
 
 \begin{indentblock}
 \begin{description}
 
 \item[\<open>f.\<close>\hthm{code} \<open>[code]\<close>\rm:] ~ \\
 @{thm literate.code[no_vars]} \\
 The \<open>[code]\<close> attribute is set by the \<open>code\<close> plugin
 (Section~\ref{ssec:code-generator}).
 
 \item[\<open>f.\<close>\hthm{ctr}\rm:] ~ \\
 @{thm literate.ctr[no_vars]}
 
 \item[\<open>f.\<close>\hthm{disc} \<open>[simp, code]\<close>\rm:] ~ \\
 @{thm literate.disc[no_vars]} \\
 The \<open>[code]\<close> attribute is set by the \<open>code\<close> plugin
 (Section~\ref{ssec:code-generator}). The \<open>[simp]\<close> attribute is set only
 for functions for which \<open>f.disc_iff\<close> is not available.
 
 \item[\<open>f.\<close>\hthm{disc_iff} \<open>[simp]\<close>\rm:] ~ \\
 @{thm literate.disc_iff[no_vars]} \\
 This property is generated only for functions declared with the
 \<open>exhaustive\<close> option or whose conditions are trivially exhaustive.
 
 \item[\<open>f.\<close>\hthm{sel} \<open>[simp, code]\<close>\rm:] ~ \\
 @{thm literate.disc[no_vars]} \\
 The \<open>[code]\<close> attribute is set by the \<open>code\<close> plugin
 (Section~\ref{ssec:code-generator}).
 
 \item[\<open>f.\<close>\hthm{exclude}\rm:] ~ \\
 These properties are missing for \<^const>\<open>literate\<close> because no exclusiveness
 proof obligations arose. In general, the properties correspond to the
 discharged proof obligations.
 
 \item[\<open>f.\<close>\hthm{exhaust}\rm:] ~ \\
 This property is missing for \<^const>\<open>literate\<close> because no exhaustiveness
 proof obligation arose. In general, the property correspond to the discharged
 proof obligation.
 
 \item[\begin{tabular}{@ {}l@ {}}
   \<open>f.\<close>\hthm{coinduct} \<open>[consumes m, case_names t\<^sub>1 \<dots> t\<^sub>m,\<close> \\
   \phantom{\<open>f.\<close>\hthm{coinduct} \<open>[\<close>}\<open>case_conclusion D\<^sub>1 \<dots>
   D\<^sub>n]\<close>\rm:
 \end{tabular}] ~ \\
 This coinduction rule is generated for nested-as-mutual corecursive functions
 (Section~\ref{sssec:primcorec-nested-as-mutual-corecursion}).
 
 \item[\begin{tabular}{@ {}l@ {}}
   \<open>f.\<close>\hthm{coinduct_strong} \<open>[consumes m, case_names t\<^sub>1 \<dots> t\<^sub>m,\<close> \\
   \phantom{\<open>f.\<close>\hthm{coinduct_strong} \<open>[\<close>}\<open>case_conclusion D\<^sub>1 \<dots>
   D\<^sub>n]\<close>\rm:
 \end{tabular}] ~ \\
 This coinduction rule is generated for nested-as-mutual corecursive functions
 (Section~\ref{sssec:primcorec-nested-as-mutual-corecursion}).
 
 \item[\begin{tabular}{@ {}l@ {}}
   \<open>f\<^sub>1_\<dots>_f\<^sub>m.\<close>\hthm{coinduct} \<open>[case_names t\<^sub>1 \<dots> t\<^sub>m,\<close> \\
   \phantom{\<open>f.\<close>\hthm{coinduct} \<open>[\<close>}\<open>case_conclusion D\<^sub>1 \<dots>
   D\<^sub>n]\<close>\rm:
 \end{tabular}] ~ \\
 This coinduction rule is generated for nested-as-mutual corecursive functions
 (Section~\ref{sssec:primcorec-nested-as-mutual-corecursion}). Given $m > 1$
 mutually corecursive functions, this rule can be used to prove $m$ properties
 simultaneously.
 
 \item[\begin{tabular}{@ {}l@ {}}
   \<open>f\<^sub>1_\<dots>_f\<^sub>m.\<close>\hthm{coinduct_strong} \<open>[case_names t\<^sub>1 \<dots> t\<^sub>m,\<close> \\
   \phantom{\<open>f.\<close>\hthm{coinduct_strong} \<open>[\<close>}\<open>case_conclusion D\<^sub>1 \<dots>
   D\<^sub>n]\<close>\rm:
 \end{tabular}] ~ \\
 This coinduction rule is generated for nested-as-mutual corecursive functions
 (Section~\ref{sssec:primcorec-nested-as-mutual-corecursion}). Given $m > 1$
 mutually corecursive functions, this rule can be used to prove $m$ properties
 simultaneously.
 
 \end{description}
 \end{indentblock}
 
 \noindent
 For convenience, @{command primcorec} and @{command primcorecursive} also
 provide the following collection:
 
 \begin{indentblock}
 \begin{description}
 
 \item[\<open>f.\<close>\hthm{simps}] = \<open>f.disc_iff\<close> (or \<open>f.disc\<close>) \<open>t.sel\<close>
 
 \end{description}
 \end{indentblock}
 \<close>
 
 
 (*
 subsection \<open>Recursive Default Values for Selectors
   \label{ssec:primcorec-recursive-default-values-for-selectors}\<close>
 
 text \<open>
 partial_function to the rescue
 \<close>
 *)
 
 
 section \<open>Registering Bounded Natural Functors
   \label{sec:registering-bounded-natural-functors}\<close>
 
 text \<open>
 The (co)datatype package can be set up to allow nested recursion through
 arbitrary type constructors, as long as they adhere to the BNF requirements
 and are registered as BNFs. It is also possible to declare a BNF abstractly
 without specifying its internal structure.
 \<close>
 
 
 subsection \<open>Bounded Natural Functors
   \label{ssec:bounded-natural-functors}\<close>
 
 text \<open>
 Bounded natural functors (BNFs) are a semantic criterion for where
 (co)re\-cur\-sion may appear on the right-hand side of an equation
-@{cite "traytel-et-al-2012" and "blanchette-et-al-2015-wit"}.
+\<^cite>\<open>"traytel-et-al-2012" and "blanchette-et-al-2015-wit"\<close>.
 
 An $n$-ary BNF is a type constructor equipped with a map function
 (functorial action), $n$ set functions (natural transformations),
 and an infinite cardinal bound that satisfy certain properties.
 For example, \<^typ>\<open>'a llist\<close> is a unary BNF.
 Its predicator \<open>llist_all ::
   ('a \<Rightarrow> bool) \<Rightarrow>
   'a llist \<Rightarrow> bool\<close>
 extends unary predicates over elements to unary predicates over
 lazy lists.
 Similarly, its relator \<open>llist_all2 ::
   ('a \<Rightarrow> 'b \<Rightarrow> bool) \<Rightarrow>
   'a llist \<Rightarrow> 'b llist \<Rightarrow> bool\<close>
 extends binary predicates over elements to binary predicates over parallel
 lazy lists. The cardinal bound limits the number of elements returned by the
 set function; it may not depend on the cardinality of \<^typ>\<open>'a\<close>.
 
 The type constructors introduced by @{command datatype} and
 @{command codatatype} are automatically registered as BNFs. In addition, a
 number of old-style datatypes and non-free types are preregistered.
 
 Given an $n$-ary BNF, the $n$ type variables associated with set functions,
 and on which the map function acts, are \emph{live}; any other variables are
 \emph{dead}. Nested (co)recursion can only take place through live variables.
 \<close>
 
 
 subsection \<open>Introductory Examples
   \label{ssec:bnf-introductory-examples}\<close>
 
 text \<open>
 The example below shows how to register a type as a BNF using the @{command bnf}
 command. Some of the proof obligations are best viewed with the bundle
 "cardinal_syntax" included.
 
 The type is simply a copy of the function space \<^typ>\<open>'d \<Rightarrow> 'a\<close>, where \<^typ>\<open>'a\<close>
 is live and \<^typ>\<open>'d\<close> is dead. We introduce it together with its map function,
 set function, predicator, and relator.
 \<close>
 
     typedef ('d, 'a) fn = "UNIV :: ('d \<Rightarrow> 'a) set"
       by simp
 
 text \<open>\blankline\<close>
 
     setup_lifting type_definition_fn
 
 text \<open>\blankline\<close>
 
     lift_definition map_fn :: "('a \<Rightarrow> 'b) \<Rightarrow> ('d, 'a) fn \<Rightarrow> ('d, 'b) fn" is "(\<circ>)" .
     lift_definition set_fn :: "('d, 'a) fn \<Rightarrow> 'a set" is range .
 
 text \<open>\blankline\<close>
 
     lift_definition
       pred_fn :: "('a \<Rightarrow> bool) \<Rightarrow> ('d, 'a) fn \<Rightarrow> bool"
     is
       "pred_fun (\<lambda>_. True)" .
 
     lift_definition
       rel_fn :: "('a \<Rightarrow> 'b \<Rightarrow> bool) \<Rightarrow> ('d, 'a) fn \<Rightarrow> ('d, 'b) fn \<Rightarrow> bool"
     is
       "rel_fun (=)" .
 
 text \<open>\blankline\<close>
 
     bnf "('d, 'a) fn"
       map: map_fn
       sets: set_fn
       bd: "natLeq +c card_suc |UNIV :: 'd set|"
       rel: rel_fn
       pred: pred_fn
     proof -
       show "map_fn id = id"
         by transfer auto
     next
       fix f :: "'a \<Rightarrow> 'b" and g :: "'b \<Rightarrow> 'c"
       show "map_fn (g \<circ> f) = map_fn g \<circ> map_fn f"
         by transfer (auto simp add: comp_def)
     next
       fix F :: "('d, 'a) fn" and f g :: "'a \<Rightarrow> 'b"
       assume "\<And>x. x \<in> set_fn F \<Longrightarrow> f x = g x"
       then show "map_fn f F = map_fn g F"
         by transfer auto
     next
       fix f :: "'a \<Rightarrow> 'b"
       show "set_fn \<circ> map_fn f = (`) f \<circ> set_fn"
         by transfer (auto simp add: comp_def)
     next
       show "card_order (natLeq +c card_suc |UNIV :: 'd set| )"
         by (rule card_order_bd_fun)
     next
       show "cinfinite (natLeq +c card_suc |UNIV :: 'd set| )"
         by (rule Cinfinite_bd_fun[THEN conjunct1])
     next
       show "regularCard (natLeq +c card_suc |UNIV :: 'd set| )"
         by (rule regularCard_bd_fun)
     next
       fix F :: "('d, 'a) fn"
       have "|set_fn F| \<le>o |UNIV :: 'd set|" (is "_ \<le>o ?U")
         by transfer (rule card_of_image)
       also have "?U <o card_suc ?U"
         by (simp add: card_of_card_order_on card_suc_greater)
       also have "card_suc ?U \<le>o natLeq +c card_suc ?U"
         using Card_order_card_suc card_of_card_order_on ordLeq_csum2 by blast
       finally show "|set_fn F| <o natLeq +c card_suc |UNIV :: 'd set|" .
     next
       fix R :: "'a \<Rightarrow> 'b \<Rightarrow> bool" and S :: "'b \<Rightarrow> 'c \<Rightarrow> bool"
       show "rel_fn R OO rel_fn S \<le> rel_fn (R OO S)"
         by (rule, transfer) (auto simp add: rel_fun_def)
     next
       fix R :: "'a \<Rightarrow> 'b \<Rightarrow> bool"
       show "rel_fn R = (\<lambda>x y. \<exists>z. set_fn z \<subseteq> {(x, y). R x y} \<and> map_fn fst z = x \<and> map_fn snd z = y)"
         unfolding fun_eq_iff relcompp.simps conversep.simps
         by transfer (force simp: rel_fun_def subset_iff)
     next
       fix P :: "'a \<Rightarrow> bool"
       show "pred_fn P = (\<lambda>x. Ball (set_fn x) P)"
         unfolding fun_eq_iff by transfer simp
     qed
 
 text \<open>\blankline\<close>
 
     print_theorems
     print_bnfs
 
 text \<open>
 \noindent
 Using \keyw{print_theorems} and @{command print_bnfs}, we can contemplate and
 show the world what we have achieved.
 
 This particular example does not need any nonemptiness witness, because the
 one generated by default is good enough, but in general this would be
 necessary. See \<^file>\<open>~~/src/HOL/Basic_BNFs.thy\<close>,
 \<^file>\<open>~~/src/HOL/Library/Countable_Set_Type.thy\<close>,
 \<^file>\<open>~~/src/HOL/Library/FSet.thy\<close>, and
 \<^file>\<open>~~/src/HOL/Library/Multiset.thy\<close> for further examples of BNF
 registration, some of which feature custom witnesses.
 
 For many typedefs and quotient types, lifting the BNF structure from the raw typ
 to the abstract type can be done uniformly. This is the task of the @{command lift_bnf}
 command. Using @{command lift_bnf}, the above registration of \<^typ>\<open>('d, 'a) fn\<close> as a
 BNF becomes much shorter:
 \<close>
 
 (*<*)
     context early
     begin
 (*>*)
     lift_bnf (*<*)(no_warn_wits) (*>*)('d, 'a) fn
       by force+
 (*<*)
     end
 (*>*)
 
 text \<open>
 For type copies (@{command typedef}s with \<^term>\<open>UNIV\<close> as the representing set),
 the proof obligations are so simple that they can be
 discharged automatically, yielding another command, @{command copy_bnf}, which
 does not emit any proof obligations:
 \<close>
 
 (*<*)
     context late
     begin
 (*>*)
     copy_bnf ('d, 'a) fn
 (*<*)
     end
 (*>*)
 
 text \<open>
 Since record schemas are type copies, @{command copy_bnf} can be used to
 register them as BNFs:
 \<close>
 
     record 'a point =
       xval :: 'a
       yval :: 'a
 
 text \<open>\blankline\<close>
 
     copy_bnf (*<*)(no_warn_transfer) (*>*)('a, 'z) point_ext
 
 text \<open>
 In the general case, the proof obligations generated by @{command lift_bnf} are
 simpler than the acual BNF properties. In particular, no cardinality reasoning
 is required. Consider the following type of nonempty lists:
 \<close>
 
     typedef 'a nonempty_list = "{xs :: 'a list. xs \<noteq> []}" by auto
 
 text \<open>
 The @{command lift_bnf} command requires us to prove that the set of nonempty lists
 is closed under the map function and the zip function. The latter only
 occurs implicitly in the goal, in form of the variable
 \<^term>\<open>zs :: ('a \<times> 'b) list\<close>.
 \<close>
 
     lift_bnf (*<*)(no_warn_wits,no_warn_transfer) (*>*)'a nonempty_list
     proof -
       fix f (*<*):: "'a \<Rightarrow> 'c"(*>*)and xs :: "'a list"
       assume "xs \<in> {xs. xs \<noteq> []}"
       then show "map f xs \<in> {xs. xs \<noteq> []}"
         by (cases xs(*<*) rule: list.exhaust(*>*)) auto
     next
       fix zs :: "('a \<times> 'b) list"
       assume "map fst zs \<in> {xs. xs \<noteq> []}" "map snd zs \<in> {xs. xs \<noteq> []}"
       then show "\<exists>zs'\<in>{xs. xs \<noteq> []}.
             set zs' \<subseteq> set zs \<and>
             map fst zs' = map fst zs \<and>
             map snd zs' = map snd zs"
         by (cases zs (*<*)rule: list.exhaust(*>*)) (auto intro!: exI[of _ zs])
     qed
 
 text \<open>The @{command lift_bnf} command also supports quotient types. Here is an example
 that defines the option type as a quotient of the sum type. The proof obligations
 generated by @{command lift_bnf} for quotients are different from the ones for typedefs.
 You can find additional examples of usages of @{command lift_bnf} for both quotients and subtypes
 in the session \emph{HOL-Datatype_Examples}.\<close>
 
     inductive ignore_Inl :: "'a + 'a \<Rightarrow> 'a + 'a \<Rightarrow> bool" where
       "ignore_Inl (Inl x) (Inl y)"
     | "ignore_Inl (Inr x) (Inr x)"
 
     (*<*)
     inductive_simps ignore_Inl_simps[simp]:
       "ignore_Inl (Inl x) y"
       "ignore_Inl (Inr x') y"
       "ignore_Inl y (Inl x)"
       "ignore_Inl y (Inr x')"
     (*>*)
 
     lemma ignore_Inl_equivp:
       "ignore_Inl x x"
       "ignore_Inl x y \<Longrightarrow> ignore_Inl y x"
       "ignore_Inl x y \<Longrightarrow> ignore_Inl y z \<Longrightarrow> ignore_Inl x z"
       by (cases x; cases y; cases z; auto)+
 
     quotient_type 'a myoption = "'a + 'a" / ignore_Inl
       unfolding equivp_reflp_symp_transp reflp_def symp_def transp_def
       by (blast intro: ignore_Inl_equivp)
 
     lift_bnf 'a myoption (*<*)[wits: "Inl undefined :: 'a + 'a"](*>*)
 
     proof -
       fix P :: "'a \<Rightarrow> 'b \<Rightarrow> bool" and Q :: "'b \<Rightarrow> 'c \<Rightarrow> bool"
       assume "P OO Q \<noteq> bot"
       then show "rel_sum P P OO ignore_Inl OO rel_sum Q Q
          \<le> ignore_Inl OO rel_sum (P OO Q) (P OO Q) OO ignore_Inl"
         by (fastforce(*<*) elim!: ignore_Inl.cases simp add: relcompp_apply fun_eq_iff rel_sum.simps(*>*))
     next
       fix S :: "'a set set"
       let ?eq = "{(x, x'). ignore_Inl x x'}"
       let ?in = "\<lambda>A. {x. Basic_BNFs.setl x \<union> Basic_BNFs.setr x \<subseteq> A}"
       assume "S \<noteq> {}" "\<Inter> S \<noteq> {}"
       show "(\<Inter>A\<in>S. ?eq `` ?in A) \<subseteq> ?eq `` ?in (\<Inter> S)"
       proof (intro subsetI)
         fix x
         assume "x \<in> (\<Inter>A\<in>S. ?eq `` ?in A)"
         with \<open>\<Inter> S \<noteq> {}\<close> show "x \<in> ?eq `` ?in (\<Inter> S)"
           by (cases x) (fastforce(*<*) dest!: spec[where x="Inl _"](*>*))+
       qed
     (*<*)next
       fix a :: 'a
       assume "a \<in> (\<Inter>mx\<in>{mx. ignore_Inl (map_sum Inr Inr (Inl undefined)) mx}.
         \<Union> (Basic_BNFs.setr ` (Basic_BNFs.setl mx \<union> Basic_BNFs.setr mx)))"
       then show False
         by (auto simp: setr.simps)(*>*)
     qed
 
 
 text \<open>
 The next example declares a BNF axiomatically. This can be convenient for
 reasoning abstractly about an arbitrary BNF. The @{command bnf_axiomatization}
 command below introduces a type \<open>('a, 'b, 'c) F\<close>, three set constants,
 a map function, a predicator, a relator, and a nonemptiness witness that depends only on
 \<^typ>\<open>'a\<close>. The type \<open>'a \<Rightarrow> ('a, 'b, 'c) F\<close> of the witness can be read
 as an implication: Given a witness for \<^typ>\<open>'a\<close>, we can construct a witness for
 \<open>('a, 'b, 'c) F\<close>. The BNF properties are postulated as axioms.
 \<close>
 
     bnf_axiomatization (setA: 'a, setB: 'b, setC: 'c) F
       [wits: "'a \<Rightarrow> ('a, 'b, 'c) F"]
 
 text \<open>\blankline\<close>
 
     print_theorems
     print_bnfs
 
 
 subsection \<open>Command Syntax
   \label{ssec:bnf-command-syntax}\<close>
 
 subsubsection \<open>\keyw{bnf}
   \label{sssec:bnf}\<close>
 
 text \<open>
 \begin{matharray}{rcl}
   @{command_def "bnf"} & : & \<open>local_theory \<rightarrow> proof(prove)\<close>
 \end{matharray}
 
 \<^rail>\<open>
   @@{command bnf} target? (name ':')? type \<newline>
     'map:' term ('sets:' (term +))? 'bd:' term \<newline>
     ('wits:' (term +))? ('rel:' term)? \<newline>
     ('pred:' term)? @{syntax plugins}?
 \<close>
 
 \medskip
 
 \noindent
 The @{command bnf} command registers an existing type as a bounded natural
 functor (BNF). The type must be equipped with an appropriate map function
 (functorial action). In addition, custom set functions, predicators, relators, and
 nonemptiness witnesses can be specified; otherwise, default versions are used.
 
 The syntactic entity \synt{target} can be used to specify a local context,
 \synt{type} denotes a HOL type, and \synt{term} denotes a HOL term
-@{cite "isabelle-isar-ref"}.
+\<^cite>\<open>"isabelle-isar-ref"\<close>.
 
 The @{syntax plugins} option indicates which plugins should be enabled
 (\<open>only\<close>) or disabled (\<open>del\<close>). By default, all plugins are enabled.
 
 %%% TODO: elaborate on proof obligations
 \<close>
 
 subsubsection \<open>\keyw{lift_bnf}
   \label{sssec:lift-bnf}\<close>
 
 text \<open>
 \begin{matharray}{rcl}
   @{command_def "lift_bnf"} & : & \<open>local_theory \<rightarrow> proof(prove)\<close>
 \end{matharray}
 
 \<^rail>\<open>
   @@{command lift_bnf} target? lb_options? \<newline>
     @{syntax tyargs} name wit_terms?  \<newline>
     ('via' thm thm?)? @{syntax map_rel_pred}?
   ;
   @{syntax_def lb_options}: '(' ((@{syntax plugins} | 'no_warn_wits' | 'no_warn_transfer') + ',') ')'
   ;
   @{syntax_def wit_terms}: '[' 'wits' ':' terms ']'
 \<close>
 \medskip
 
 \noindent
 The @{command lift_bnf} command registers as a BNF an existing type (the
 \emph{abstract type}) that was defined as a subtype of a BNF (the \emph{raw
 type}) using the @{command typedef} command or as a quotient type of a BNF (also, the
 \emph{raw type}) using the @{command quotient_type}. To achieve this, it lifts the BNF
 structure on the raw type to the abstract type following a \<^term>\<open>type_definition\<close> or a
 \<^term>\<open>Quotient\<close> theorem. The theorem is usually inferred from the type, but can
 also be explicitly supplied by means of the optional \<open>via\<close> clause. In case of quotients, it
 is sometimes also necessary to supply a second theorem of the form \<^term>\<open>reflp eq\<close>,
 that expresses the reflexivity (and thus totality) of the equivalence relation. In
 addition, custom names for the set functions, the map function, the predicator, and the relator,
 as well as nonemptiness witnesses can be specified.
 
 Nonemptiness witnesses are not lifted from the raw type's BNF, as this would be
 incomplete. They must be given as terms (on the raw type) and proved to be
 witnesses. The command warns about witness types that are present in the raw
 type's BNF but not supplied by the user. The warning can be disabled by
 specifying the \<open>no_warn_wits\<close> option.
 \<close>
 
 subsubsection \<open>\keyw{copy_bnf}
   \label{sssec:copy-bnf}\<close>
 
 text \<open>
 \begin{matharray}{rcl}
   @{command_def "copy_bnf"} & : & \<open>local_theory \<rightarrow> local_theory\<close>
 \end{matharray}
 
 \<^rail>\<open>
   @@{command copy_bnf} target? cb_options? \<newline>
     @{syntax tyargs} name ('via' thm)? @{syntax map_rel_pred}?
   ;
   @{syntax_def cb_options}: '(' ((@{syntax plugins} | 'no_warn_transfer') + ',') ')'
 
 \<close>
 \medskip
 
 \noindent
 The @{command copy_bnf} command performs the same lifting as @{command lift_bnf}
 for type copies (@{command typedef}s with \<^term>\<open>UNIV\<close> as the representing set),
 without requiring the user to discharge any proof obligations or provide
 nonemptiness witnesses.
 \<close>
 
 subsubsection \<open>\keyw{bnf_axiomatization}
   \label{sssec:bnf-axiomatization}\<close>
 
 text \<open>
 \begin{matharray}{rcl}
   @{command_def "bnf_axiomatization"} & : & \<open>local_theory \<rightarrow> local_theory\<close>
 \end{matharray}
 
 \<^rail>\<open>
   @@{command bnf_axiomatization} target? ('(' @{syntax plugins} ')')? \<newline>
     @{syntax tyargs}? name @{syntax wit_types}? \<newline>
     mixfix? @{syntax map_rel_pred}?
   ;
   @{syntax_def wit_types}: '[' 'wits' ':' types ']'
 \<close>
 
 \medskip
 
 \noindent
 The @{command bnf_axiomatization} command declares a new type and associated constants
 (map, set, predicator, relator, and cardinal bound) and asserts the BNF properties for
 these constants as axioms.
 
 The syntactic entity \synt{target} can be used to specify a local context,
 \synt{name} denotes an identifier, \synt{typefree} denotes fixed type variable
 (\<^typ>\<open>'a\<close>, \<^typ>\<open>'b\<close>, \ldots), \synt{mixfix} denotes the usual parenthesized
 mixfix notation, and \synt{types} denotes a space-separated list of types
-@{cite "isabelle-isar-ref"}.
+\<^cite>\<open>"isabelle-isar-ref"\<close>.
 
 The @{syntax plugins} option indicates which plugins should be enabled
 (\<open>only\<close>) or disabled (\<open>del\<close>). By default, all plugins are enabled.
 
 Type arguments are live by default; they can be marked as dead by entering
 \<open>dead\<close> in front of the type variable (e.g., \<open>(dead 'a)\<close>)
 instead of an identifier for the corresponding set function. Witnesses can be
 specified by their types. Otherwise, the syntax of @{command bnf_axiomatization}
 is identical to the left-hand side of a @{command datatype} or
 @{command codatatype} definition.
 
 The command is useful to reason abstractly about BNFs. The axioms are safe
 because there exist BNFs of arbitrary large arities. Applications must import
 the \<^file>\<open>~~/src/HOL/Library/BNF_Axiomatization.thy\<close> theory
 to use this functionality.
 \<close>
 
 
 subsubsection \<open>\keyw{print_bnfs}
   \label{sssec:print-bnfs}\<close>
 
 text \<open>
 \begin{matharray}{rcl}
   @{command_def "print_bnfs"} & : & \<open>local_theory \<rightarrow>\<close>
 \end{matharray}
 
 \<^rail>\<open>
   @@{command print_bnfs}
 \<close>
 \<close>
 
 
 section \<open>Deriving Destructors and Constructor Theorems
   \label{sec:deriving-destructors-and-constructor-theorems}\<close>
 
 text \<open>
 The derivation of convenience theorems for types equipped with free constructors,
 as performed internally by @{command datatype} and @{command codatatype},
 is available as a stand-alone command called @{command free_constructors}.
 
 %  * need for this is rare but may arise if you want e.g. to add destructors to
 %    a type not introduced by ...
 %
 %  * @{command free_constructors}
 %    * \<open>plugins\<close>, \<open>discs_sels\<close>
 %    * hack to have both co and nonco view via locale (cf. ext nats)
 \<close>
 
 
 (*
 subsection \<open>Introductory Example
   \label{ssec:ctors-introductory-example}\<close>
 *)
 
 
 subsection \<open>Command Syntax
   \label{ssec:ctors-command-syntax}\<close>
 
 subsubsection \<open>\keyw{free_constructors}
   \label{sssec:free-constructors}\<close>
 
 text \<open>
 \begin{matharray}{rcl}
   @{command_def "free_constructors"} & : & \<open>local_theory \<rightarrow> proof(prove)\<close>
 \end{matharray}
 
 \<^rail>\<open>
   @@{command free_constructors} target? @{syntax dt_options} \<newline>
     name 'for' (@{syntax fc_ctor} + '|') \<newline>
   (@'where' (prop + '|'))?
   ;
   @{syntax_def fc_ctor}: (name ':')? term (name * )
 \<close>
 
 \medskip
 
 \noindent
 The @{command free_constructors} command generates destructor constants for
 freely constructed types as well as properties about constructors and
 destructors. It also registers the constants and theorems in a data structure
 that is queried by various tools (e.g., \keyw{function}).
 
 The syntactic entity \synt{target} can be used to specify a local context,
 \synt{name} denotes an identifier, \synt{prop} denotes a HOL proposition, and
-\synt{term} denotes a HOL term @{cite "isabelle-isar-ref"}.
+\synt{term} denotes a HOL term \<^cite>\<open>"isabelle-isar-ref"\<close>.
 
 The syntax resembles that of @{command datatype} and @{command codatatype}
 definitions (Sections
 \ref{ssec:datatype-command-syntax}~and~\ref{ssec:codatatype-command-syntax}).
 A constructor is specified by an optional name for the discriminator, the
 constructor itself (as a term), and a list of optional names for the selectors.
 
 Section~\ref{ssec:datatype-generated-theorems} lists the generated theorems.
 For bootstrapping reasons, the generally useful \<open>[fundef_cong]\<close>
 attribute is not set on the generated \<open>case_cong\<close> theorem. It can be
 added manually using \keyw{declare}.
 \<close>
 
 
 subsubsection \<open>\keyw{simps_of_case}
   \label{sssec:simps-of-case}\<close>
 
 text \<open>
 \begin{matharray}{rcl}
   @{command_def "simps_of_case"} & : & \<open>local_theory \<rightarrow> local_theory\<close>
 \end{matharray}
 
 \<^rail>\<open>
   @@{command simps_of_case} target? (name ':')? \<newline>
     (thm + ) (@'splits' ':' (thm + ))?
 \<close>
 
 \medskip
 
 \noindent
 The @{command simps_of_case} command provided by theory
 \<^file>\<open>~~/src/HOL/Library/Simps_Case_Conv.thy\<close> converts a single equation with
 a complex case expression on the right-hand side into a set of pattern-matching
 equations. For example,
 \<close>
 
 (*<*)
     context late
     begin
 (*>*)
     simps_of_case lapp_simps: lapp.code
 
 text \<open>
 \noindent
 translates @{thm lapp.code[no_vars]} into
 %
 \begin{gather*}
   @{thm lapp_simps(1)[no_vars]} \\
   @{thm lapp_simps(2)[no_vars]}
 \end{gather*}
 \<close>
 
 
 subsubsection \<open>\keyw{case_of_simps}
   \label{sssec:case-of-simps}\<close>
 
 text \<open>
 \begin{matharray}{rcl}
   @{command_def "case_of_simps"} & : & \<open>local_theory \<rightarrow> local_theory\<close>
 \end{matharray}
 
 \<^rail>\<open>
   @@{command case_of_simps} target? (name ':')? \<newline>
     (thm + )
 \<close>
 
 \medskip
 
 \noindent
 The \keyw{case_of_simps} command provided by theory
 \<^file>\<open>~~/src/HOL/Library/Simps_Case_Conv.thy\<close> converts a set of
 pattern-matching equations into single equation with a complex case expression
 on the right-hand side (cf.\ @{command simps_of_case}). For example,
 \<close>
 
     case_of_simps lapp_case: lapp_simps
 
 text \<open>
 \noindent
 translates
 %
 \begin{gather*}
   @{thm lapp_simps(1)[no_vars]} \\
   @{thm lapp_simps(2)[no_vars]}
 \end{gather*}
 %
 into @{thm lapp_case[no_vars]}.
 \<close>
 (*<*)
     end
 (*>*)
 
 
 (*
 section \<open>Using the Standard ML Interface
   \label{sec:using-the-standard-ml-interface}\<close>
 
 text \<open>
 The package's programmatic interface.
 \<close>
 *)
 
 
 section \<open>Selecting Plugins
   \label{sec:selecting-plugins}\<close>
 
 text \<open>
 Plugins extend the (co)datatype package to interoperate with other Isabelle
 packages and tools, such as the code generator, Transfer, Lifting, and
 Quickcheck. They can be enabled or disabled individually using the
 @{syntax plugins} option to the commands @{command datatype},
 @{command primrec}, @{command codatatype}, @{command primcorec},
 @{command primcorecursive}, @{command bnf}, @{command bnf_axiomatization}, and
 @{command free_constructors}. For example:
 \<close>
 
     datatype (plugins del: code "quickcheck") color = Red | Black
 
 text \<open>
 Beyond the standard plugins, the \emph{Archive of Formal Proofs} includes a
 \keyw{derive} command that derives class instances of datatypes
-@{cite "sternagel-thiemann-2015"}.
+\<^cite>\<open>"sternagel-thiemann-2015"\<close>.
 \<close>
 
 subsection \<open>Code Generator
   \label{ssec:code-generator}\<close>
 
 text \<open>
 The \hthm{code} plugin registers freely generated types, including
 (co)datatypes, and (co)recursive functions for code generation. No distinction
 is made between datatypes and codatatypes. This means that for target languages
 with a strict evaluation strategy (e.g., Standard ML), programs that attempt to
 produce infinite codatatype values will not terminate.
 
 For types, the plugin derives the following properties:
 
 \begin{indentblock}
 \begin{description}
 
 \item[\<open>t.\<close>\hthm{eq.refl} \<open>[code nbe]\<close>\rm:] ~ \\
 @{thm list.eq.refl[no_vars]}
 
 \item[\<open>t.\<close>\hthm{eq.simps} \<open>[code]\<close>\rm:] ~ \\
 @{thm list.eq.simps(1)[no_vars]} \\
 @{thm list.eq.simps(2)[no_vars]} \\
 @{thm list.eq.simps(3)[no_vars]} \\
 @{thm list.eq.simps(4)[no_vars]} \\
 @{thm list.eq.simps(5)[no_vars]} \\
 @{thm list.eq.simps(6)[no_vars]}
 
 \end{description}
 \end{indentblock}
 
 In addition, the plugin sets the \<open>[code]\<close> attribute on a number of
 properties of freely generated types and of (co)recursive functions, as
 documented in Sections \ref{ssec:datatype-generated-theorems},
 \ref{ssec:primrec-generated-theorems}, \ref{ssec:codatatype-generated-theorems},
 and~\ref{ssec:primcorec-generated-theorems}.
 \<close>
 
 
 subsection \<open>Size
   \label{ssec:size}\<close>
 
 text \<open>
 For each datatype \<open>t\<close>, the \hthm{size} plugin generates a generic size
 function \<open>t.size_t\<close> as well as a specific instance
 \<open>size :: t \<Rightarrow> nat\<close> belonging to the \<open>size\<close> type class. The
 \keyw{fun} command relies on \<^const>\<open>size\<close> to prove termination of recursive
 functions on datatypes.
 
 The plugin derives the following properties:
 
 \begin{indentblock}
 \begin{description}
 
 \item[\<open>t.\<close>\hthm{size} \<open>[simp, code]\<close>\rm:] ~ \\
 @{thm list.size(1)[no_vars]} \\
 @{thm list.size(2)[no_vars]} \\
 @{thm list.size(3)[no_vars]} \\
 @{thm list.size(4)[no_vars]}
 
 \item[\<open>t.\<close>\hthm{size_gen}\rm:] ~ \\
 @{thm list.size_gen(1)[no_vars]} \\
 @{thm list.size_gen(2)[no_vars]}
 
 \item[\<open>t.\<close>\hthm{size_gen_o_map}\rm:] ~ \\
 @{thm list.size_gen_o_map[no_vars]}
 
 \item[\<open>t.\<close>\hthm{size_neq}\rm:] ~ \\
 This property is missing for \<^typ>\<open>'a list\<close>. If the \<^term>\<open>size\<close> function
 always evaluates to a non-zero value, this theorem has the form
 \<^prop>\<open>\<not> size x = 0\<close>.
 
 \end{description}
 \end{indentblock}
 
 The \<open>t.size\<close> and \<open>t.size_t\<close> functions generated for datatypes
 defined by nested recursion through a datatype \<open>u\<close> depend on
 \<open>u.size_u\<close>.
 
 If the recursion is through a non-datatype \<open>u\<close> with type arguments
 \<open>'a\<^sub>1, \<dots>, 'a\<^sub>m\<close>, by default \<open>u\<close> values are given a size of 0. This
 can be improved upon by registering a custom size function of type
 \<open>('a\<^sub>1 \<Rightarrow> nat) \<Rightarrow> \<dots> \<Rightarrow> ('a\<^sub>m \<Rightarrow> nat) \<Rightarrow> u \<Rightarrow> nat\<close> using
 the ML function \<^ML>\<open>BNF_LFP_Size.register_size\<close> or
 \<^ML>\<open>BNF_LFP_Size.register_size_global\<close>. See theory
 \<^file>\<open>~~/src/HOL/Library/Multiset.thy\<close> for an example.
 \<close>
 
 
 subsection \<open>Transfer
   \label{ssec:transfer}\<close>
 
 text \<open>
 For each (co)datatype with live type arguments and each manually registered BNF,
 the \hthm{transfer} plugin generates a predicator \<open>t.pred_t\<close> and
 properties that guide the Transfer tool.
 
 For types with at least one live type argument and \emph{no dead type
 arguments}, the plugin derives the following properties:
 
 \begin{indentblock}
 \begin{description}
 
 \item[\<open>t.\<close>\hthm{Domainp_rel} \<open>[relator_domain]\<close>\rm:] ~ \\
 @{thm list.Domainp_rel[no_vars]}
 
 \item[\<open>t.\<close>\hthm{left_total_rel} \<open>[transfer_rule]\<close>\rm:] ~ \\
 @{thm list.left_total_rel[no_vars]}
 
 \item[\<open>t.\<close>\hthm{left_unique_rel} \<open>[transfer_rule]\<close>\rm:] ~ \\
 @{thm list.left_unique_rel[no_vars]}
 
 \item[\<open>t.\<close>\hthm{right_total_rel} \<open>[transfer_rule]\<close>\rm:] ~ \\
 @{thm list.right_total_rel[no_vars]}
 
 \item[\<open>t.\<close>\hthm{right_unique_rel} \<open>[transfer_rule]\<close>\rm:] ~ \\
 @{thm list.right_unique_rel[no_vars]}
 
 \item[\<open>t.\<close>\hthm{bi_total_rel} \<open>[transfer_rule]\<close>\rm:] ~ \\
 @{thm list.bi_total_rel[no_vars]}
 
 \item[\<open>t.\<close>\hthm{bi_unique_rel} \<open>[transfer_rule]\<close>\rm:] ~ \\
 @{thm list.bi_unique_rel[no_vars]}
 
 \end{description}
 \end{indentblock}
 
 For (co)datatypes with at least one live type argument, the plugin sets the
 \<open>[transfer_rule]\<close> attribute on the following (co)datatypes properties:
 \<open>t.case_\<close>\allowbreak \<open>transfer\<close>,
 \<open>t.sel_\<close>\allowbreak \<open>transfer\<close>,
 \<open>t.ctr_\<close>\allowbreak \<open>transfer\<close>,
 \<open>t.disc_\<close>\allowbreak \<open>transfer\<close>,
 \<open>t.rec_\<close>\allowbreak \<open>transfer\<close>, and
 \<open>t.corec_\<close>\allowbreak \<open>transfer\<close>.
 For (co)datatypes that further have \emph{no dead type arguments}, the plugin
 sets \<open>[transfer_rule]\<close> on
 \<open>t.set_\<close>\allowbreak \<open>transfer\<close>,
 \<open>t.map_\<close>\allowbreak \<open>transfer\<close>, and
 \<open>t.rel_\<close>\allowbreak \<open>transfer\<close>.
 
 For @{command primrec}, @{command primcorec}, and @{command primcorecursive},
 the plugin implements the generation of the \<open>f.transfer\<close> property,
 conditioned by the \<open>transfer\<close> option, and sets the
 \<open>[transfer_rule]\<close> attribute on these.
 \<close>
 
 
 subsection \<open>Lifting
   \label{ssec:lifting}\<close>
 
 text \<open>
 For each (co)datatype and each manually registered BNF with at least one live
 type argument \emph{and no dead type arguments}, the \hthm{lifting} plugin
 generates properties and attributes that guide the Lifting tool.
 
 The plugin derives the following property:
 
 \begin{indentblock}
 \begin{description}
 
 \item[\<open>t.\<close>\hthm{Quotient} \<open>[quot_map]\<close>\rm:] ~ \\
 @{thm list.Quotient[no_vars]}
 
 \end{description}
 \end{indentblock}
 
 In addition, the plugin sets the \<open>[relator_eq]\<close> attribute on a
 variant of the \<open>t.rel_eq_onp\<close> property, the \<open>[relator_mono]\<close>
 attribute on \<open>t.rel_mono\<close>, and the \<open>[relator_distr]\<close> attribute
 on \<open>t.rel_compp\<close>.
 \<close>
 
 
 subsection \<open>Quickcheck
   \label{ssec:quickcheck}\<close>
 
 text \<open>
 The integration of datatypes with Quickcheck is accomplished by the
 \hthm{quick\-check} plugin. It combines a number of subplugins that instantiate
 specific type classes. The subplugins can be enabled or disabled individually.
 They are listed below:
 
 \begin{indentblock}
 \hthm{quickcheck_random} \\
 \hthm{quickcheck_exhaustive} \\
 \hthm{quickcheck_bounded_forall} \\
 \hthm{quickcheck_full_exhaustive} \\
 \hthm{quickcheck_narrowing}
 \end{indentblock}
 \<close>
 
 
 subsection \<open>Program Extraction
   \label{ssec:program-extraction}\<close>
 
 text \<open>
 The \hthm{extraction} plugin provides realizers for induction and case analysis,
 to enable program extraction from proofs involving datatypes. This functionality
 is only available with full proof objects, i.e., with the \emph{HOL-Proofs}
 session.
 \<close>
 
 
 section \<open>Known Bugs and Limitations
   \label{sec:known-bugs-and-limitations}\<close>
 
 text \<open>
 This section lists the known bugs and limitations of the (co)datatype package at
 the time of this writing.
 
 \begin{enumerate}
 \setlength{\itemsep}{0pt}
 
 \item
 \emph{Defining mutually (co)recursive (co)datatypes can be slow.} Fortunately,
 it is always possible to recast mutual specifications to nested ones, which are
 processed more efficiently.
 
 \item
 \emph{Locally fixed types and terms cannot be used in type specifications.}
 The limitation on types can be circumvented by adding type arguments to the local
 (co)datatypes to abstract over the locally fixed types.
 
 \item
 \emph{The \emph{\keyw{primcorec}} command does not allow user-specified names and
 attributes next to the entered formulas.} The less convenient syntax, using the
 \keyw{lemmas} command, is available as an alternative.
 
 \item
 \emph{The \emph{\keyw{primcorec}} command does not allow corecursion under
 \<open>case\<close>--\<open>of\<close> for datatypes that are defined without
 discriminators and selectors.}
 
 \item
 \emph{There is no way to use an overloaded constant from a syntactic type
 class, such as \<open>0\<close>, as a constructor.}
 
 \item
 \emph{There is no way to register the same type as both a datatype and a
 codatatype.} This affects types such as the extended natural numbers, for which
 both views would make sense (for a different set of constructors).
 
 \item
 \emph{The names of variables are often suboptimal in the properties generated by
 the package.}
 
 \item
 \emph{The compatibility layer sometimes produces induction principles with a
 slightly different ordering of the premises than the old package.}
 
 \end{enumerate}
 \<close>
 
 
 text \<open>
 \section*{Acknowledgment}
 
 Tobias Nipkow and Makarius Wenzel encouraged us to implement the new
 (co)datatype package. Andreas Lochbihler provided lots of comments on earlier
 versions of the package, especially on the coinductive part. Brian Huffman
 suggested major simplifications to the internal constructions. Ond\v{r}ej
 Kun\v{c}ar implemented the \<open>transfer\<close> and \<open>lifting\<close> plugins.
 Christian Sternagel and Ren\'e Thiemann ported the \keyw{derive} command
 from the \emph{Archive of Formal Proofs} to the new datatypes. Gerwin Klein and
 Lars Noschinski implemented the @{command simps_of_case} and @{command
 case_of_simps} commands. Florian Haftmann, Christian Urban, and Makarius
 Wenzel provided general advice on Isabelle and package writing. Stefan Milius
 and Lutz Schröder found an elegant proof that eliminated one of the BNF
 proof obligations. Mamoun Filali-Amine, Gerwin Klein, Andreas Lochbihler,
 Tobias Nipkow, and Christian Sternagel suggested many textual improvements to
 this tutorial.
 \<close>
 
 end
diff --git a/src/Doc/Demo_EPTCS/Document.thy b/src/Doc/Demo_EPTCS/Document.thy
--- a/src/Doc/Demo_EPTCS/Document.thy
+++ b/src/Doc/Demo_EPTCS/Document.thy
@@ -1,64 +1,64 @@
 theory Document
   imports Main
 begin
 
 section \<open>Some section\<close>
 
 subsection \<open>Some subsection\<close>
 
 subsection \<open>Some subsubsection\<close>
 
 subsubsection \<open>Some subsubsubsection\<close>
 
 paragraph \<open>A paragraph.\<close>
 
 text \<open>Informal bla bla.\<close>
 
 definition "foo = True"  \<comment> \<open>side remark on \<^const>\<open>foo\<close>\<close>
 
 definition "bar = False"  \<comment> \<open>side remark on \<^const>\<open>bar\<close>\<close>
 
 lemma foo unfolding foo_def ..
 
 
 paragraph \<open>Another paragraph.\<close>
 
-text \<open>See also @{cite \<open>\S3\<close> "isabelle-system"}.\<close>
+text \<open>See also \<^cite>\<open>\<open>\S3\<close> in "isabelle-system"\<close>.\<close>
 
 
 section \<open>Formal proof of Cantor's theorem\<close>
 
 text_raw \<open>\isakeeptag{proof}\<close>
 text \<open>
   Cantor's Theorem states that there is no surjection from
   a set to its powerset.  The proof works by diagonalization.  E.g.\ see
   \<^item> \<^url>\<open>http://mathworld.wolfram.com/CantorDiagonalMethod.html\<close>
   \<^item> \<^url>\<open>https://en.wikipedia.org/wiki/Cantor's_diagonal_argument\<close>
 \<close>
 
 theorem Cantor: "\<nexists>f :: 'a \<Rightarrow> 'a set. \<forall>A. \<exists>x. A = f x"
 proof
   assume "\<exists>f :: 'a \<Rightarrow> 'a set. \<forall>A. \<exists>x. A = f x"
   then obtain f :: "'a \<Rightarrow> 'a set" where *: "\<forall>A. \<exists>x. A = f x" ..
   let ?D = "{x. x \<notin> f x}"
   from * obtain a where "?D = f a" by blast
   moreover have "a \<in> ?D \<longleftrightarrow> a \<notin> f a" by blast
   ultimately show False by blast
 qed
 
 
 subsection \<open>Lorem ipsum dolor\<close>
 
 text \<open>
   Lorem ipsum dolor sit amet, consectetur adipiscing elit. Donec id ipsum
   sapien. Vivamus malesuada enim nibh, a tristique nisi sodales ac. Praesent
   ut sem consectetur, interdum tellus ac, sodales nulla. Quisque vel diam at
   risus tempus tempor eget a tortor. Suspendisse potenti. Nulla erat lacus,
   dignissim sed volutpat nec, feugiat non leo. Nunc blandit et justo sed
   venenatis. Donec scelerisque placerat magna, et congue nulla convallis vel.
   Cras tristique dolor consequat dolor tristique rutrum. Suspendisse ultrices
   sem nibh, et suscipit felis ultricies at. Aliquam venenatis est vel nulla
   efficitur ornare. Lorem ipsum dolor sit amet, consectetur adipiscing elit.
 \<close>
 
 end
diff --git a/src/Doc/Demo_Easychair/Document.thy b/src/Doc/Demo_Easychair/Document.thy
--- a/src/Doc/Demo_Easychair/Document.thy
+++ b/src/Doc/Demo_Easychair/Document.thy
@@ -1,64 +1,64 @@
 theory Document
   imports Main
 begin
 
 section \<open>Some section\<close>
 
 subsection \<open>Some subsection\<close>
 
 subsection \<open>Some subsubsection\<close>
 
 subsubsection \<open>Some subsubsubsection\<close>
 
 paragraph \<open>A paragraph.\<close>
 
 text \<open>Informal bla bla.\<close>
 
 definition "foo = True"  \<comment> \<open>side remark on \<^const>\<open>foo\<close>\<close>
 
 definition "bar = False"  \<comment> \<open>side remark on \<^const>\<open>bar\<close>\<close>
 
 lemma foo unfolding foo_def ..
 
 
 paragraph \<open>Another paragraph.\<close>
 
-text \<open>See also @{cite \<open>\S3\<close> "isabelle-system"}.\<close>
+text \<open>See also \<^cite>\<open>\<open>\S3\<close> in "isabelle-system"\<close>.\<close>
 
 
 section \<open>Formal proof of Cantor's theorem\<close>
 
 text_raw \<open>\isakeeptag{proof}\<close>
 text \<open>
   Cantor's Theorem states that there is no surjection from
   a set to its powerset.  The proof works by diagonalization.  E.g.\ see
   \<^item> \<^url>\<open>http://mathworld.wolfram.com/CantorDiagonalMethod.html\<close>
   \<^item> \<^url>\<open>https://en.wikipedia.org/wiki/Cantor's_diagonal_argument\<close>
 \<close>
 
 theorem Cantor: "\<nexists>f :: 'a \<Rightarrow> 'a set. \<forall>A. \<exists>x. A = f x"
 proof
   assume "\<exists>f :: 'a \<Rightarrow> 'a set. \<forall>A. \<exists>x. A = f x"
   then obtain f :: "'a \<Rightarrow> 'a set" where *: "\<forall>A. \<exists>x. A = f x" ..
   let ?D = "{x. x \<notin> f x}"
   from * obtain a where "?D = f a" by blast
   moreover have "a \<in> ?D \<longleftrightarrow> a \<notin> f a" by blast
   ultimately show False by blast
 qed
 
 
 subsection \<open>Lorem ipsum dolor\<close>
 
 text \<open>
   Lorem ipsum dolor sit amet, consectetur adipiscing elit. Donec id ipsum
   sapien. Vivamus malesuada enim nibh, a tristique nisi sodales ac. Praesent
   ut sem consectetur, interdum tellus ac, sodales nulla. Quisque vel diam at
   risus tempus tempor eget a tortor. Suspendisse potenti. Nulla erat lacus,
   dignissim sed volutpat nec, feugiat non leo. Nunc blandit et justo sed
   venenatis. Donec scelerisque placerat magna, et congue nulla convallis vel.
   Cras tristique dolor consequat dolor tristique rutrum. Suspendisse ultrices
   sem nibh, et suscipit felis ultricies at. Aliquam venenatis est vel nulla
   efficitur ornare. Lorem ipsum dolor sit amet, consectetur adipiscing elit.
 \<close>
 
 end
diff --git a/src/Doc/Demo_LIPIcs/Document.thy b/src/Doc/Demo_LIPIcs/Document.thy
--- a/src/Doc/Demo_LIPIcs/Document.thy
+++ b/src/Doc/Demo_LIPIcs/Document.thy
@@ -1,64 +1,64 @@
 theory Document
   imports Main
 begin
 
 section \<open>Some section\<close>
 
 subsection \<open>Some subsection\<close>
 
 subsection \<open>Some subsubsection\<close>
 
 subsubsection \<open>Some subsubsubsection\<close>
 
 paragraph \<open>A paragraph.\<close>
 
 text \<open>Informal bla bla.\<close>
 
 definition "foo = True"  \<comment> \<open>side remark on \<^const>\<open>foo\<close>\<close>
 
 definition "bar = False"  \<comment> \<open>side remark on \<^const>\<open>bar\<close>\<close>
 
 lemma foo unfolding foo_def ..
 
 
 paragraph \<open>Another paragraph.\<close>
 
-text \<open>See also @{cite \<open>\S3\<close> "isabelle-system"}.\<close>
+text \<open>See also \<^cite>\<open>\<open>\S3\<close> in "isabelle-system"\<close>.\<close>
 
 
 section \<open>Formal proof of Cantor's theorem\<close>
 
 text_raw \<open>\isakeeptag{proof}\<close>
 text \<open>
   Cantor's Theorem states that there is no surjection from
   a set to its powerset.  The proof works by diagonalization.  E.g.\ see
   \<^item> \<^url>\<open>http://mathworld.wolfram.com/CantorDiagonalMethod.html\<close>
   \<^item> \<^url>\<open>https://en.wikipedia.org/wiki/Cantor's_diagonal_argument\<close>
 \<close>
 
 theorem Cantor: "\<nexists>f :: 'a \<Rightarrow> 'a set. \<forall>A. \<exists>x. A = f x"
 proof
   assume "\<exists>f :: 'a \<Rightarrow> 'a set. \<forall>A. \<exists>x. A = f x"
   then obtain f :: "'a \<Rightarrow> 'a set" where *: "\<forall>A. \<exists>x. A = f x" ..
   let ?D = "{x. x \<notin> f x}"
   from * obtain a where "?D = f a" by blast
   moreover have "a \<in> ?D \<longleftrightarrow> a \<notin> f a" by blast
   ultimately show False by blast
 qed
 
 
 subsection \<open>Lorem ipsum dolor\<close>
 
 text \<open>
   Lorem ipsum dolor sit amet, consectetur adipiscing elit. Donec id ipsum
   sapien. Vivamus malesuada enim nibh, a tristique nisi sodales ac. Praesent
   ut sem consectetur, interdum tellus ac, sodales nulla. Quisque vel diam at
   risus tempus tempor eget a tortor. Suspendisse potenti. Nulla erat lacus,
   dignissim sed volutpat nec, feugiat non leo. Nunc blandit et justo sed
   venenatis. Donec scelerisque placerat magna, et congue nulla convallis vel.
   Cras tristique dolor consequat dolor tristique rutrum. Suspendisse ultrices
   sem nibh, et suscipit felis ultricies at. Aliquam venenatis est vel nulla
   efficitur ornare. Lorem ipsum dolor sit amet, consectetur adipiscing elit.
 \<close>
 
 end
diff --git a/src/Doc/Demo_LLNCS/Document.thy b/src/Doc/Demo_LLNCS/Document.thy
--- a/src/Doc/Demo_LLNCS/Document.thy
+++ b/src/Doc/Demo_LLNCS/Document.thy
@@ -1,64 +1,64 @@
 theory Document
   imports Main
 begin
 
 section \<open>Some section\<close>
 
 subsection \<open>Some subsection\<close>
 
 subsection \<open>Some subsubsection\<close>
 
 subsubsection \<open>Some subsubsubsection\<close>
 
 paragraph \<open>A paragraph.\<close>
 
 text \<open>Informal bla bla.\<close>
 
 definition "foo = True"  \<comment> \<open>side remark on \<^const>\<open>foo\<close>\<close>
 
 definition "bar = False"  \<comment> \<open>side remark on \<^const>\<open>bar\<close>\<close>
 
 lemma foo unfolding foo_def ..
 
 
 paragraph \<open>Another paragraph.\<close>
 
-text \<open>See also @{cite \<open>\S3\<close> "isabelle-system"}.\<close>
+text \<open>See also \<^cite>\<open>\<open>\S3\<close> in "isabelle-system"\<close>.\<close>
 
 
 section \<open>Formal proof of Cantor's theorem\<close>
 
 text_raw \<open>\isakeeptag{proof}\<close>
 text \<open>
   Cantor's Theorem states that there is no surjection from
   a set to its powerset.  The proof works by diagonalization.  E.g.\ see
   \<^item> \<^url>\<open>http://mathworld.wolfram.com/CantorDiagonalMethod.html\<close>
   \<^item> \<^url>\<open>https://en.wikipedia.org/wiki/Cantor%27s%5fdiagonal%5fargument\<close>
 \<close>
 
 theorem Cantor: "\<nexists>f :: 'a \<Rightarrow> 'a set. \<forall>A. \<exists>x. A = f x"
 proof
   assume "\<exists>f :: 'a \<Rightarrow> 'a set. \<forall>A. \<exists>x. A = f x"
   then obtain f :: "'a \<Rightarrow> 'a set" where *: "\<forall>A. \<exists>x. A = f x" ..
   let ?D = "{x. x \<notin> f x}"
   from * obtain a where "?D = f a" by blast
   moreover have "a \<in> ?D \<longleftrightarrow> a \<notin> f a" by blast
   ultimately show False by blast
 qed
 
 
 subsection \<open>Lorem ipsum dolor\<close>
 
 text \<open>
   Lorem ipsum dolor sit amet, consectetur adipiscing elit. Donec id ipsum
   sapien. Vivamus malesuada enim nibh, a tristique nisi sodales ac. Praesent
   ut sem consectetur, interdum tellus ac, sodales nulla. Quisque vel diam at
   risus tempus tempor eget a tortor. Suspendisse potenti. Nulla erat lacus,
   dignissim sed volutpat nec, feugiat non leo. Nunc blandit et justo sed
   venenatis. Donec scelerisque placerat magna, et congue nulla convallis vel.
   Cras tristique dolor consequat dolor tristique rutrum. Suspendisse ultrices
   sem nibh, et suscipit felis ultricies at. Aliquam venenatis est vel nulla
   efficitur ornare. Lorem ipsum dolor sit amet, consectetur adipiscing elit.
 \<close>
 
 end
diff --git a/src/Doc/Eisbach/Manual.thy b/src/Doc/Eisbach/Manual.thy
--- a/src/Doc/Eisbach/Manual.thy
+++ b/src/Doc/Eisbach/Manual.thy
@@ -1,957 +1,957 @@
 (*:maxLineLen=78:*)
 
 theory Manual
 imports Base "HOL-Eisbach.Eisbach_Tools"
 begin
 
 chapter \<open>The method command\<close>
 
 text \<open>
   The @{command_def method} command provides the ability to write proof
   methods by combining existing ones with their usual syntax. Specifically it
   allows compound proof methods to be named, and to extend the name space of
   basic methods accordingly. Method definitions may abstract over parameters:
   terms, facts, or other methods.
 
   \<^medskip>
   The syntax diagram below refers to some syntactic categories that are
-  further defined in @{cite "isabelle-isar-ref"}.
+  further defined in \<^cite>\<open>"isabelle-isar-ref"\<close>.
 
   \<^rail>\<open>
     @@{command method} name args @'=' method
     ;
     args: term_args? method_args? \<newline> fact_args? decl_args?
     ;
     term_args: @'for' @{syntax "fixes"}
     ;
     method_args: @'methods' (name+)
     ;
     fact_args: @'uses' (name+)
     ;
     decl_args: @'declares' (name+)
   \<close>
 \<close>
 
 
 section \<open>Basic method definitions\<close>
 
 text \<open>
   Consider the following proof that makes use of usual Isar method
   combinators.
 \<close>
 
     lemma "P \<and> Q \<longrightarrow> P"
       by ((rule impI, (erule conjE)?) | assumption)+
 
 text \<open>
   It is clear that this compound method will be applicable in more cases than
   this proof alone. With the @{command method} command we can define a proof
   method that makes the above functionality available generally.
 \<close>
 
     method prop_solver\<^sub>1 =
       ((rule impI, (erule conjE)?) | assumption)+
 
     lemma "P \<and> Q \<and> R \<longrightarrow> P"
       by prop_solver\<^sub>1
 
 text \<open>
   In this example, the facts \<open>impI\<close> and \<open>conjE\<close> are static. They are evaluated
   once when the method is defined and cannot be changed later. This makes the
   method stable in the sense of \<^emph>\<open>static scoping\<close>: naming another fact \<open>impI\<close>
   in a later context won't affect the behaviour of \<open>prop_solver\<^sub>1\<close>.
 \<close>
 
 
 section \<open>Term abstraction\<close>
 
 text \<open>
   Methods can also abstract over terms using the @{keyword_def "for"} keyword,
   optionally providing type constraints. For instance, the following proof
   method \<open>intro_ex\<close> takes a term \<^term>\<open>y\<close> of any type, which it uses to
   instantiate the \<^term>\<open>x\<close>-variable of \<open>exI\<close> (existential introduction)
   before applying the result as a rule. The instantiation is performed here by
   Isar's @{attribute_ref "where"} attribute. If the current subgoal is to find
   a witness for the given predicate \<^term>\<open>Q\<close>, then this has the effect of
   committing to \<^term>\<open>y\<close>.
 \<close>
 
     method intro_ex for Q :: "'a \<Rightarrow> bool" and y :: 'a =
       (rule exI ["where" P = Q and x = y])
 
 
 text \<open>
   The term parameters \<^term>\<open>y\<close> and \<^term>\<open>Q\<close> can be used arbitrarily inside
   the method body, as part of attribute applications or arguments to other
   methods. The expression is type-checked as far as possible when the method
   is defined, however dynamic type errors can still occur when it is invoked
   (e.g.\ when terms are instantiated in a parameterized fact). Actual term
   arguments are supplied positionally, in the same order as in the method
   definition.
 \<close>
 
     lemma "P a \<Longrightarrow> \<exists>x. P x"
       by (intro_ex P a)
 
 
 section \<open>Fact abstraction\<close>
 
 subsection \<open>Named theorems\<close>
 
 text \<open>
   A \<^emph>\<open>named theorem\<close> is a fact whose contents are produced dynamically within
   the current proof context. The Isar command @{command_ref "named_theorems"}
   declares a dynamic fact with a corresponding \<^emph>\<open>attribute\<close> of the same
   name. This allows to maintain a collection of facts in the context as
   follows:
 \<close>
 
     named_theorems intros
 
 text \<open>
   So far \<open>intros\<close> refers to the empty fact. Using the Isar command
   @{command_ref "declare"} we may apply declaration attributes to the context.
   Below we declare both \<open>conjI\<close> and \<open>impI\<close> as \<open>intros\<close>, adding them to the
   named theorem slot.
 \<close>
 
     declare conjI [intros] and impI [intros]
 
 text \<open>
   We can refer to named theorems as dynamic facts within a particular proof
   context, which are evaluated whenever the method is invoked. Instead of
   having facts hard-coded into the method, as in \<open>prop_solver\<^sub>1\<close>, we can
   instead refer to these named theorems.
 \<close>
 
     named_theorems elims
     declare conjE [elims]
 
     method prop_solver\<^sub>3 =
       ((rule intros, (erule elims)?) | assumption)+
 
     lemma "P \<and> Q \<longrightarrow> P"
       by prop_solver\<^sub>3
 
 text \<open>
   Often these named theorems need to be augmented on the spot, when a method
   is invoked. The @{keyword_def "declares"} keyword in the signature of
   @{command method} adds the common method syntax \<open>method decl: facts\<close> for
   each named theorem \<open>decl\<close>.
 \<close>
 
     method prop_solver\<^sub>4 declares intros elims =
       ((rule intros, (erule elims)?) | assumption)+
 
     lemma "P \<and> (P \<longrightarrow> Q) \<longrightarrow> Q \<and> P"
       by (prop_solver\<^sub>4 elims: impE intros: conjI)
 
 
 subsection \<open>Simple fact abstraction\<close>
 
 text \<open>
   The @{keyword "declares"} keyword requires that a corresponding dynamic fact
   has been declared with @{command_ref named_theorems}. This is useful for
   managing collections of facts which are to be augmented with declarations,
   but is overkill if we simply want to pass a fact to a method.
 
   We may use the @{keyword_def "uses"} keyword in the method header to provide
   a simple fact parameter. In contrast to @{keyword "declares"}, these facts
   are always implicitly empty unless augmented when the method is invoked.
 \<close>
 
     method rule_twice uses my_rule =
       (rule my_rule, rule my_rule)
 
     lemma "P \<Longrightarrow> Q \<Longrightarrow> (P \<and> Q) \<and> Q"
       by (rule_twice my_rule: conjI)
 
 
 section \<open>Higher-order methods\<close>
 
 text \<open>
   The \<^emph>\<open>structured concatenation\<close> combinator ``\<open>method\<^sub>1 ; method\<^sub>2\<close>'' was
   introduced in Isabelle2015, motivated by the development of Eisbach. It is
   similar to ``\<open>method\<^sub>1, method\<^sub>2\<close>'', but \<open>method\<^sub>2\<close> is invoked on \<^emph>\<open>all\<close>
   subgoals that have newly emerged from \<open>method\<^sub>1\<close>. This is useful to handle
   cases where the number of subgoals produced by a method is determined
   dynamically at run-time.
 \<close>
 
     method conj_with uses rule =
       (intro conjI ; intro rule)
 
     lemma
       assumes A: "P"
       shows "P \<and> P \<and> P"
       by (conj_with rule: A)
 
 text \<open>
   Method definitions may take other methods as arguments, and thus implement
   method combinators with prefix syntax. For example, to more usefully exploit
   Isabelle's backtracking, the explicit requirement that a method solve all
   produced subgoals is frequently useful. This can easily be written as a
   \<^emph>\<open>higher-order method\<close> using ``\<open>;\<close>''. The @{keyword "methods"} keyword
   denotes method parameters that are other proof methods to be invoked by the
   method being defined.
 \<close>
 
     method solve methods m = (m ; fail)
 
 text \<open>
   Given some method-argument \<open>m\<close>, \<open>solve \<open>m\<close>\<close> applies the method \<open>m\<close> and then
   fails whenever \<open>m\<close> produces any new unsolved subgoals --- i.e. when \<open>m\<close>
   fails to completely discharge the goal it was applied to.
 \<close>
 
 
 section \<open>Example\<close>
 
 text \<open>
   With these simple features we are ready to write our first non-trivial proof
   method. Returning to the first-order logic example, the following method
   definition applies various rules with their canonical methods.
 \<close>
 
     named_theorems subst
 
     method prop_solver declares intros elims subst =
       (assumption |
         (rule intros) | erule elims |
         subst subst | subst (asm) subst |
         (erule notE ; solve \<open>prop_solver\<close>))+
 
 text \<open>
   The only non-trivial part above is the final alternative \<open>(erule notE ;
   solve \<open>prop_solver\<close>)\<close>. Here, in the case that all other alternatives fail,
   the method takes one of the assumptions \<^term>\<open>\<not> P\<close> of the current goal
   and eliminates it with the rule \<open>notE\<close>, causing the goal to be proved to
   become \<^term>\<open>P\<close>. The method then recursively invokes itself on the
   remaining goals. The job of the recursive call is to demonstrate that there
   is a contradiction in the original assumptions (i.e.\ that \<^term>\<open>P\<close> can be
   derived from them). Note this recursive invocation is applied with the
   @{method solve} method combinator to ensure that a contradiction will indeed
   be shown. In the case where a contradiction cannot be found, backtracking
   will occur and a different assumption \<^term>\<open>\<not> Q\<close> will be chosen for
   elimination.
 
   Note that the recursive call to @{method prop_solver} does not have any
   parameters passed to it. Recall that fact parameters, e.g.\ \<open>intros\<close>,
   \<open>elims\<close>, and \<open>subst\<close>, are managed by declarations in the current proof
   context. They will therefore be passed to any recursive call to @{method
   prop_solver} and, more generally, any invocation of a method which declares
   these named theorems.
 
   \<^medskip>
   After declaring some standard rules to the context, the @{method
   prop_solver} becomes capable of solving non-trivial propositional
   tautologies.
 \<close>
 
     lemmas [intros] =
       conjI  \<comment> \<open>@{thm conjI}\<close>
       impI  \<comment> \<open>@{thm impI}\<close>
       disjCI  \<comment> \<open>@{thm disjCI}\<close>
       iffI  \<comment> \<open>@{thm iffI}\<close>
       notI  \<comment> \<open>@{thm notI}\<close>
 
     lemmas [elims] =
       impCE  \<comment> \<open>@{thm impCE}\<close>
       conjE  \<comment> \<open>@{thm conjE}\<close>
       disjE  \<comment> \<open>@{thm disjE}\<close>
 
     lemma "(A \<or> B) \<and> (A \<longrightarrow> C) \<and> (B \<longrightarrow> C) \<longrightarrow> C"
       by prop_solver
 
 
 chapter \<open>The match method \label{s:matching}\<close>
 
 text \<open>
   So far we have seen methods defined as simple combinations of other methods.
   Some familiar programming language concepts have been introduced (i.e.\
   abstraction and recursion). The only control flow has been implicitly the
   result of backtracking. When designing more sophisticated proof methods this
   proves too restrictive and difficult to manage conceptually.
 
   To address this, we introduce the @{method_def match} method, which provides
   more direct access to the higher-order matching facility at the core of
   Isabelle. It is implemented as a separate proof method (in Isabelle/ML), and
   thus can be directly applied to proofs, however it is most useful when
   applied in the context of writing Eisbach method definitions.
 
   \<^medskip>
   The syntax diagram below refers to some syntactic categories that are
-  further defined in @{cite "isabelle-isar-ref"}.
+  further defined in \<^cite>\<open>"isabelle-isar-ref"\<close>.
 
   \<^rail>\<open>
     @@{method match} kind @'in' (pattern '\<Rightarrow>' @{syntax text} + '\<bar>')
     ;
     kind:
       (@'conclusion' | @'premises' ('(' 'local' ')')? |
        '(' term ')' | @{syntax thms})
     ;
     pattern: fact_name? term args? \<newline> (@'for' fixes)?
     ;
     fact_name: @{syntax name} @{syntax attributes}? ':'
     ;
     args: '(' (('multi' | 'cut' nat?) + ',') ')'
   \<close>
 
   Matching allows methods to introspect the goal state, and to implement more
   explicit control flow. In the basic case, a term or fact \<open>ts\<close> is given to
   match against as a \<^emph>\<open>match target\<close>, along with a collection of
   pattern-method pairs \<open>(p, m)\<close>: roughly speaking, when the pattern \<open>p\<close>
   matches any member of \<open>ts\<close>, the \<^emph>\<open>inner\<close> method \<open>m\<close> will be executed.
 \<close>
 
     lemma
       assumes X:
         "Q \<longrightarrow> P"
         "Q"
       shows P
         by (match X in I: "Q \<longrightarrow> P" and I': "Q" \<Rightarrow> \<open>insert mp [OF I I']\<close>)
 
 text \<open>
   In this example we have a structured Isar proof, with the named assumption
   \<open>X\<close> and a conclusion \<^term>\<open>P\<close>. With the match method we can find the
   local facts \<^term>\<open>Q \<longrightarrow> P\<close> and \<^term>\<open>Q\<close>, binding them to separately as
   \<open>I\<close> and \<open>I'\<close>. We then specialize the modus-ponens rule @{thm mp [of Q P]} to
   these facts to solve the goal.
 \<close>
 
 
 section \<open>Subgoal focus\<close>
 
 text\<open>
   In the previous example we were able to match against an assumption out of
   the Isar proof state. In general, however, proof subgoals can be
   \<^emph>\<open>unstructured\<close>, with goal parameters and premises arising from rule
   application. To address this, @{method match} uses \<^emph>\<open>subgoal focusing\<close> to
   produce structured goals out of unstructured ones. In place of fact or term,
   we may give the keyword @{keyword_def "premises"} as the match target. This
   causes a subgoal focus on the first subgoal, lifting local goal parameters
   to fixed term variables and premises into hypothetical theorems. The match
   is performed against these theorems, naming them and binding them as
   appropriate. Similarly giving the keyword @{keyword_def "conclusion"}
   matches against the conclusion of the first subgoal.
 
   An unstructured version of the previous example can then be similarly solved
   through focusing.
 \<close>
 
     lemma "Q \<longrightarrow> P \<Longrightarrow> Q \<Longrightarrow> P"
       by (match premises in
                 I: "Q \<longrightarrow> P" and I': "Q" \<Rightarrow> \<open>insert mp [OF I I']\<close>)
 
 text \<open>
   Match variables may be specified by giving a list of @{keyword_ref
   "for"}-fixes after the pattern description. This marks those terms as bound
   variables, which may be used in the method body.
 \<close>
 
     lemma "Q \<longrightarrow> P \<Longrightarrow> Q \<Longrightarrow> P"
       by (match premises in I: "Q \<longrightarrow> A" and I': "Q" for A \<Rightarrow>
             \<open>match conclusion in A \<Rightarrow> \<open>insert mp [OF I I']\<close>\<close>)
 
 text \<open>
   In this example \<^term>\<open>A\<close> is a match variable which is bound to \<^term>\<open>P\<close>
   upon a successful match. The inner @{method match} then matches the
   now-bound \<^term>\<open>A\<close> (bound to \<^term>\<open>P\<close>) against the conclusion (also \<^term>\<open>P\<close>), finally applying the specialized rule to solve the goal.
 
   Schematic terms like \<open>?P\<close> may also be used to specify match variables, but
   the result of the match is not bound, and thus cannot be used in the inner
   method body.
 
   \<^medskip>
   In the following example we extract the predicate of an existentially
   quantified conclusion in the current subgoal and search the current premises
   for a matching fact. If both matches are successful, we then instantiate the
   existential introduction rule with both the witness and predicate, solving
   with the matched premise.
 \<close>
 
     method solve_ex =
       (match conclusion in "\<exists>x. Q x" for Q \<Rightarrow>
         \<open>match premises in U: "Q y" for y \<Rightarrow>
           \<open>rule exI [where P = Q and x = y, OF U]\<close>\<close>)
 
 text \<open>
   The first @{method match} matches the pattern \<^term>\<open>\<exists>x. Q x\<close> against the
   current conclusion, binding the term \<^term>\<open>Q\<close> in the inner match. Next
   the pattern \<open>Q y\<close> is matched against all premises of the current subgoal. In
   this case \<^term>\<open>Q\<close> is fixed and \<^term>\<open>y\<close> may be instantiated. Once a
   match is found, the local fact \<open>U\<close> is bound to the matching premise and the
   variable \<^term>\<open>y\<close> is bound to the matching witness. The existential
   introduction rule \<open>exI:\<close>~@{thm exI} is then instantiated with \<^term>\<open>y\<close> as
   the witness and \<^term>\<open>Q\<close> as the predicate, with its proof obligation
   solved by the local fact U (using the Isar attribute @{attribute OF}). The
   following example is a trivial use of this method.
 \<close>
 
     lemma "halts p \<Longrightarrow> \<exists>x. halts x"
       by solve_ex
 
 
 subsection \<open>Operating within a focus\<close>
 
 text \<open>
   Subgoal focusing provides a structured form of a subgoal, allowing for more
   expressive introspection of the goal state. This requires some consideration
   in order to be used effectively. When the keyword @{keyword "premises"} is
   given as the match target, the premises of the subgoal are lifted into
   hypothetical theorems, which can be found and named via match patterns.
   Additionally these premises are stripped from the subgoal, leaving only the
   conclusion. This renders them inaccessible to standard proof methods which
   operate on the premises, such as @{method frule} or @{method erule}. Naive
   usage of these methods within a match will most likely not function as the
   method author intended.
 \<close>
 
     method my_allE_bad for y :: 'a =
       (match premises in I: "\<forall>x :: 'a. ?Q x" \<Rightarrow>
         \<open>erule allE [where x = y]\<close>)
 
 text \<open>
   Here we take a single parameter \<^term>\<open>y\<close> and specialize the universal
   elimination rule (@{thm allE}) to it, then attempt to apply this specialized
   rule with @{method erule}. The method @{method erule} will attempt to unify
   with a universal quantifier in the premises that matches the type of \<^term>\<open>y\<close>. Since @{keyword "premises"} causes a focus, however, there are no
   subgoal premises to be found and thus @{method my_allE_bad} will always
   fail. If focusing instead left the premises in place, using methods like
   @{method erule} would lead to unintended behaviour, specifically during
   backtracking. In our example, @{method erule} could choose an alternate
   premise while backtracking, while leaving \<open>I\<close> bound to the original match.
   In the case of more complex inner methods, where either \<open>I\<close> or bound terms
   are used, this would almost certainly not be the intended behaviour.
 
   An alternative implementation would be to specialize the elimination rule to
   the bound term and apply it directly.
 \<close>
 
     method my_allE_almost for y :: 'a =
       (match premises in I: "\<forall>x :: 'a. ?Q x" \<Rightarrow>
         \<open>rule allE [where x = y, OF I]\<close>)
 
     lemma "\<forall>x. P x \<Longrightarrow> P y"
       by (my_allE_almost y)
 
 text \<open>
   This method will insert a specialized duplicate of a universally quantified
   premise. Although this will successfully apply in the presence of such a
   premise, it is not likely the intended behaviour. Repeated application of
   this method will produce an infinite stream of duplicate specialized
   premises, due to the original premise never being removed. To address this,
   matched premises may be declared with the @{attribute thin} attribute. This
   will hide the premise from subsequent inner matches, and remove it from the
   list of premises when the inner method has finished and the subgoal is
   unfocused. It can be considered analogous to the existing \<open>thin_tac\<close>.
 
   To complete our example, the correct implementation of the method will
   @{attribute thin} the premise from the match and then apply it to the
   specialized elimination rule.\<close>
 
     method my_allE for y :: 'a =
       (match premises in I [thin]: "\<forall>x :: 'a. ?Q x" \<Rightarrow>
          \<open>rule allE [where x = y, OF I]\<close>)
 
     lemma "\<forall>x. P x \<Longrightarrow> \<forall>x. Q x \<Longrightarrow> P y \<and> Q y"
       by (my_allE y)+ (rule conjI)
 
 
 subsubsection \<open>Inner focusing\<close>
 
 text \<open>
   Premises are \<^emph>\<open>accumulated\<close> for the purposes of subgoal focusing. In
   contrast to using standard methods like @{method frule} within focused
   match, another @{method match} will have access to all the premises of the
   outer focus.
 \<close>
 
     lemma "A \<Longrightarrow> B \<Longrightarrow> A \<and> B"
       by (match premises in H: A \<Rightarrow> \<open>intro conjI, rule H,
             match premises in H': B \<Rightarrow> \<open>rule H'\<close>\<close>)
 
 text \<open>
   In this example, the inner @{method match} can find the focused premise
   \<^term>\<open>B\<close>. In contrast, the @{method assumption} method would fail here due
   to \<^term>\<open>B\<close> not being logically accessible.
 \<close>
 
     lemma "A \<Longrightarrow> A \<and> (B \<longrightarrow> B)"
       by (match premises in H: A \<Rightarrow> \<open>intro conjI, rule H, rule impI,
             match premises (local) in A \<Rightarrow> \<open>fail\<close>
                                  \<bar> H': B \<Rightarrow> \<open>rule H'\<close>\<close>)
 
 text \<open>
   In this example, the only premise that exists in the first focus is \<^term>\<open>A\<close>. Prior to the inner match, the rule \<open>impI\<close> changes the goal \<^term>\<open>B \<longrightarrow>
   B\<close> into \<^term>\<open>B \<Longrightarrow> B\<close>. A standard premise match would also include \<^term>\<open>A\<close> as an original premise of the outer match. The \<open>local\<close> argument limits
   the match to newly focused premises.
 \<close>
 
 
 section \<open>Attributes\<close>
 
 text \<open>
   Attributes may throw errors when applied to a given fact. For example, rule
   instantiation will fail if there is a type mismatch or if a given variable
   doesn't exist. Within a match or a method definition, it isn't generally
   possible to guarantee that applied attributes won't fail. For example, in
   the following method there is no guarantee that the two provided facts will
   necessarily compose.
 \<close>
 
     method my_compose uses rule1 rule2 =
       (rule rule1 [OF rule2])
 
 text \<open>
   Some attributes (like @{attribute OF}) have been made partially
   Eisbach-aware. This means that they are able to form a closure despite not
   necessarily always being applicable. In the case of @{attribute OF}, it is
   up to the proof author to guard attribute application with an appropriate
   @{method match}, but there are still no static guarantees.
 
   In contrast to @{attribute OF}, the @{attribute "where"} and @{attribute of}
   attributes attempt to provide static guarantees that they will apply
   whenever possible.
 
   Within a match pattern for a fact, each outermost quantifier specifies the
   requirement that a matching fact must have a schematic variable at that
   point. This gives a corresponding name to this ``slot'' for the purposes of
   forming a static closure, allowing the @{attribute "where"} attribute to
   perform an instantiation at run-time.
 \<close>
 
     lemma
       assumes A: "Q \<Longrightarrow> False"
       shows "\<not> Q"
       by (match intros in X: "\<And>P. (P \<Longrightarrow> False) \<Longrightarrow> \<not> P" \<Rightarrow>
             \<open>rule X [where P = Q, OF A]\<close>)
 
 text \<open>
   Subgoal focusing converts the outermost quantifiers of premises into
   schematics when lifting them to hypothetical facts. This allows us to
   instantiate them with @{attribute "where"} when using an appropriate match
   pattern.
 \<close>
 
     lemma "(\<And>x :: 'a. A x \<Longrightarrow> B x) \<Longrightarrow> A y \<Longrightarrow> B y"
       by (match premises in I: "\<And>x :: 'a. ?P x \<Longrightarrow> ?Q x" \<Rightarrow>
             \<open>rule I [where x = y]\<close>)
 
 text \<open>
   The @{attribute of} attribute behaves similarly. It is worth noting,
   however, that the positional instantiation of @{attribute of} occurs against
   the position of the variables as they are declared \<^emph>\<open>in the match pattern\<close>.
 \<close>
 
     lemma
       fixes A B and x :: 'a and y :: 'b
       assumes asm: "(\<And>x y. A y x \<Longrightarrow> B x y )"
       shows "A y x \<Longrightarrow> B x y"
       by (match asm in I: "\<And>(x :: 'a) (y :: 'b). ?P x y \<Longrightarrow> ?Q x y" \<Rightarrow>
             \<open>rule I [of x y]\<close>)
 
 text \<open>
   In this example, the order of schematics in \<open>asm\<close> is actually \<open>?y ?x\<close>, but
   we instantiate our matched rule in the opposite order. This is because the
   effective rule \<^term>\<open>I\<close> was bound from the match, which declared the \<^typ>\<open>'a\<close> slot first and the \<^typ>\<open>'b\<close> slot second.
 
   To get the dynamic behaviour of @{attribute of} we can choose to invoke it
   \<^emph>\<open>unchecked\<close>. This avoids trying to do any type inference for the provided
   parameters, instead storing them as their most general type and doing type
   matching at run-time. This, like @{attribute OF}, will throw errors if the
   expected slots don't exist or there is a type mismatch.
 \<close>
 
     lemma
       fixes A B and x :: 'a and y :: 'b
       assumes asm: "\<And>x y. A y x \<Longrightarrow> B x y"
       shows "A y x \<Longrightarrow> B x y"
       by (match asm in I: "PROP ?P" \<Rightarrow> \<open>rule I [of (unchecked) y x]\<close>)
 
 text \<open>
   Attributes may be applied to matched facts directly as they are matched. Any
   declarations will therefore be applied in the context of the inner method,
   as well as any transformations to the rule.
 \<close>
 
     lemma "(\<And>x :: 'a. A x \<Longrightarrow> B x) \<Longrightarrow> A y \<longrightarrow> B y"
       by (match premises in I [of y, intros]: "\<And>x :: 'a. ?P x \<Longrightarrow> ?Q x" \<Rightarrow>
             \<open>prop_solver\<close>)
 
 text \<open>
   In this example, the pattern \<open>\<And>x :: 'a. ?P x \<Longrightarrow> ?Q x\<close> matches against the
   only premise, giving an appropriately typed slot for \<^term>\<open>y\<close>. After the
   match, the resulting rule is instantiated to \<^term>\<open>y\<close> and then declared as
   an @{attribute intros} rule. This is then picked up by @{method prop_solver}
   to solve the goal.
 \<close>
 
 
 section \<open>Multi-match \label{sec:multi}\<close>
 
 text \<open>
   In all previous examples, @{method match} was only ever searching for a
   single rule or premise. Each local fact would therefore always have a length
   of exactly one. We may, however, wish to find \<^emph>\<open>all\<close> matching results. To
   achieve this, we can simply mark a given pattern with the \<open>(multi)\<close>
   argument.
 \<close>
 
     lemma
       assumes asms: "A \<Longrightarrow> B"  "A \<Longrightarrow> D"
       shows "(A \<longrightarrow> B) \<and> (A \<longrightarrow> D)"
       apply (match asms in I [intros]: "?P \<Longrightarrow> ?Q"  \<Rightarrow> \<open>solves \<open>prop_solver\<close>\<close>)?
       apply (match asms in I [intros]: "?P \<Longrightarrow> ?Q" (multi) \<Rightarrow> \<open>prop_solver\<close>)
       done
 
 text \<open>
   In the first @{method match}, without the \<open>(multi)\<close> argument, \<^term>\<open>I\<close> is
   only ever be bound to one of the members of \<open>asms\<close>. This backtracks over
   both possibilities (see next section), however neither assumption in
   isolation is sufficient to solve to goal. The use of the @{method solves}
   combinator ensures that @{method prop_solver} has no effect on the goal when
   it doesn't solve it, and so the first match leaves the goal unchanged. In
   the second @{method match}, \<open>I\<close> is bound to all of \<open>asms\<close>, declaring both
   results as \<open>intros\<close>. With these rules @{method prop_solver} is capable of
   solving the goal.
 
   Using for-fixed variables in patterns imposes additional constraints on the
   results. In all previous examples, the choice of using \<open>?P\<close> or a for-fixed
   \<^term>\<open>P\<close> only depended on whether or not \<^term>\<open>P\<close> was mentioned in another
   pattern or the inner method. When using a multi-match, however, all
   for-fixed terms must agree in the results.
 \<close>
 
     lemma
       assumes asms: "A \<Longrightarrow> B"  "A \<Longrightarrow> D"  "D \<Longrightarrow> B"
       shows "(A \<longrightarrow> B) \<and> (A \<longrightarrow> D)"
       apply (match asms in I [intros]: "?P \<Longrightarrow> Q" (multi) for Q \<Rightarrow>
               \<open>solves \<open>prop_solver\<close>\<close>)?
       apply (match asms in I [intros]: "P \<Longrightarrow> ?Q" (multi) for P \<Rightarrow>
               \<open>prop_solver\<close>)
       done
 
 text \<open>
   Here we have two seemingly-equivalent applications of @{method match},
   however only the second one is capable of solving the goal. The first
   @{method match} selects the first and third members of \<open>asms\<close> (those that
   agree on their conclusion), which is not sufficient. The second @{method
   match} selects the first and second members of \<open>asms\<close> (those that agree on
   their assumption), which is enough for @{method prop_solver} to solve the
   goal.
 \<close>
 
 
 section \<open>Dummy patterns\<close>
 
 text \<open>
   Dummy patterns may be given as placeholders for unique schematics in
   patterns. They implicitly receive all currently bound variables as
   arguments, and are coerced into the \<^typ>\<open>prop\<close> type whenever possible. For
   example, the trivial dummy pattern \<open>_\<close> will match any proposition. In
   contrast, by default the pattern \<open>?P\<close> is considered to have type \<^typ>\<open>bool\<close>. It will not bind anything with meta-logical connectives (e.g. \<open>_ \<Longrightarrow> _\<close>
   or \<open>_ &&& _\<close>).
 \<close>
 
     lemma
       assumes asms: "A &&& B \<Longrightarrow> D"
       shows "(A \<and> B \<longrightarrow> D)"
       by (match asms in I: _ \<Rightarrow> \<open>prop_solver intros: I conjunctionI\<close>)
 
 
 section \<open>Backtracking\<close>
 
 text \<open>
   Patterns are considered top-down, executing the inner method \<open>m\<close> of the
   first pattern which is satisfied by the current match target. By default,
   matching performs extensive backtracking by attempting all valid variable
   and fact bindings according to the given pattern. In particular, all
   unifiers for a given pattern will be explored, as well as each matching
   fact. The inner method \<open>m\<close> will be re-executed for each different
   variable/fact binding during backtracking. A successful match is considered
   a cut-point for backtracking. Specifically, once a match is made no other
   pattern-method pairs will be considered.
 
   The method \<open>foo\<close> below fails for all goals that are conjunctions. Any such
   goal will match the first pattern, causing the second pattern (that would
   otherwise match all goals) to never be considered.
 \<close>
 
     method foo =
       (match conclusion in "?P \<and> ?Q" \<Rightarrow> \<open>fail\<close> \<bar> "?R" \<Rightarrow> \<open>prop_solver\<close>)
 
 text \<open>
   The failure of an inner method that is executed after a successful match
   will cause the entire match to fail. This distinction is important due to
   the pervasive use of backtracking. When a method is used in a combinator
   chain, its failure becomes significant because it signals previously applied
   methods to move to the next result. Therefore, it is necessary for @{method
   match} to not mask such failure. One can always rewrite a match using the
   combinators ``\<open>?\<close>'' and ``\<open>|\<close>'' to try subsequent patterns in the case of an
   inner-method failure. The following proof method, for example, always
   invokes @{method prop_solver} for all goals because its first alternative
   either never matches or (if it does match) always fails.
 \<close>
 
     method foo\<^sub>1 =
       (match conclusion in "?P \<and> ?Q" \<Rightarrow> \<open>fail\<close>) |
       (match conclusion in "?R" \<Rightarrow> \<open>prop_solver\<close>)
 
 
 subsection \<open>Cut\<close>
 
 text \<open>
   Backtracking may be controlled more precisely by marking individual patterns
   as \<open>cut\<close>. This causes backtracking to not progress beyond this pattern: once
   a match is found no others will be considered.
 \<close>
 
     method foo\<^sub>2 =
       (match premises in I: "P \<and> Q" (cut) and I': "P \<longrightarrow> ?U" for P Q \<Rightarrow>
         \<open>rule mp [OF I' I [THEN conjunct1]]\<close>)
 
 text \<open>
   In this example, once a conjunction is found (\<^term>\<open>P \<and> Q\<close>), all possible
   implications of \<^term>\<open>P\<close> in the premises are considered, evaluating the
   inner @{method rule} with each consequent. No other conjunctions will be
   considered, with method failure occurring once all implications of the form
   \<open>P \<longrightarrow> ?U\<close> have been explored. Here the left-right processing of individual
   patterns is important, as all patterns after of the cut will maintain their
   usual backtracking behaviour.
 \<close>
 
     lemma "A \<and> B \<Longrightarrow> A \<longrightarrow> D \<Longrightarrow> A \<longrightarrow> C \<Longrightarrow> C"
       by foo\<^sub>2
 
     lemma "C \<and> D \<Longrightarrow> A \<and> B \<Longrightarrow> A \<longrightarrow> C  \<Longrightarrow> C"
       by (foo\<^sub>2 | prop_solver)
 
 text \<open>
   In this example, the first lemma is solved by \<open>foo\<^sub>2\<close>, by first picking
   \<^term>\<open>A \<longrightarrow> D\<close> for \<open>I'\<close>, then backtracking and ultimately succeeding after
   picking \<^term>\<open>A \<longrightarrow> C\<close>. In the second lemma, however, \<^term>\<open>C \<and> D\<close> is
   matched first, the second pattern in the match cannot be found and so the
   method fails, falling through to @{method prop_solver}.
 
   More precise control is also possible by giving a positive number \<open>n\<close> as an
   argument to \<open>cut\<close>. This will limit the number of backtracking results of
   that match to be at most \<open>n\<close>. The match argument \<open>(cut 1)\<close> is the same as
   simply \<open>(cut)\<close>.
 \<close>
 
 
 subsection \<open>Multi-match revisited\<close>
 
 text \<open>
   A multi-match will produce a sequence of potential bindings for for-fixed
   variables, where each binding environment is the result of matching against
   at least one element from the match target. For each environment, the match
   result will be all elements of the match target which agree with the pattern
   under that environment. This can result in unexpected behaviour when giving
   very general patterns.
 \<close>
 
     lemma
       assumes asms: "\<And>x. A x \<and> B x"  "\<And>y. A y \<and> C y"  "\<And>z. B z \<and> C z"
       shows "A x \<and> C x"
       by (match asms in I: "\<And>x. P x \<and> ?Q x" (multi) for P \<Rightarrow>
          \<open>match (P) in "A" \<Rightarrow> \<open>fail\<close>
                        \<bar> _ \<Rightarrow> \<open>match I in "\<And>x. A x \<and> B x" \<Rightarrow> \<open>fail\<close>
                                                       \<bar> _ \<Rightarrow> \<open>rule I\<close>\<close>\<close>)
 
 text \<open>
   Intuitively it seems like this proof should fail to check. The first match
   result, which binds \<^term>\<open>I\<close> to the first two members of \<open>asms\<close>, fails the
   second inner match due to binding \<^term>\<open>P\<close> to \<^term>\<open>A\<close>. Backtracking then
   attempts to bind \<^term>\<open>I\<close> to the third member of \<open>asms\<close>. This passes all
   inner matches, but fails when @{method rule} cannot successfully apply this
   to the current goal. After this, a valid match that is produced by the
   unifier is one which binds \<^term>\<open>P\<close> to simply \<open>\<lambda>a. A ?x\<close>. The first inner
   match succeeds because \<open>\<lambda>a. A ?x\<close> does not match \<^term>\<open>A\<close>. The next inner
   match succeeds because \<^term>\<open>I\<close> has only been bound to the first member of
   \<open>asms\<close>. This is due to @{method match} considering \<open>\<lambda>a. A ?x\<close> and \<open>\<lambda>a. A ?y\<close>
   as distinct terms.
 
   The simplest way to address this is to explicitly disallow term bindings
   which we would consider invalid.
 \<close>
 
     method abs_used for P =
       (match (P) in "\<lambda>a. ?P" \<Rightarrow> \<open>fail\<close> \<bar> _ \<Rightarrow> \<open>-\<close>)
 
 text \<open>
   This method has no effect on the goal state, but instead serves as a filter
   on the environment produced from match.
 \<close>
 
 
 section \<open>Uncurrying\<close>
 
 text \<open>
   The @{method match} method is not aware of the logical content of match
   targets. Each pattern is simply matched against the shallow structure of a
   fact or term. Most facts are in \<^emph>\<open>normal form\<close>, which curries premises via
   meta-implication \<open>_ \<Longrightarrow> _\<close>.
 \<close>
 
     lemma
       assumes asms: "D \<Longrightarrow> B \<Longrightarrow> C"  "D \<Longrightarrow> A"
       shows "D \<Longrightarrow> B \<Longrightarrow> C \<and> A"
       by (match asms in H: "D \<Longrightarrow> _" (multi) \<Rightarrow> \<open>prop_solver elims: H\<close>)
 
 text \<open>
   For the first member of \<open>asms\<close> the dummy pattern successfully matches
   against \<^term>\<open>B \<Longrightarrow> C\<close> and so the proof is successful.
 \<close>
 
     lemma
       assumes asms: "A \<Longrightarrow> B \<Longrightarrow> C"  "D \<Longrightarrow> C"
       shows "D \<or> (A \<and> B) \<Longrightarrow> C"
       apply (match asms in H: "_ \<Longrightarrow> C" (multi) \<Rightarrow> \<open>prop_solver elims: H\<close>)(*<*)?
       apply (prop_solver elims: asms)
       done(*>*)
 
 text \<open>
   This proof will fail to solve the goal. Our match pattern will only match
   rules which have a single premise, and conclusion \<^term>\<open>C\<close>, so the first
   member of \<open>asms\<close> is not bound and thus the proof fails. Matching a pattern
   of the form \<^term>\<open>P \<Longrightarrow> Q\<close> against this fact will bind \<^term>\<open>P\<close> to
   \<^term>\<open>A\<close> and \<^term>\<open>Q\<close> to \<^term>\<open>B \<Longrightarrow> C\<close>. Our pattern, with a concrete
   \<^term>\<open>C\<close> in the conclusion, will fail to match this fact.
 
   To express our desired match, we may \<^emph>\<open>uncurry\<close> our rules before matching
   against them. This forms a meta-conjunction of all premises in a fact, so
   that only one implication remains. For example the uncurried version of
   \<^term>\<open>A \<Longrightarrow> B \<Longrightarrow> C\<close> is \<^term>\<open>A &&& B \<Longrightarrow> C\<close>. This will now match our
   desired pattern \<open>_ \<Longrightarrow> C\<close>, and can be \<^emph>\<open>curried\<close> after the match to put it
   back into normal form.
 \<close>
 
     lemma
       assumes asms: "A \<Longrightarrow> B \<Longrightarrow> C"  "D \<Longrightarrow> C"
       shows "D \<or> (A \<and> B) \<Longrightarrow> C"
       by (match asms [uncurry] in H [curry]: "_ \<Longrightarrow> C" (multi) \<Rightarrow>
           \<open>prop_solver elims: H\<close>)
 
 
 section \<open>Reverse matching\<close>
 
 text \<open>
   The @{method match} method only attempts to perform matching of the pattern
   against the match target. Specifically this means that it will not
   instantiate schematic terms in the match target.
 \<close>
 
     lemma
       assumes asms: "\<And>x :: 'a. A x"
       shows "A y"
       apply (match asms in H: "A y" \<Rightarrow> \<open>rule H\<close>)?
       apply (match asms in H: P for P \<Rightarrow>
           \<open>match ("A y") in P \<Rightarrow> \<open>rule H\<close>\<close>)
       done
 
 text \<open>
   In the first @{method match} we attempt to find a member of \<open>asms\<close> which
   matches our goal precisely. This fails due to no such member existing. The
   second match reverses the role of the fact in the match, by first giving a
   general pattern \<^term>\<open>P\<close>. This bound pattern is then matched against \<^term>\<open>A y\<close>. In this case, \<^term>\<open>P\<close> is bound to \<open>A ?x\<close> and so it successfully
   matches.
 \<close>
 
 
 section \<open>Type matching\<close>
 
 text \<open>
   The rule instantiation attributes @{attribute "where"} and @{attribute "of"}
   attempt to guarantee type-correctness wherever possible. This can require
   additional invocations of @{method match} in order to statically ensure that
   instantiation will succeed.
 \<close>
 
     lemma
       assumes asms: "\<And>x :: 'a. A x"
       shows "A y"
       by (match asms in H: "\<And>z :: 'b. P z" for P \<Rightarrow>
           \<open>match (y) in "y :: 'b" for y \<Rightarrow> \<open>rule H [where z = y]\<close>\<close>)
 
 text \<open>
   In this example the type \<open>'b\<close> is matched to \<open>'a\<close>, however statically they
   are formally distinct types. The first match binds \<open>'b\<close> while the inner
   match serves to coerce \<^term>\<open>y\<close> into having the type \<open>'b\<close>. This allows the
   rule instantiation to successfully apply.
 \<close>
 
 
 chapter \<open>Method development\<close>
 
 section \<open>Tracing methods\<close>
 
 text \<open>
   Method tracing is supported by auxiliary print methods provided by \<^theory>\<open>HOL-Eisbach.Eisbach_Tools\<close>. These include @{method print_fact}, @{method
   print_term} and @{method print_type}. Whenever a print method is evaluated
   it leaves the goal unchanged and writes its argument as tracing output.
 
   Print methods can be combined with the @{method fail} method to investigate
   the backtracking behaviour of a method.
 \<close>
 
     lemma
       assumes asms: A B C D
       shows D
       apply (match asms in H: _ \<Rightarrow> \<open>print_fact H, fail\<close>)(*<*)?
       apply (simp add: asms)
       done(*>*)
 
 text \<open>
   This proof will fail, but the tracing output will show the order that the
   assumptions are attempted.
 \<close>
 
 
 section \<open>Integrating with Isabelle/ML\<close>
 
 subsubsection \<open>Attributes\<close>
 
 text \<open>
   A custom rule attribute is a simple way to extend the functionality of
   Eisbach methods. The dummy rule attribute notation (\<open>[[ _ ]]\<close>) invokes the
   given attribute against a dummy fact and evaluates to the result of that
   attribute. When used as a match target, this can serve as an effective
   auxiliary function.
 \<close>
 
     attribute_setup get_split_rule =
       \<open>Args.term >> (fn t =>
         Thm.rule_attribute [] (fn context => fn _ =>
           (case get_split_rule (Context.proof_of context) t of
             SOME thm => thm
           | NONE => Drule.dummy_thm)))\<close>
 
 text \<open>
   In this example, the new attribute @{attribute get_split_rule} lifts the ML
   function of the same name into an attribute. When applied to a case
   distinction over a datatype, it retrieves its corresponding split rule.
 
   We can then integrate this into a method that applies the split rule, first
   matching to ensure that fetching the rule was successful.
 \<close>
 (*<*)declare TrueI [intros](*>*)
     method splits =
       (match conclusion in "?P f" for f \<Rightarrow>
         \<open>match [[get_split_rule f]] in U: "(_ :: bool) = _" \<Rightarrow>
           \<open>rule U [THEN iffD2]\<close>\<close>)
 
     lemma "L \<noteq> [] \<Longrightarrow> case L of [] \<Rightarrow> False | _ \<Rightarrow> True"
       apply splits
       apply (prop_solver intros: allI)
       done
 
 text \<open>
   Here the new @{method splits} method transforms the goal to use only logical
   connectives: \<^term>\<open>L = [] \<longrightarrow> False \<and> (\<forall>x y. L = x # y \<longrightarrow> True)\<close>. This goal
   is then in a form solvable by @{method prop_solver} when given the universal
   quantifier introduction rule \<open>allI\<close>.
 \<close>
 
 end
diff --git a/src/Doc/Eisbach/Preface.thy b/src/Doc/Eisbach/Preface.thy
--- a/src/Doc/Eisbach/Preface.thy
+++ b/src/Doc/Eisbach/Preface.thy
@@ -1,42 +1,42 @@
 (*:maxLineLen=78:*)
 
 theory Preface
 imports Base "HOL-Eisbach.Eisbach_Tools"
 begin
 
 text \<open>
   \<^emph>\<open>Eisbach\<close> is a collection of tools which form the basis for defining new
-  proof methods in Isabelle/Isar~@{cite "Wenzel-PhD"}. It can be thought of as
+  proof methods in Isabelle/Isar~\<^cite>\<open>"Wenzel-PhD"\<close>. It can be thought of as
   a ``proof method language'', but is more precisely an infrastructure for
   defining new proof methods out of existing ones.
 
   The core functionality of Eisbach is provided by the Isar @{command method}
   command. Here users may define new methods by combining existing ones with
   the usual Isar syntax. These methods can be abstracted over terms, facts and
   other methods, as one might expect in any higher-order functional language.
 
   Additional functionality is provided by extending the space of methods and
   attributes. The new @{method match} method allows for explicit control-flow,
   by taking a match target and a list of pattern-method pairs. By using the
   functionality provided by Eisbach, additional support methods can be easily
   written. For example, the @{method catch} method, which provides basic
   try-catch functionality, only requires a few lines of ML.
 
   Eisbach enables users to implement automated proof tools conveniently via
   Isabelle/Isar syntax. This is in contrast to the traditional approach to use
   Isabelle/ML (via @{command_ref method_setup}), which poses a higher
   barrier-to-entry for casual users.
 
   \<^medskip>
   This manual is written for readers familiar with Isabelle/Isar, but not
   necessarily Isabelle/ML. It covers the usage of the @{command method} as
   well as the @{method match} method, as well as discussing their integration
   with existing Isar concepts such as @{command named_theorems}.
 
   These commands are provided by theory \<^theory>\<open>HOL-Eisbach.Eisbach\<close>: it
   needs to be imported by all Eisbach applications. Theory
   \<^theory>\<open>HOL-Eisbach.Eisbach_Tools\<close> provides additional proof methods and
   attributes that are occasionally useful.
 \<close>
 
 end
diff --git a/src/Doc/Functions/Functions.thy b/src/Doc/Functions/Functions.thy
--- a/src/Doc/Functions/Functions.thy
+++ b/src/Doc/Functions/Functions.thy
@@ -1,1242 +1,1242 @@
 (*  Title:      Doc/Functions/Functions.thy
     Author:     Alexander Krauss, TU Muenchen
 
 Tutorial for function definitions with the new "function" package.
 *)
 
 theory Functions
 imports Main
 begin
 
 section \<open>Function Definitions for Dummies\<close>
 
 text \<open>
   In most cases, defining a recursive function is just as simple as other definitions:
 \<close>
 
 fun fib :: "nat \<Rightarrow> nat"
 where
   "fib 0 = 1"
 | "fib (Suc 0) = 1"
 | "fib (Suc (Suc n)) = fib n + fib (Suc n)"
 
 text \<open>
   The syntax is rather self-explanatory: We introduce a function by
   giving its name, its type, 
   and a set of defining recursive equations.
   If we leave out the type, the most general type will be
   inferred, which can sometimes lead to surprises: Since both \<^term>\<open>1::nat\<close> and \<open>+\<close> are overloaded, we would end up
   with \<open>fib :: nat \<Rightarrow> 'a::{one,plus}\<close>.
 \<close>
 
 text \<open>
   The function always terminates, since its argument gets smaller in
   every recursive call. 
   Since HOL is a logic of total functions, termination is a
   fundamental requirement to prevent inconsistencies\footnote{From the
   \qt{definition} \<open>f(n) = f(n) + 1\<close> we could prove 
   \<open>0 = 1\<close> by subtracting \<open>f(n)\<close> on both sides.}.
   Isabelle tries to prove termination automatically when a definition
   is made. In \S\ref{termination}, we will look at cases where this
   fails and see what to do then.
 \<close>
 
 subsection \<open>Pattern matching\<close>
 
 text \<open>\label{patmatch}
   Like in functional programming, we can use pattern matching to
   define functions. At the moment we will only consider \emph{constructor
   patterns}, which only consist of datatype constructors and
   variables. Furthermore, patterns must be linear, i.e.\ all variables
   on the left hand side of an equation must be distinct. In
   \S\ref{genpats} we discuss more general pattern matching.
 
   If patterns overlap, the order of the equations is taken into
   account. The following function inserts a fixed element between any
   two elements of a list:
 \<close>
 
 fun sep :: "'a \<Rightarrow> 'a list \<Rightarrow> 'a list"
 where
   "sep a (x#y#xs) = x # a # sep a (y # xs)"
 | "sep a xs       = xs"
 
 text \<open>
   Overlapping patterns are interpreted as \qt{increments} to what is
   already there: The second equation is only meant for the cases where
   the first one does not match. Consequently, Isabelle replaces it
   internally by the remaining cases, making the patterns disjoint:
 \<close>
 
 thm sep.simps
 
 text \<open>@{thm [display] sep.simps[no_vars]}\<close>
 
 text \<open>
   \noindent The equations from function definitions are automatically used in
   simplification:
 \<close>
 
 lemma "sep 0 [1, 2, 3] = [1, 0, 2, 0, 3]"
 by simp
 
 subsection \<open>Induction\<close>
 
 text \<open>
 
   Isabelle provides customized induction rules for recursive
   functions. These rules follow the recursive structure of the
   definition. Here is the rule @{thm [source] sep.induct} arising from the
   above definition of \<^const>\<open>sep\<close>:
 
   @{thm [display] sep.induct}
   
   We have a step case for list with at least two elements, and two
   base cases for the zero- and the one-element list. Here is a simple
   proof about \<^const>\<open>sep\<close> and \<^const>\<open>map\<close>
 \<close>
 
 lemma "map f (sep x ys) = sep (f x) (map f ys)"
 apply (induct x ys rule: sep.induct)
 
 text \<open>
   We get three cases, like in the definition.
 
   @{subgoals [display]}
 \<close>
 
 apply auto 
 done
 text \<open>
 
   With the \cmd{fun} command, you can define about 80\% of the
   functions that occur in practice. The rest of this tutorial explains
   the remaining 20\%.
 \<close>
 
 
 section \<open>fun vs.\ function\<close>
 
 text \<open>
   The \cmd{fun} command provides a
   convenient shorthand notation for simple function definitions. In
   this mode, Isabelle tries to solve all the necessary proof obligations
   automatically. If any proof fails, the definition is
   rejected. This can either mean that the definition is indeed faulty,
   or that the default proof procedures are just not smart enough (or
   rather: not designed) to handle the definition.
 
   By expanding the abbreviation to the more verbose \cmd{function} command, these proof obligations become visible and can be analyzed or
   solved manually. The expansion from \cmd{fun} to \cmd{function} is as follows:
 
 \end{isamarkuptext}
 
 
 \[\left[\;\begin{minipage}{0.25\textwidth}\vspace{6pt}
 \cmd{fun} \<open>f :: \<tau>\<close>\\%
 \cmd{where}\\%
 \hspace*{2ex}{\it equations}\\%
 \hspace*{2ex}\vdots\vspace*{6pt}
 \end{minipage}\right]
 \quad\equiv\quad
 \left[\;\begin{minipage}{0.48\textwidth}\vspace{6pt}
 \cmd{function} \<open>(\<close>\cmd{sequential}\<open>) f :: \<tau>\<close>\\%
 \cmd{where}\\%
 \hspace*{2ex}{\it equations}\\%
 \hspace*{2ex}\vdots\\%
 \cmd{by} \<open>pat_completeness auto\<close>\\%
 \cmd{termination by} \<open>lexicographic_order\<close>\vspace{6pt}
 \end{minipage}
 \right]\]
 
 \begin{isamarkuptext}
   \vspace*{1em}
   \noindent Some details have now become explicit:
 
   \begin{enumerate}
   \item The \cmd{sequential} option enables the preprocessing of
   pattern overlaps which we already saw. Without this option, the equations
   must already be disjoint and complete. The automatic completion only
   works with constructor patterns.
 
   \item A function definition produces a proof obligation which
   expresses completeness and compatibility of patterns (we talk about
   this later). The combination of the methods \<open>pat_completeness\<close> and
   \<open>auto\<close> is used to solve this proof obligation.
 
   \item A termination proof follows the definition, started by the
   \cmd{termination} command. This will be explained in \S\ref{termination}.
  \end{enumerate}
   Whenever a \cmd{fun} command fails, it is usually a good idea to
   expand the syntax to the more verbose \cmd{function} form, to see
   what is actually going on.
 \<close>
 
 
 section \<open>Termination\<close>
 
 text \<open>\label{termination}
   The method \<open>lexicographic_order\<close> is the default method for
   termination proofs. It can prove termination of a
   certain class of functions by searching for a suitable lexicographic
   combination of size measures. Of course, not all functions have such
   a simple termination argument. For them, we can specify the termination
   relation manually.
 \<close>
 
 subsection \<open>The {\tt relation} method\<close>
 text\<open>
   Consider the following function, which sums up natural numbers up to
   \<open>N\<close>, using a counter \<open>i\<close>:
 \<close>
 
 function sum :: "nat \<Rightarrow> nat \<Rightarrow> nat"
 where
   "sum i N = (if i > N then 0 else i + sum (Suc i) N)"
 by pat_completeness auto
 
 text \<open>
   \noindent The \<open>lexicographic_order\<close> method fails on this example, because none of the
   arguments decreases in the recursive call, with respect to the standard size ordering.
   To prove termination manually, we must provide a custom wellfounded relation.
 
   The termination argument for \<open>sum\<close> is based on the fact that
   the \emph{difference} between \<open>i\<close> and \<open>N\<close> gets
   smaller in every step, and that the recursion stops when \<open>i\<close>
   is greater than \<open>N\<close>. Phrased differently, the expression 
   \<open>N + 1 - i\<close> always decreases.
 
   We can use this expression as a measure function suitable to prove termination.
 \<close>
 
 termination sum
 apply (relation "measure (\<lambda>(i,N). N + 1 - i)")
 
 text \<open>
   The \cmd{termination} command sets up the termination goal for the
   specified function \<open>sum\<close>. If the function name is omitted, it
   implicitly refers to the last function definition.
 
   The \<open>relation\<close> method takes a relation of
   type \<^typ>\<open>('a \<times> 'a) set\<close>, where \<^typ>\<open>'a\<close> is the argument type of
   the function. If the function has multiple curried arguments, then
   these are packed together into a tuple, as it happened in the above
   example.
 
   The predefined function @{term[source] "measure :: ('a \<Rightarrow> nat) \<Rightarrow> ('a \<times> 'a) set"} constructs a
   wellfounded relation from a mapping into the natural numbers (a
   \emph{measure function}). 
 
   After the invocation of \<open>relation\<close>, we must prove that (a)
   the relation we supplied is wellfounded, and (b) that the arguments
   of recursive calls indeed decrease with respect to the
   relation:
 
   @{subgoals[display,indent=0]}
 
   These goals are all solved by \<open>auto\<close>:
 \<close>
 
 apply auto
 done
 
 text \<open>
   Let us complicate the function a little, by adding some more
   recursive calls: 
 \<close>
 
 function foo :: "nat \<Rightarrow> nat \<Rightarrow> nat"
 where
   "foo i N = (if i > N 
               then (if N = 0 then 0 else foo 0 (N - 1))
               else i + foo (Suc i) N)"
 by pat_completeness auto
 
 text \<open>
   When \<open>i\<close> has reached \<open>N\<close>, it starts at zero again
   and \<open>N\<close> is decremented.
   This corresponds to a nested
   loop where one index counts up and the other down. Termination can
   be proved using a lexicographic combination of two measures, namely
   the value of \<open>N\<close> and the above difference. The \<^const>\<open>measures\<close> combinator generalizes \<open>measure\<close> by taking a
   list of measure functions.  
 \<close>
 
 termination 
 by (relation "measures [\<lambda>(i, N). N, \<lambda>(i,N). N + 1 - i]") auto
 
 subsection \<open>How \<open>lexicographic_order\<close> works\<close>
 
 (*fun fails :: "nat \<Rightarrow> nat list \<Rightarrow> nat"
 where
   "fails a [] = a"
 | "fails a (x#xs) = fails (x + a) (x # xs)"
 *)
 
 text \<open>
   To see how the automatic termination proofs work, let's look at an
   example where it fails\footnote{For a detailed discussion of the
-  termination prover, see @{cite bulwahnKN07}}:
+  termination prover, see \<^cite>\<open>bulwahnKN07\<close>}:
 
 \end{isamarkuptext}  
 \cmd{fun} \<open>fails :: "nat \<Rightarrow> nat list \<Rightarrow> nat"\<close>\\%
 \cmd{where}\\%
 \hspace*{2ex}\<open>"fails a [] = a"\<close>\\%
 |\hspace*{1.5ex}\<open>"fails a (x#xs) = fails (x + a) (x#xs)"\<close>\\
 \begin{isamarkuptext}
 
 \noindent Isabelle responds with the following error:
 
 \begin{isabelle}
 *** Unfinished subgoals:\newline
 *** (a, 1, <):\newline
 *** \ 1.~\<open>\<And>x. x = 0\<close>\newline
 *** (a, 1, <=):\newline
 *** \ 1.~False\newline
 *** (a, 2, <):\newline
 *** \ 1.~False\newline
 *** Calls:\newline
 *** a) \<open>(a, x # xs) -->> (x + a, x # xs)\<close>\newline
 *** Measures:\newline
 *** 1) \<open>\<lambda>x. size (fst x)\<close>\newline
 *** 2) \<open>\<lambda>x. size (snd x)\<close>\newline
 *** Result matrix:\newline
 *** \ \ \ \ 1\ \ 2  \newline
 *** a:  ?   <= \newline
 *** Could not find lexicographic termination order.\newline
 *** At command "fun".\newline
 \end{isabelle}
 \<close>
 text \<open>
   The key to this error message is the matrix at the bottom. The rows
   of that matrix correspond to the different recursive calls (In our
   case, there is just one). The columns are the function's arguments 
   (expressed through different measure functions, which map the
   argument tuple to a natural number). 
 
   The contents of the matrix summarize what is known about argument
   descents: The second argument has a weak descent (\<open><=\<close>) at the
   recursive call, and for the first argument nothing could be proved,
   which is expressed by \<open>?\<close>. In general, there are the values
   \<open><\<close>, \<open><=\<close> and \<open>?\<close>.
 
   For the failed proof attempts, the unfinished subgoals are also
   printed. Looking at these will often point to a missing lemma.
 \<close>
 
 subsection \<open>The \<open>size_change\<close> method\<close>
 
 text \<open>
   Some termination goals that are beyond the powers of
   \<open>lexicographic_order\<close> can be solved automatically by the
   more powerful \<open>size_change\<close> method, which uses a variant of
   the size-change principle, together with some other
   techniques. While the details are discussed
-  elsewhere @{cite krauss_phd},
+  elsewhere \<^cite>\<open>krauss_phd\<close>,
   here are a few typical situations where
   \<open>lexicographic_order\<close> has difficulties and \<open>size_change\<close>
   may be worth a try:
   \begin{itemize}
   \item Arguments are permuted in a recursive call.
   \item Several mutually recursive functions with multiple arguments.
   \item Unusual control flow (e.g., when some recursive calls cannot
   occur in sequence).
   \end{itemize}
 
   Loading the theory \<open>Multiset\<close> makes the \<open>size_change\<close>
   method a bit stronger: it can then use multiset orders internally.
 \<close>
 
 subsection \<open>Configuring simplification rules for termination proofs\<close>
 
 text \<open>
   Since both \<open>lexicographic_order\<close> and \<open>size_change\<close> rely on the simplifier internally,
   there can sometimes be the need for adding additional simp rules to them.
   This can be done either as arguments to the methods themselves, or globally via the
   theorem attribute \<open>termination_simp\<close>, which is useful in rare cases.
 \<close>
 
 section \<open>Mutual Recursion\<close>
 
 text \<open>
   If two or more functions call one another mutually, they have to be defined
   in one step. Here are \<open>even\<close> and \<open>odd\<close>:
 \<close>
 
 function even :: "nat \<Rightarrow> bool"
     and odd  :: "nat \<Rightarrow> bool"
 where
   "even 0 = True"
 | "odd 0 = False"
 | "even (Suc n) = odd n"
 | "odd (Suc n) = even n"
 by pat_completeness auto
 
 text \<open>
   To eliminate the mutual dependencies, Isabelle internally
   creates a single function operating on the sum
   type \<^typ>\<open>nat + nat\<close>. Then, \<^const>\<open>even\<close> and \<^const>\<open>odd\<close> are
   defined as projections. Consequently, termination has to be proved
   simultaneously for both functions, by specifying a measure on the
   sum type: 
 \<close>
 
 termination 
 by (relation "measure (\<lambda>x. case x of Inl n \<Rightarrow> n | Inr n \<Rightarrow> n)") auto
 
 text \<open>
   We could also have used \<open>lexicographic_order\<close>, which
   supports mutual recursive termination proofs to a certain extent.
 \<close>
 
 subsection \<open>Induction for mutual recursion\<close>
 
 text \<open>
 
   When functions are mutually recursive, proving properties about them
   generally requires simultaneous induction. The induction rule @{thm [source] "even_odd.induct"}
   generated from the above definition reflects this.
 
   Let us prove something about \<^const>\<open>even\<close> and \<^const>\<open>odd\<close>:
 \<close>
 
 lemma even_odd_mod2:
   "even n = (n mod 2 = 0)"
   "odd n = (n mod 2 = 1)"
 
 text \<open>
   We apply simultaneous induction, specifying the induction variable
   for both goals, separated by \cmd{and}:\<close>
 
 apply (induct n and n rule: even_odd.induct)
 
 text \<open>
   We get four subgoals, which correspond to the clauses in the
   definition of \<^const>\<open>even\<close> and \<^const>\<open>odd\<close>:
   @{subgoals[display,indent=0]}
   Simplification solves the first two goals, leaving us with two
   statements about the \<open>mod\<close> operation to prove:
 \<close>
 
 apply simp_all
 
 text \<open>
   @{subgoals[display,indent=0]} 
 
   \noindent These can be handled by Isabelle's arithmetic decision procedures.
   
 \<close>
 
 apply arith
 apply arith
 done
 
 text \<open>
   In proofs like this, the simultaneous induction is really essential:
   Even if we are just interested in one of the results, the other
   one is necessary to strengthen the induction hypothesis. If we leave
   out the statement about \<^const>\<open>odd\<close> and just write \<^term>\<open>True\<close> instead,
   the same proof fails:
 \<close>
 
 lemma failed_attempt:
   "even n = (n mod 2 = 0)"
   "True"
 apply (induct n rule: even_odd.induct)
 
 text \<open>
   \noindent Now the third subgoal is a dead end, since we have no
   useful induction hypothesis available:
 
   @{subgoals[display,indent=0]} 
 \<close>
 
 oops
 
 section \<open>Elimination\<close>
 
 text \<open>
   A definition of function \<open>f\<close> gives rise to two kinds of elimination rules. Rule \<open>f.cases\<close>
   simply describes case analysis according to the patterns used in the definition:
 \<close>
 
 fun list_to_option :: "'a list \<Rightarrow> 'a option"
 where
   "list_to_option [x] = Some x"
 | "list_to_option _ = None"
 
 thm list_to_option.cases
 text \<open>
   @{thm[display] list_to_option.cases}
 
   Note that this rule does not mention the function at all, but only describes the cases used for
   defining it. In contrast, the rule @{thm[source] list_to_option.elims} also tell us what the function
   value will be in each case:
 \<close>
 thm list_to_option.elims
 text \<open>
   @{thm[display] list_to_option.elims}
 
   \noindent
   This lets us eliminate an assumption of the form \<^prop>\<open>list_to_option xs = y\<close> and replace it
   with the two cases, e.g.:
 \<close>
 
 lemma "list_to_option xs = y \<Longrightarrow> P"
 proof (erule list_to_option.elims)
   fix x assume "xs = [x]" "y = Some x" thus P sorry
 next
   assume "xs = []" "y = None" thus P sorry
 next
   fix a b xs' assume "xs = a # b # xs'" "y = None" thus P sorry
 qed
 
 
 text \<open>
   Sometimes it is convenient to derive specialized versions of the \<open>elim\<close> rules above and
   keep them around as facts explicitly. For example, it is natural to show that if 
   \<^prop>\<open>list_to_option xs = Some y\<close>, then \<^term>\<open>xs\<close> must be a singleton. The command 
   \cmd{fun\_cases} derives such facts automatically, by instantiating and simplifying the general 
   elimination rules given some pattern:
 \<close>
 
 fun_cases list_to_option_SomeE[elim]: "list_to_option xs = Some y"
 
 thm list_to_option_SomeE
 text \<open>
   @{thm[display] list_to_option_SomeE}
 \<close>
 
 
 section \<open>General pattern matching\<close>
 text\<open>\label{genpats}\<close>
 
 subsection \<open>Avoiding automatic pattern splitting\<close>
 
 text \<open>
 
   Up to now, we used pattern matching only on datatypes, and the
   patterns were always disjoint and complete, and if they weren't,
   they were made disjoint automatically like in the definition of
   \<^const>\<open>sep\<close> in \S\ref{patmatch}.
 
   This automatic splitting can significantly increase the number of
   equations involved, and this is not always desirable. The following
   example shows the problem:
   
   Suppose we are modeling incomplete knowledge about the world by a
   three-valued datatype, which has values \<^term>\<open>T\<close>, \<^term>\<open>F\<close>
   and \<^term>\<open>X\<close> for true, false and uncertain propositions, respectively. 
 \<close>
 
 datatype P3 = T | F | X
 
 text \<open>\noindent Then the conjunction of such values can be defined as follows:\<close>
 
 fun And :: "P3 \<Rightarrow> P3 \<Rightarrow> P3"
 where
   "And T p = p"
 | "And p T = p"
 | "And p F = F"
 | "And F p = F"
 | "And X X = X"
 
 
 text \<open>
   This definition is useful, because the equations can directly be used
   as simplification rules. But the patterns overlap: For example,
   the expression \<^term>\<open>And T T\<close> is matched by both the first and
   the second equation. By default, Isabelle makes the patterns disjoint by
   splitting them up, producing instances:
 \<close>
 
 thm And.simps
 
 text \<open>
   @{thm[indent=4] And.simps}
   
   \vspace*{1em}
   \noindent There are several problems with this:
 
   \begin{enumerate}
   \item If the datatype has many constructors, there can be an
   explosion of equations. For \<^const>\<open>And\<close>, we get seven instead of
   five equations, which can be tolerated, but this is just a small
   example.
 
   \item Since splitting makes the equations \qt{less general}, they
   do not always match in rewriting. While the term \<^term>\<open>And x F\<close>
   can be simplified to \<^term>\<open>F\<close> with the original equations, a
   (manual) case split on \<^term>\<open>x\<close> is now necessary.
 
   \item The splitting also concerns the induction rule @{thm [source]
   "And.induct"}. Instead of five premises it now has seven, which
   means that our induction proofs will have more cases.
 
   \item In general, it increases clarity if we get the same definition
   back which we put in.
   \end{enumerate}
 
   If we do not want the automatic splitting, we can switch it off by
   leaving out the \cmd{sequential} option. However, we will have to
   prove that our pattern matching is consistent\footnote{This prevents
   us from defining something like \<^term>\<open>f x = True\<close> and \<^term>\<open>f x
   = False\<close> simultaneously.}:
 \<close>
 
 function And2 :: "P3 \<Rightarrow> P3 \<Rightarrow> P3"
 where
   "And2 T p = p"
 | "And2 p T = p"
 | "And2 p F = F"
 | "And2 F p = F"
 | "And2 X X = X"
 
 text \<open>
   \noindent Now let's look at the proof obligations generated by a
   function definition. In this case, they are:
 
   @{subgoals[display,indent=0]}\vspace{-1.2em}\hspace{3cm}\vdots\vspace{1.2em}
 
   The first subgoal expresses the completeness of the patterns. It has
   the form of an elimination rule and states that every \<^term>\<open>x\<close> of
   the function's input type must match at least one of the patterns\footnote{Completeness could
   be equivalently stated as a disjunction of existential statements: 
 \<^term>\<open>(\<exists>p. x = (T, p)) \<or> (\<exists>p. x = (p, T)) \<or> (\<exists>p. x = (p, F)) \<or>
   (\<exists>p. x = (F, p)) \<or> (x = (X, X))\<close>, and you can use the method \<open>atomize_elim\<close> to get that form instead.}. If the patterns just involve
   datatypes, we can solve it with the \<open>pat_completeness\<close>
   method:
 \<close>
 
 apply pat_completeness
 
 text \<open>
   The remaining subgoals express \emph{pattern compatibility}. We do
   allow that an input value matches multiple patterns, but in this
   case, the result (i.e.~the right hand sides of the equations) must
   also be equal. For each pair of two patterns, there is one such
   subgoal. Usually this needs injectivity of the constructors, which
   is used automatically by \<open>auto\<close>.
 \<close>
 
 by auto
 termination by (relation "{}") simp
 
 
 subsection \<open>Non-constructor patterns\<close>
 
 text \<open>
   Most of Isabelle's basic types take the form of inductive datatypes,
   and usually pattern matching works on the constructors of such types. 
   However, this need not be always the case, and the \cmd{function}
   command handles other kind of patterns, too.
 
   One well-known instance of non-constructor patterns are
   so-called \emph{$n+k$-patterns}, which are a little controversial in
   the functional programming world. Here is the initial fibonacci
   example with $n+k$-patterns:
 \<close>
 
 function fib2 :: "nat \<Rightarrow> nat"
 where
   "fib2 0 = 1"
 | "fib2 1 = 1"
 | "fib2 (n + 2) = fib2 n + fib2 (Suc n)"
 
 text \<open>
   This kind of matching is again justified by the proof of pattern
   completeness and compatibility. 
   The proof obligation for pattern completeness states that every natural number is
   either \<^term>\<open>0::nat\<close>, \<^term>\<open>1::nat\<close> or \<^term>\<open>n +
   (2::nat)\<close>:
 
   @{subgoals[display,indent=0,goals_limit=1]}
 
   This is an arithmetic triviality, but unfortunately the
   \<open>arith\<close> method cannot handle this specific form of an
   elimination rule. However, we can use the method \<open>atomize_elim\<close> to do an ad-hoc conversion to a disjunction of
   existentials, which can then be solved by the arithmetic decision procedure.
   Pattern compatibility and termination are automatic as usual.
 \<close>
 apply atomize_elim
 apply arith
 apply auto
 done
 termination by lexicographic_order
 text \<open>
   We can stretch the notion of pattern matching even more. The
   following function is not a sensible functional program, but a
   perfectly valid mathematical definition:
 \<close>
 
 function ev :: "nat \<Rightarrow> bool"
 where
   "ev (2 * n) = True"
 | "ev (2 * n + 1) = False"
 apply atomize_elim
 by arith+
 termination by (relation "{}") simp
 
 text \<open>
   This general notion of pattern matching gives you a certain freedom
   in writing down specifications. However, as always, such freedom should
   be used with care:
 
   If we leave the area of constructor
   patterns, we have effectively departed from the world of functional
   programming. This means that it is no longer possible to use the
   code generator, and expect it to generate ML code for our
   definitions. Also, such a specification might not work very well together with
   simplification. Your mileage may vary.
 \<close>
 
 
 subsection \<open>Conditional equations\<close>
 
 text \<open>
   The function package also supports conditional equations, which are
   similar to guards in a language like Haskell. Here is Euclid's
   algorithm written with conditional patterns\footnote{Note that the
   patterns are also overlapping in the base case}:
 \<close>
 
 function gcd :: "nat \<Rightarrow> nat \<Rightarrow> nat"
 where
   "gcd x 0 = x"
 | "gcd 0 y = y"
 | "x < y \<Longrightarrow> gcd (Suc x) (Suc y) = gcd (Suc x) (y - x)"
 | "\<not> x < y \<Longrightarrow> gcd (Suc x) (Suc y) = gcd (x - y) (Suc y)"
 by (atomize_elim, auto, arith)
 termination by lexicographic_order
 
 text \<open>
   By now, you can probably guess what the proof obligations for the
   pattern completeness and compatibility look like. 
 
   Again, functions with conditional patterns are not supported by the
   code generator.
 \<close>
 
 
 subsection \<open>Pattern matching on strings\<close>
 
 text \<open>
   As strings (as lists of characters) are normal datatypes, pattern
   matching on them is possible, but somewhat problematic. Consider the
   following definition:
 
 \end{isamarkuptext}
 \noindent\cmd{fun} \<open>check :: "string \<Rightarrow> bool"\<close>\\%
 \cmd{where}\\%
 \hspace*{2ex}\<open>"check (''good'') = True"\<close>\\%
 \<open>| "check s = False"\<close>
 \begin{isamarkuptext}
 
   \noindent An invocation of the above \cmd{fun} command does not
   terminate. What is the problem? Strings are lists of characters, and
   characters are a datatype with a lot of constructors. Splitting the
   catch-all pattern thus leads to an explosion of cases, which cannot
   be handled by Isabelle.
 
   There are two things we can do here. Either we write an explicit
   \<open>if\<close> on the right hand side, or we can use conditional patterns:
 \<close>
 
 function check :: "string \<Rightarrow> bool"
 where
   "check (''good'') = True"
 | "s \<noteq> ''good'' \<Longrightarrow> check s = False"
 by auto
 termination by (relation "{}") simp
 
 
 section \<open>Partiality \label{sec:partiality}\<close>
 
 text \<open>
   In HOL, all functions are total. A function \<^term>\<open>f\<close> applied to
   \<^term>\<open>x\<close> always has the value \<^term>\<open>f x\<close>, and there is no notion
   of undefinedness. 
   This is why we have to do termination
   proofs when defining functions: The proof justifies that the
   function can be defined by wellfounded recursion.
 
   However, the \cmd{function} package does support partiality to a
   certain extent. Let's look at the following function which looks
   for a zero of a given function f. 
 \<close>
 
 function (*<*)(domintros)(*>*)findzero :: "(nat \<Rightarrow> nat) \<Rightarrow> nat \<Rightarrow> nat"
 where
   "findzero f n = (if f n = 0 then n else findzero f (Suc n))"
 by pat_completeness auto
 
 text \<open>
   \noindent Clearly, any attempt of a termination proof must fail. And without
   that, we do not get the usual rules \<open>findzero.simps\<close> and 
   \<open>findzero.induct\<close>. So what was the definition good for at all?
 \<close>
 
 subsection \<open>Domain predicates\<close>
 
 text \<open>
   The trick is that Isabelle has not only defined the function \<^const>\<open>findzero\<close>, but also
   a predicate \<^term>\<open>findzero_dom\<close> that characterizes the values where the function
   terminates: the \emph{domain} of the function. If we treat a
   partial function just as a total function with an additional domain
   predicate, we can derive simplification and
   induction rules as we do for total functions. They are guarded
   by domain conditions and are called \<open>psimps\<close> and \<open>pinduct\<close>: 
 \<close>
 
 text \<open>
   \noindent\begin{minipage}{0.79\textwidth}@{thm[display,margin=85] findzero.psimps}\end{minipage}
   \hfill(@{thm [source] "findzero.psimps"})
   \vspace{1em}
 
   \noindent\begin{minipage}{0.79\textwidth}@{thm[display,margin=85] findzero.pinduct}\end{minipage}
   \hfill(@{thm [source] "findzero.pinduct"})
 \<close>
 
 text \<open>
   Remember that all we
   are doing here is use some tricks to make a total function appear
   as if it was partial. We can still write the term \<^term>\<open>findzero
   (\<lambda>x. 1) 0\<close> and like any other term of type \<^typ>\<open>nat\<close> it is equal
   to some natural number, although we might not be able to find out
   which one. The function is \emph{underdefined}.
 
   But it is defined enough to prove something interesting about it. We
   can prove that if \<^term>\<open>findzero f n\<close>
   terminates, it indeed returns a zero of \<^term>\<open>f\<close>:
 \<close>
 
 lemma findzero_zero: "findzero_dom (f, n) \<Longrightarrow> f (findzero f n) = 0"
 
 text \<open>\noindent We apply induction as usual, but using the partial induction
   rule:\<close>
 
 apply (induct f n rule: findzero.pinduct)
 
 text \<open>\noindent This gives the following subgoals:
 
   @{subgoals[display,indent=0]}
 
   \noindent The hypothesis in our lemma was used to satisfy the first premise in
   the induction rule. However, we also get \<^term>\<open>findzero_dom (f, n)\<close> as a local assumption in the induction step. This
   allows unfolding \<^term>\<open>findzero f n\<close> using the \<open>psimps\<close>
   rule, and the rest is trivial.
 \<close>
 apply (simp add: findzero.psimps)
 done
 
 text \<open>
   Proofs about partial functions are often not harder than for total
   functions. Fig.~\ref{findzero_isar} shows a slightly more
   complicated proof written in Isar. It is verbose enough to show how
   partiality comes into play: From the partial induction, we get an
   additional domain condition hypothesis. Observe how this condition
   is applied when calls to \<^term>\<open>findzero\<close> are unfolded.
 \<close>
 
 text_raw \<open>
 \begin{figure}
 \hrule\vspace{6pt}
 \begin{minipage}{0.8\textwidth}
 \isabellestyle{it}
 \isastyle\isamarkuptrue
 \<close>
 lemma "\<lbrakk>findzero_dom (f, n); x \<in> {n ..< findzero f n}\<rbrakk> \<Longrightarrow> f x \<noteq> 0"
 proof (induct rule: findzero.pinduct)
   fix f n assume dom: "findzero_dom (f, n)"
                and IH: "\<lbrakk>f n \<noteq> 0; x \<in> {Suc n ..< findzero f (Suc n)}\<rbrakk> \<Longrightarrow> f x \<noteq> 0"
                and x_range: "x \<in> {n ..< findzero f n}"
   have "f n \<noteq> 0"
   proof 
     assume "f n = 0"
     with dom have "findzero f n = n" by (simp add: findzero.psimps)
     with x_range show False by auto
   qed
   
   from x_range have "x = n \<or> x \<in> {Suc n ..< findzero f n}" by auto
   thus "f x \<noteq> 0"
   proof
     assume "x = n"
     with \<open>f n \<noteq> 0\<close> show ?thesis by simp
   next
     assume "x \<in> {Suc n ..< findzero f n}"
     with dom and \<open>f n \<noteq> 0\<close> have "x \<in> {Suc n ..< findzero f (Suc n)}" by (simp add: findzero.psimps)
     with IH and \<open>f n \<noteq> 0\<close>
     show ?thesis by simp
   qed
 qed
 text_raw \<open>
 \isamarkupfalse\isabellestyle{tt}
 \end{minipage}\vspace{6pt}\hrule
 \caption{A proof about a partial function}\label{findzero_isar}
 \end{figure}
 \<close>
 
 subsection \<open>Partial termination proofs\<close>
 
 text \<open>
   Now that we have proved some interesting properties about our
   function, we should turn to the domain predicate and see if it is
   actually true for some values. Otherwise we would have just proved
   lemmas with \<^term>\<open>False\<close> as a premise.
 
   Essentially, we need some introduction rules for \<open>findzero_dom\<close>. The function package can prove such domain
   introduction rules automatically. But since they are not used very
   often (they are almost never needed if the function is total), this
   functionality is disabled by default for efficiency reasons. So we have to go
   back and ask for them explicitly by passing the \<open>(domintros)\<close> option to the function package:
 
 \vspace{1ex}
 \noindent\cmd{function} \<open>(domintros) findzero :: "(nat \<Rightarrow> nat) \<Rightarrow> nat \<Rightarrow> nat"\<close>\\%
 \cmd{where}\isanewline%
 \ \ \ldots\\
 
   \noindent Now the package has proved an introduction rule for \<open>findzero_dom\<close>:
 \<close>
 
 thm findzero.domintros
 
 text \<open>
   @{thm[display] findzero.domintros}
 
   Domain introduction rules allow to show that a given value lies in the
   domain of a function, if the arguments of all recursive calls
   are in the domain as well. They allow to do a \qt{single step} in a
   termination proof. Usually, you want to combine them with a suitable
   induction principle.
 
   Since our function increases its argument at recursive calls, we
   need an induction principle which works \qt{backwards}. We will use
   @{thm [source] inc_induct}, which allows to do induction from a fixed number
   \qt{downwards}:
 
   \begin{center}@{thm inc_induct}\hfill(@{thm [source] "inc_induct"})\end{center}
 
   Figure \ref{findzero_term} gives a detailed Isar proof of the fact
   that \<open>findzero\<close> terminates if there is a zero which is greater
   or equal to \<^term>\<open>n\<close>. First we derive two useful rules which will
   solve the base case and the step case of the induction. The
   induction is then straightforward, except for the unusual induction
   principle.
 
 \<close>
 
 text_raw \<open>
 \begin{figure}
 \hrule\vspace{6pt}
 \begin{minipage}{0.8\textwidth}
 \isabellestyle{it}
 \isastyle\isamarkuptrue
 \<close>
 lemma findzero_termination:
   assumes "x \<ge> n" and "f x = 0"
   shows "findzero_dom (f, n)"
 proof - 
   have base: "findzero_dom (f, x)"
     by (rule findzero.domintros) (simp add:\<open>f x = 0\<close>)
 
   have step: "\<And>i. findzero_dom (f, Suc i) 
     \<Longrightarrow> findzero_dom (f, i)"
     by (rule findzero.domintros) simp
 
   from \<open>x \<ge> n\<close> show ?thesis
   proof (induct rule:inc_induct)
     show "findzero_dom (f, x)" by (rule base)
   next
     fix i assume "findzero_dom (f, Suc i)"
     thus "findzero_dom (f, i)" by (rule step)
   qed
 qed      
 text_raw \<open>
 \isamarkupfalse\isabellestyle{tt}
 \end{minipage}\vspace{6pt}\hrule
 \caption{Termination proof for \<open>findzero\<close>}\label{findzero_term}
 \end{figure}
 \<close>
       
 text \<open>
   Again, the proof given in Fig.~\ref{findzero_term} has a lot of
   detail in order to explain the principles. Using more automation, we
   can also have a short proof:
 \<close>
 
 lemma findzero_termination_short:
   assumes zero: "x >= n" 
   assumes [simp]: "f x = 0"
   shows "findzero_dom (f, n)"
 using zero
 by (induct rule:inc_induct) (auto intro: findzero.domintros)
     
 text \<open>
   \noindent It is simple to combine the partial correctness result with the
   termination lemma:
 \<close>
 
 lemma findzero_total_correctness:
   "f x = 0 \<Longrightarrow> f (findzero f 0) = 0"
 by (blast intro: findzero_zero findzero_termination)
 
 subsection \<open>Definition of the domain predicate\<close>
 
 text \<open>
   Sometimes it is useful to know what the definition of the domain
   predicate looks like. Actually, \<open>findzero_dom\<close> is just an
   abbreviation:
 
   @{abbrev[display] findzero_dom}
 
   The domain predicate is the \emph{accessible part} of a relation \<^const>\<open>findzero_rel\<close>, which was also created internally by the function
   package. \<^const>\<open>findzero_rel\<close> is just a normal
   inductive predicate, so we can inspect its definition by
   looking at the introduction rules @{thm [source] findzero_rel.intros}.
   In our case there is just a single rule:
 
   @{thm[display] findzero_rel.intros}
 
   The predicate \<^const>\<open>findzero_rel\<close>
   describes the \emph{recursion relation} of the function
   definition. The recursion relation is a binary relation on
   the arguments of the function that relates each argument to its
   recursive calls. In general, there is one introduction rule for each
   recursive call.
 
   The predicate \<^term>\<open>Wellfounded.accp findzero_rel\<close> is the accessible part of
   that relation. An argument belongs to the accessible part, if it can
   be reached in a finite number of steps (cf.~its definition in \<open>Wellfounded.thy\<close>).
 
   Since the domain predicate is just an abbreviation, you can use
   lemmas for \<^const>\<open>Wellfounded.accp\<close> and \<^const>\<open>findzero_rel\<close> directly. Some
   lemmas which are occasionally useful are @{thm [source] accpI}, @{thm [source]
   accp_downward}, and of course the introduction and elimination rules
   for the recursion relation @{thm [source] "findzero_rel.intros"} and @{thm
   [source] "findzero_rel.cases"}.
 \<close>
 
 section \<open>Nested recursion\<close>
 
 text \<open>
   Recursive calls which are nested in one another frequently cause
   complications, since their termination proof can depend on a partial
   correctness property of the function itself. 
 
   As a small example, we define the \qt{nested zero} function:
 \<close>
 
 function nz :: "nat \<Rightarrow> nat"
 where
   "nz 0 = 0"
 | "nz (Suc n) = nz (nz n)"
 by pat_completeness auto
 
 text \<open>
   If we attempt to prove termination using the identity measure on
   naturals, this fails:
 \<close>
 
 termination
   apply (relation "measure (\<lambda>n. n)")
   apply auto
 
 text \<open>
   We get stuck with the subgoal
 
   @{subgoals[display]}
 
   Of course this statement is true, since we know that \<^const>\<open>nz\<close> is
   the zero function. And in fact we have no problem proving this
   property by induction.
 \<close>
 (*<*)oops(*>*)
 lemma nz_is_zero: "nz_dom n \<Longrightarrow> nz n = 0"
   by (induct rule:nz.pinduct) (auto simp: nz.psimps)
 
 text \<open>
   We formulate this as a partial correctness lemma with the condition
   \<^term>\<open>nz_dom n\<close>. This allows us to prove it with the \<open>pinduct\<close> rule before we have proved termination. With this lemma,
   the termination proof works as expected:
 \<close>
 
 termination
   by (relation "measure (\<lambda>n. n)") (auto simp: nz_is_zero)
 
 text \<open>
   As a general strategy, one should prove the statements needed for
   termination as a partial property first. Then they can be used to do
   the termination proof. This also works for less trivial
   examples. Figure \ref{f91} defines the 91-function, a well-known
   challenge problem due to John McCarthy, and proves its termination.
 \<close>
 
 text_raw \<open>
 \begin{figure}
 \hrule\vspace{6pt}
 \begin{minipage}{0.8\textwidth}
 \isabellestyle{it}
 \isastyle\isamarkuptrue
 \<close>
 
 function f91 :: "nat \<Rightarrow> nat"
 where
   "f91 n = (if 100 < n then n - 10 else f91 (f91 (n + 11)))"
 by pat_completeness auto
 
 lemma f91_estimate: 
   assumes trm: "f91_dom n" 
   shows "n < f91 n + 11"
 using trm by induct (auto simp: f91.psimps)
 
 termination
 proof
   let ?R = "measure (\<lambda>x. 101 - x)"
   show "wf ?R" ..
 
   fix n :: nat assume "\<not> 100 < n" \<comment> \<open>Assumptions for both calls\<close>
 
   thus "(n + 11, n) \<in> ?R" by simp \<comment> \<open>Inner call\<close>
 
   assume inner_trm: "f91_dom (n + 11)" \<comment> \<open>Outer call\<close>
   with f91_estimate have "n + 11 < f91 (n + 11) + 11" .
   with \<open>\<not> 100 < n\<close> show "(f91 (n + 11), n) \<in> ?R" by simp
 qed
 
 text_raw \<open>
 \isamarkupfalse\isabellestyle{tt}
 \end{minipage}
 \vspace{6pt}\hrule
 \caption{McCarthy's 91-function}\label{f91}
 \end{figure}
 \<close>
 
 
 section \<open>Higher-Order Recursion\<close>
 
 text \<open>
   Higher-order recursion occurs when recursive calls
   are passed as arguments to higher-order combinators such as \<^const>\<open>map\<close>, \<^term>\<open>filter\<close> etc.
   As an example, imagine a datatype of n-ary trees:
 \<close>
 
 datatype 'a tree = 
   Leaf 'a 
 | Branch "'a tree list"
 
 
 text \<open>\noindent We can define a function which swaps the left and right subtrees recursively, using the 
   list functions \<^const>\<open>rev\<close> and \<^const>\<open>map\<close>:\<close>
 
 fun mirror :: "'a tree \<Rightarrow> 'a tree"
 where
   "mirror (Leaf n) = Leaf n"
 | "mirror (Branch l) = Branch (rev (map mirror l))"
 
 text \<open>
   Although the definition is accepted without problems, let us look at the termination proof:
 \<close>
 
 termination proof
   text \<open>
 
   As usual, we have to give a wellfounded relation, such that the
   arguments of the recursive calls get smaller. But what exactly are
   the arguments of the recursive calls when mirror is given as an
   argument to \<^const>\<open>map\<close>? Isabelle gives us the
   subgoals
 
   @{subgoals[display,indent=0]} 
 
   So the system seems to know that \<^const>\<open>map\<close> only
   applies the recursive call \<^term>\<open>mirror\<close> to elements
   of \<^term>\<open>l\<close>, which is essential for the termination proof.
 
   This knowledge about \<^const>\<open>map\<close> is encoded in so-called congruence rules,
   which are special theorems known to the \cmd{function} command. The
   rule for \<^const>\<open>map\<close> is
 
   @{thm[display] map_cong}
 
   You can read this in the following way: Two applications of \<^const>\<open>map\<close> are equal, if the list arguments are equal and the functions
   coincide on the elements of the list. This means that for the value 
   \<^term>\<open>map f l\<close> we only have to know how \<^term>\<open>f\<close> behaves on
   the elements of \<^term>\<open>l\<close>.
 
   Usually, one such congruence rule is
   needed for each higher-order construct that is used when defining
   new functions. In fact, even basic functions like \<^const>\<open>If\<close> and \<^const>\<open>Let\<close> are handled by this mechanism. The congruence
   rule for \<^const>\<open>If\<close> states that the \<open>then\<close> branch is only
   relevant if the condition is true, and the \<open>else\<close> branch only if it
   is false:
 
   @{thm[display] if_cong}
   
   Congruence rules can be added to the
   function package by giving them the \<^term>\<open>fundef_cong\<close> attribute.
 
   The constructs that are predefined in Isabelle, usually
   come with the respective congruence rules.
   But if you define your own higher-order functions, you may have to
   state and prove the required congruence rules yourself, if you want to use your
   functions in recursive definitions. 
 \<close>
 (*<*)oops(*>*)
 
 subsection \<open>Congruence Rules and Evaluation Order\<close>
 
 text \<open>
   Higher order logic differs from functional programming languages in
   that it has no built-in notion of evaluation order. A program is
   just a set of equations, and it is not specified how they must be
   evaluated. 
 
   However for the purpose of function definition, we must talk about
   evaluation order implicitly, when we reason about termination.
   Congruence rules express that a certain evaluation order is
   consistent with the logical definition. 
 
   Consider the following function.
 \<close>
 
 function f :: "nat \<Rightarrow> bool"
 where
   "f n = (n = 0 \<or> f (n - 1))"
 (*<*)by pat_completeness auto(*>*)
 
 text \<open>
   For this definition, the termination proof fails. The default configuration
   specifies no congruence rule for disjunction. We have to add a
   congruence rule that specifies left-to-right evaluation order:
 
   \vspace{1ex}
   \noindent @{thm disj_cong}\hfill(@{thm [source] "disj_cong"})
   \vspace{1ex}
 
   Now the definition works without problems. Note how the termination
   proof depends on the extra condition that we get from the congruence
   rule.
 
   However, as evaluation is not a hard-wired concept, we
   could just turn everything around by declaring a different
   congruence rule. Then we can make the reverse definition:
 \<close>
 
 lemma disj_cong2[fundef_cong]: 
   "(\<not> Q' \<Longrightarrow> P = P') \<Longrightarrow> (Q = Q') \<Longrightarrow> (P \<or> Q) = (P' \<or> Q')"
   by blast
 
 fun f' :: "nat \<Rightarrow> bool"
 where
   "f' n = (f' (n - 1) \<or> n = 0)"
 
 text \<open>
   \noindent These examples show that, in general, there is no \qt{best} set of
   congruence rules.
 
   However, such tweaking should rarely be necessary in
   practice, as most of the time, the default set of congruence rules
   works well.
 \<close>
 
 end
diff --git a/src/Doc/Implementation/Eq.thy b/src/Doc/Implementation/Eq.thy
--- a/src/Doc/Implementation/Eq.thy
+++ b/src/Doc/Implementation/Eq.thy
@@ -1,139 +1,139 @@
 (*:maxLineLen=78:*)
 
 theory Eq
 imports Base
 begin
 
 chapter \<open>Equational reasoning\<close>
 
 text \<open>
   Equality is one of the most fundamental concepts of mathematics. The
   Isabelle/Pure logic (\chref{ch:logic}) provides a builtin relation \<open>\<equiv> :: \<alpha> \<Rightarrow>
   \<alpha> \<Rightarrow> prop\<close> that expresses equality of arbitrary terms (or propositions) at
   the framework level, as expressed by certain basic inference rules
   (\secref{sec:eq-rules}).
 
   Equational reasoning means to replace equals by equals, using reflexivity
   and transitivity to form chains of replacement steps, and congruence rules
   to access sub-structures. Conversions (\secref{sec:conv}) provide a
   convenient framework to compose basic equational steps to build specific
   equational reasoning tools.
 
   Higher-order matching is able to provide suitable instantiations for giving
   equality rules, which leads to the versatile concept of \<open>\<lambda>\<close>-term rewriting
   (\secref{sec:rewriting}). Internally this is based on the general-purpose
   Simplifier engine of Isabelle, which is more specific and more efficient
   than plain conversions.
 
   Object-logics usually introduce specific notions of equality or equivalence,
   and relate it with the Pure equality. This enables to re-use the Pure tools
   for equational reasoning for particular object-logic connectives as well.
 \<close>
 
 
 section \<open>Basic equality rules \label{sec:eq-rules}\<close>
 
 text \<open>
   Isabelle/Pure uses \<open>\<equiv>\<close> for equality of arbitrary terms, which includes
   equivalence of propositions of the logical framework. The conceptual
   axiomatization of the constant \<open>\<equiv> :: \<alpha> \<Rightarrow> \<alpha> \<Rightarrow> prop\<close> is given in
   \figref{fig:pure-equality}. The inference kernel presents slightly different
   equality rules, which may be understood as derived rules from this minimal
   axiomatization. The Pure theory also provides some theorems that express the
   same reasoning schemes as theorems that can be composed like object-level
   rules as explained in \secref{sec:obj-rules}.
 
   For example, \<^ML>\<open>Thm.symmetric\<close> as Pure inference is an ML function that
   maps a theorem \<open>th\<close> stating \<open>t \<equiv> u\<close> to one stating \<open>u \<equiv> t\<close>. In contrast,
   @{thm [source] Pure.symmetric} as Pure theorem expresses the same reasoning
   in declarative form. If used like \<open>th [THEN Pure.symmetric]\<close> in Isar source
   notation, it achieves a similar effect as the ML inference function,
   although the rule attribute @{attribute THEN} or ML operator \<^ML>\<open>op RS\<close>
   involve the full machinery of higher-order unification (modulo
   \<open>\<beta>\<eta>\<close>-conversion) and lifting of \<open>\<And>/\<Longrightarrow>\<close> contexts.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
   @{define_ML Thm.reflexive: "cterm -> thm"} \\
   @{define_ML Thm.symmetric: "thm -> thm"} \\
   @{define_ML Thm.transitive: "thm -> thm -> thm"} \\
   @{define_ML Thm.abstract_rule: "string -> cterm -> thm -> thm"} \\
   @{define_ML Thm.combination: "thm -> thm -> thm"} \\[0.5ex]
   @{define_ML Thm.equal_intr: "thm -> thm -> thm"} \\
   @{define_ML Thm.equal_elim: "thm -> thm -> thm"} \\
   \end{mldecls}
 
   See also \<^file>\<open>~~/src/Pure/thm.ML\<close> for further description of these inference
   rules, and a few more for primitive \<open>\<beta>\<close> and \<open>\<eta>\<close> conversions. Note that \<open>\<alpha>\<close>
   conversion is implicit due to the representation of terms with de-Bruijn
   indices (\secref{sec:terms}).
 \<close>
 
 
 section \<open>Conversions \label{sec:conv}\<close>
 
 text \<open>
-  The classic article @{cite "paulson:1983"} introduces the concept of
+  The classic article \<^cite>\<open>"paulson:1983"\<close> introduces the concept of
   conversion for Cambridge LCF. This was historically important to implement
   all kinds of ``simplifiers'', but the Isabelle Simplifier is done quite
-  differently, see @{cite \<open>\S9.3\<close> "isabelle-isar-ref"}.
+  differently, see \<^cite>\<open>\<open>\S9.3\<close> in "isabelle-isar-ref"\<close>.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
   @{define_ML_structure Conv} \\
   @{define_ML_type conv} \\
   @{define_ML Simplifier.asm_full_rewrite : "Proof.context -> conv"} \\
   \end{mldecls}
 
   \<^descr> \<^ML_structure>\<open>Conv\<close> is a library of combinators to build conversions,
   over type \<^ML_type>\<open>conv\<close> (see also \<^file>\<open>~~/src/Pure/conv.ML\<close>). This is one
   of the few Isabelle/ML modules that are usually used with \<^verbatim>\<open>open\<close>: finding
   examples works by searching for ``\<^verbatim>\<open>open Conv\<close>'' instead of ``\<^verbatim>\<open>Conv.\<close>''.
 
   \<^descr> \<^ML>\<open>Simplifier.asm_full_rewrite\<close> invokes the Simplifier as a
   conversion. There are a few related operations, corresponding to the various
   modes of simplification.
 \<close>
 
 
 section \<open>Rewriting \label{sec:rewriting}\<close>
 
 text \<open>
   Rewriting normalizes a given term (theorem or goal) by replacing instances
   of given equalities \<open>t \<equiv> u\<close> in subterms. Rewriting continues until no
   rewrites are applicable to any subterm. This may be used to unfold simple
   definitions of the form \<open>f x\<^sub>1 \<dots> x\<^sub>n \<equiv> u\<close>, but is slightly more general than
   that. \<close>
 
 text %mlref \<open>
   \begin{mldecls}
   @{define_ML rewrite_rule: "Proof.context -> thm list -> thm -> thm"} \\
   @{define_ML rewrite_goals_rule: "Proof.context -> thm list -> thm -> thm"} \\
   @{define_ML rewrite_goal_tac: "Proof.context -> thm list -> int -> tactic"} \\
   @{define_ML rewrite_goals_tac: "Proof.context -> thm list -> tactic"} \\
   @{define_ML fold_goals_tac: "Proof.context -> thm list -> tactic"} \\
   \end{mldecls}
 
   \<^descr> \<^ML>\<open>rewrite_rule\<close>~\<open>ctxt rules thm\<close> rewrites the whole theorem by the
   given rules.
 
   \<^descr> \<^ML>\<open>rewrite_goals_rule\<close>~\<open>ctxt rules thm\<close> rewrites the outer premises of
   the given theorem. Interpreting the same as a goal state
   (\secref{sec:tactical-goals}) it means to rewrite all subgoals (in the same
   manner as \<^ML>\<open>rewrite_goals_tac\<close>).
 
   \<^descr> \<^ML>\<open>rewrite_goal_tac\<close>~\<open>ctxt rules i\<close> rewrites subgoal \<open>i\<close> by the given
   rewrite rules.
 
   \<^descr> \<^ML>\<open>rewrite_goals_tac\<close>~\<open>ctxt rules\<close> rewrites all subgoals by the given
   rewrite rules.
 
   \<^descr> \<^ML>\<open>fold_goals_tac\<close>~\<open>ctxt rules\<close> essentially uses \<^ML>\<open>rewrite_goals_tac\<close>
   with the symmetric form of each member of \<open>rules\<close>, re-ordered to fold longer
   expression first. This supports to idea to fold primitive definitions that
   appear in expended form in the proof state.
 \<close>
 
 end
diff --git a/src/Doc/Implementation/Integration.thy b/src/Doc/Implementation/Integration.thy
--- a/src/Doc/Implementation/Integration.thy
+++ b/src/Doc/Implementation/Integration.thy
@@ -1,174 +1,174 @@
 (*:maxLineLen=78:*)
 
 theory Integration
 imports Base
 begin
 
 chapter \<open>System integration\<close>
 
 section \<open>Isar toplevel \label{sec:isar-toplevel}\<close>
 
 text \<open>
   The Isar \<^emph>\<open>toplevel state\<close> represents the outermost configuration that is
   transformed by a sequence of transitions (commands) within a theory body.
   This is a pure value with pure functions acting on it in a timeless and
   stateless manner. Historically, the sequence of transitions was wrapped up
   as sequential command loop, such that commands are applied one-by-one. In
   contemporary Isabelle/Isar, processing toplevel commands usually works in
-  parallel in multi-threaded Isabelle/ML @{cite "Wenzel:2009" and
-  "Wenzel:2013:ITP"}.
+  parallel in multi-threaded Isabelle/ML \<^cite>\<open>"Wenzel:2009" and
+  "Wenzel:2013:ITP"\<close>.
 \<close>
 
 
 subsection \<open>Toplevel state\<close>
 
 text \<open>
   The toplevel state is a disjoint sum of empty \<open>toplevel\<close>, or \<open>theory\<close>, or
   \<open>proof\<close>. The initial toplevel is empty; a theory is commenced by a @{command
   theory} header; within a theory we may use theory commands such as @{command
   definition}, or state a @{command theorem} to be proven. A proof state
   accepts a rich collection of Isar proof commands for structured proof
   composition, or unstructured proof scripts. When the proof is concluded we
   get back to the (local) theory, which is then updated by defining the
   resulting fact. Further theory declarations or theorem statements with
   proofs may follow, until we eventually conclude the theory development by
   issuing @{command end} to get back to the empty toplevel.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
   @{define_ML_type Toplevel.state} \\
   @{define_ML_exception Toplevel.UNDEF} \\
   @{define_ML Toplevel.is_toplevel: "Toplevel.state -> bool"} \\
   @{define_ML Toplevel.theory_of: "Toplevel.state -> theory"} \\
   @{define_ML Toplevel.proof_of: "Toplevel.state -> Proof.state"} \\
   \end{mldecls}
 
   \<^descr> Type \<^ML_type>\<open>Toplevel.state\<close> represents Isar toplevel states, which are
   normally manipulated through the concept of toplevel transitions only
   (\secref{sec:toplevel-transition}).
 
   \<^descr> \<^ML>\<open>Toplevel.UNDEF\<close> is raised for undefined toplevel operations. Many
   operations work only partially for certain cases, since \<^ML_type>\<open>Toplevel.state\<close> is a sum type.
 
   \<^descr> \<^ML>\<open>Toplevel.is_toplevel\<close>~\<open>state\<close> checks for an empty toplevel state.
 
   \<^descr> \<^ML>\<open>Toplevel.theory_of\<close>~\<open>state\<close> selects the background theory of \<open>state\<close>,
   it raises \<^ML>\<open>Toplevel.UNDEF\<close> for an empty toplevel state.
 
   \<^descr> \<^ML>\<open>Toplevel.proof_of\<close>~\<open>state\<close> selects the Isar proof state if available,
   otherwise it raises an error.
 \<close>
 
 text %mlantiq \<open>
   \begin{matharray}{rcl}
   @{ML_antiquotation_def "Isar.state"} & : & \<open>ML_antiquotation\<close> \\
   \end{matharray}
 
   \<^descr> \<open>@{Isar.state}\<close> refers to Isar toplevel state at that point --- as
   abstract value.
 
   This only works for diagnostic ML commands, such as @{command ML_val} or
   @{command ML_command}.
 \<close>
 
 
 subsection \<open>Toplevel transitions \label{sec:toplevel-transition}\<close>
 
 text \<open>
   An Isar toplevel transition consists of a partial function on the toplevel
   state, with additional information for diagnostics and error reporting:
   there are fields for command name, source position, and other meta-data.
 
   The operational part is represented as the sequential union of a list of
   partial functions, which are tried in turn until the first one succeeds.
   This acts like an outer case-expression for various alternative state
   transitions. For example, \<^theory_text>\<open>qed\<close> works differently for a local proofs vs.\
   the global ending of an outermost proof.
 
   Transitions are composed via transition transformers. Internally, Isar
   commands are put together from an empty transition extended by name and
   source position. It is then left to the individual command parser to turn
   the given concrete syntax into a suitable transition transformer that
   adjoins actual operations on a theory or proof state.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
   @{define_ML Toplevel.keep: "(Toplevel.state -> unit) ->
   Toplevel.transition -> Toplevel.transition"} \\
   @{define_ML Toplevel.theory: "(theory -> theory) ->
   Toplevel.transition -> Toplevel.transition"} \\
   @{define_ML Toplevel.theory_to_proof: "(theory -> Proof.state) ->
   Toplevel.transition -> Toplevel.transition"} \\
   @{define_ML Toplevel.proof: "(Proof.state -> Proof.state) ->
   Toplevel.transition -> Toplevel.transition"} \\
   @{define_ML Toplevel.proofs: "(Proof.state -> Proof.state Seq.result Seq.seq) ->
   Toplevel.transition -> Toplevel.transition"} \\
   @{define_ML Toplevel.end_proof: "(bool -> Proof.state -> Proof.context) ->
   Toplevel.transition -> Toplevel.transition"} \\
   \end{mldecls}
 
   \<^descr> \<^ML>\<open>Toplevel.keep\<close>~\<open>tr\<close> adjoins a diagnostic function.
 
   \<^descr> \<^ML>\<open>Toplevel.theory\<close>~\<open>tr\<close> adjoins a theory transformer.
 
   \<^descr> \<^ML>\<open>Toplevel.theory_to_proof\<close>~\<open>tr\<close> adjoins a global goal function, which
   turns a theory into a proof state. The theory may be changed before entering
   the proof; the generic Isar goal setup includes an \<^verbatim>\<open>after_qed\<close> argument
   that specifies how to apply the proven result to the enclosing context, when
   the proof is finished.
 
   \<^descr> \<^ML>\<open>Toplevel.proof\<close>~\<open>tr\<close> adjoins a deterministic proof command, with a
   singleton result.
 
   \<^descr> \<^ML>\<open>Toplevel.proofs\<close>~\<open>tr\<close> adjoins a general proof command, with zero or
   more result states (represented as a lazy list).
 
   \<^descr> \<^ML>\<open>Toplevel.end_proof\<close>~\<open>tr\<close> adjoins a concluding proof command, that
   returns the resulting theory, after applying the resulting facts to the
   target context.
 \<close>
 
 text %mlex \<open>
   The file \<^file>\<open>~~/src/HOL/Examples/Commands.thy\<close> shows some example Isar command
   definitions, with the all-important theory header declarations for outer
   syntax keywords.
 \<close>
 
 
 section \<open>Theory loader database\<close>
 
 text \<open>
   In batch mode and within dumped logic images, the theory database maintains
   a collection of theories as a directed acyclic graph. A theory may refer to
   other theories as @{keyword "imports"}, or to auxiliary files via special
   \<^emph>\<open>load commands\<close> (e.g.\ @{command ML_file}). For each theory, the base
   directory of its own theory file is called \<^emph>\<open>master directory\<close>: this is used
   as the relative location to refer to other files from that theory.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
   @{define_ML use_thy: "string -> unit"} \\
   @{define_ML Thy_Info.get_theory: "string -> theory"} \\
   @{define_ML Thy_Info.remove_thy: "string -> unit"} \\
   @{define_ML Thy_Info.register_thy: "theory -> unit"} \\
   \end{mldecls}
 
   \<^descr> \<^ML>\<open>use_thy\<close>~\<open>A\<close> ensures that theory \<open>A\<close> is fully up-to-date wrt.\ the
   external file store; outdated ancestors are reloaded on demand.
 
   \<^descr> \<^ML>\<open>Thy_Info.get_theory\<close>~\<open>A\<close> retrieves the theory value presently
   associated with name \<open>A\<close>. Note that the result might be outdated wrt.\ the
   file-system content.
 
   \<^descr> \<^ML>\<open>Thy_Info.remove_thy\<close>~\<open>A\<close> deletes theory \<open>A\<close> and all descendants from
   the theory database.
 
   \<^descr> \<^ML>\<open>Thy_Info.register_thy\<close>~\<open>text thy\<close> registers an existing theory value
   with the theory loader database and updates source version information
   according to the file store.
 \<close>
 
 end
diff --git a/src/Doc/Implementation/Isar.thy b/src/Doc/Implementation/Isar.thy
--- a/src/Doc/Implementation/Isar.thy
+++ b/src/Doc/Implementation/Isar.thy
@@ -1,547 +1,547 @@
 (*:maxLineLen=78:*)
 
 theory Isar
 imports Base
 begin
 
 chapter \<open>Isar language elements\<close>
 
 text \<open>
-  The Isar proof language (see also @{cite \<open>\S2\<close> "isabelle-isar-ref"})
+  The Isar proof language (see also \<^cite>\<open>\<open>\S2\<close> in "isabelle-isar-ref"\<close>)
   consists of three main categories of language elements:
 
   \<^enum> Proof \<^emph>\<open>commands\<close> define the primary language of transactions of the
   underlying Isar/VM interpreter. Typical examples are @{command "fix"},
   @{command "assume"}, @{command "show"}, @{command "proof"}, and @{command
   "qed"}.
 
   Composing proof commands according to the rules of the Isar/VM leads to
   expressions of structured proof text, such that both the machine and the
   human reader can give it a meaning as formal reasoning.
 
   \<^enum> Proof \<^emph>\<open>methods\<close> define a secondary language of mixed forward-backward
   refinement steps involving facts and goals. Typical examples are @{method
   rule}, @{method unfold}, and @{method simp}.
 
   Methods can occur in certain well-defined parts of the Isar proof language,
   say as arguments to @{command "proof"}, @{command "qed"}, or @{command
   "by"}.
 
   \<^enum> \<^emph>\<open>Attributes\<close> define a tertiary language of small annotations to theorems
   being defined or referenced. Attributes can modify both the context and the
   theorem.
 
   Typical examples are @{attribute intro} (which affects the context), and
   @{attribute symmetric} (which affects the theorem).
 \<close>
 
 
 section \<open>Proof commands\<close>
 
 text \<open>
   A \<^emph>\<open>proof command\<close> is state transition of the Isar/VM proof interpreter.
 
   In principle, Isar proof commands could be defined in user-space as well.
   The system is built like that in the first place: one part of the commands
   are primitive, the other part is defined as derived elements. Adding to the
   genuine structured proof language requires profound understanding of the
   Isar/VM machinery, though, so this is beyond the scope of this manual.
 
   What can be done realistically is to define some diagnostic commands that
   inspect the general state of the Isar/VM, and report some feedback to the
   user. Typically this involves checking of the linguistic \<^emph>\<open>mode\<close> of a proof
   state, or peeking at the pending goals (if available).
 
   Another common application is to define a toplevel command that poses a
   problem to the user as Isar proof state and processes the final result
   relatively to the context. Thus a proof can be incorporated into the context
   of some user-space tool, without modifying the Isar proof language itself.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
   @{define_ML_type Proof.state} \\
   @{define_ML Proof.assert_forward: "Proof.state -> Proof.state"} \\
   @{define_ML Proof.assert_chain: "Proof.state -> Proof.state"} \\
   @{define_ML Proof.assert_backward: "Proof.state -> Proof.state"} \\
   @{define_ML Proof.simple_goal: "Proof.state -> {context: Proof.context, goal: thm}"} \\
   @{define_ML Proof.goal: "Proof.state ->
   {context: Proof.context, facts: thm list, goal: thm}"} \\
   @{define_ML Proof.raw_goal: "Proof.state ->
   {context: Proof.context, facts: thm list, goal: thm}"} \\
   @{define_ML Proof.theorem: "Method.text option ->
   (thm list list -> Proof.context -> Proof.context) ->
   (term * term list) list list -> Proof.context -> Proof.state"} \\
   \end{mldecls}
 
   \<^descr> Type \<^ML_type>\<open>Proof.state\<close> represents Isar proof states. This is a
   block-structured configuration with proof context, linguistic mode, and
   optional goal. The latter consists of goal context, goal facts
   (``\<open>using\<close>''), and tactical goal state (see \secref{sec:tactical-goals}).
 
   The general idea is that the facts shall contribute to the refinement of
   some parts of the tactical goal --- how exactly is defined by the proof
   method that is applied in that situation.
 
   \<^descr> \<^ML>\<open>Proof.assert_forward\<close>, \<^ML>\<open>Proof.assert_chain\<close>, \<^ML>\<open>Proof.assert_backward\<close> are partial identity functions that fail unless a
   certain linguistic mode is active, namely ``\<open>proof(state)\<close>'',
   ``\<open>proof(chain)\<close>'', ``\<open>proof(prove)\<close>'', respectively (using the terminology
-  of @{cite "isabelle-isar-ref"}).
+  of \<^cite>\<open>"isabelle-isar-ref"\<close>).
 
   It is advisable study the implementations of existing proof commands for
   suitable modes to be asserted.
 
   \<^descr> \<^ML>\<open>Proof.simple_goal\<close>~\<open>state\<close> returns the structured Isar goal (if
   available) in the form seen by ``simple'' methods (like @{method simp} or
   @{method blast}). The Isar goal facts are already inserted as premises into
   the subgoals, which are presented individually as in \<^ML>\<open>Proof.goal\<close>.
 
   \<^descr> \<^ML>\<open>Proof.goal\<close>~\<open>state\<close> returns the structured Isar goal (if available)
   in the form seen by regular methods (like @{method rule}). The auxiliary
   internal encoding of Pure conjunctions is split into individual subgoals as
   usual.
 
   \<^descr> \<^ML>\<open>Proof.raw_goal\<close>~\<open>state\<close> returns the structured Isar goal (if
   available) in the raw internal form seen by ``raw'' methods (like @{method
   induct}). This form is rarely appropriate for diagnostic tools; \<^ML>\<open>Proof.simple_goal\<close> or \<^ML>\<open>Proof.goal\<close> should be used in most situations.
 
   \<^descr> \<^ML>\<open>Proof.theorem\<close>~\<open>before_qed after_qed statement ctxt\<close> initializes a
   toplevel Isar proof state within a given context.
 
   The optional \<open>before_qed\<close> method is applied at the end of the proof, just
   before extracting the result (this feature is rarely used).
 
   The \<open>after_qed\<close> continuation receives the extracted result in order to apply
   it to the final context in a suitable way (e.g.\ storing named facts). Note
   that at this generic level the target context is specified as \<^ML_type>\<open>Proof.context\<close>, but the usual wrapping of toplevel proofs into command
   transactions will provide a \<^ML_type>\<open>local_theory\<close> here
   (\chref{ch:local-theory}). This affects the way how results are stored.
 
   The \<open>statement\<close> is given as a nested list of terms, each associated with
   optional @{keyword "is"} patterns as usual in the Isar source language. The
   original nested list structure over terms is turned into one over theorems
   when \<open>after_qed\<close> is invoked.
 \<close>
 
 
 text %mlantiq \<open>
   \begin{matharray}{rcl}
   @{ML_antiquotation_def "Isar.goal"} & : & \<open>ML_antiquotation\<close> \\
   \end{matharray}
 
   \<^descr> \<open>@{Isar.goal}\<close> refers to the regular goal state (if available) of the
   current proof state managed by the Isar toplevel --- as abstract value.
 
   This only works for diagnostic ML commands, such as @{command ML_val} or
   @{command ML_command}.
 \<close>
 
 text %mlex \<open>
   The following example peeks at a certain goal configuration.
 \<close>
 
 notepad
 begin
   have A and B and C
     ML_val
      \<open>val n = Thm.nprems_of (#goal @{Isar.goal});
       \<^assert> (n = 3);\<close>
     sorry
 end
 
 text \<open>
   Here we see 3 individual subgoals in the same way as regular proof methods
   would do.
 \<close>
 
 
 section \<open>Proof methods\<close>
 
 text \<open>
   A \<open>method\<close> is a function \<open>thm\<^sup>* \<rightarrow> context * goal \<rightarrow> (context \<times> goal)\<^sup>*\<^sup>*\<close>
   that operates on the full Isar goal configuration with context, goal facts,
   and tactical goal state and enumerates possible follow-up goal states. Under
   normal circumstances, the goal context remains unchanged, but it is also
   possible to declare named extensions of the proof context (\<^emph>\<open>cases\<close>).
 
   This means a proof method is like a structurally enhanced tactic (cf.\
   \secref{sec:tactics}). The well-formedness conditions for tactics need to
   hold for methods accordingly, with the following additions.
 
   \<^item> Goal addressing is further limited either to operate uniformly on \<^emph>\<open>all\<close>
   subgoals, or specifically on the \<^emph>\<open>first\<close> subgoal.
 
   Exception: old-style tactic emulations that are embedded into the method
   space, e.g.\ @{method rule_tac}.
 
   \<^item> A non-trivial method always needs to make progress: an identical follow-up
   goal state has to be avoided.\<^footnote>\<open>This enables the user to write method
   expressions like \<open>meth\<^sup>+\<close> without looping, while the trivial do-nothing case
   can be recovered via \<open>meth\<^sup>?\<close>.\<close>
 
   Exception: trivial stuttering steps, such as ``@{method -}'' or @{method
   succeed}.
 
   \<^item> Goal facts passed to the method must not be ignored. If there is no
   sensible use of facts outside the goal state, facts should be inserted into
   the subgoals that are addressed by the method.
 
 
   \<^medskip>
   Syntactically, the language of proof methods appears as arguments to Isar
   commands like @{command "by"} or @{command apply}. User-space additions are
   reasonably easy by plugging suitable method-valued parser functions into the
   framework, using the @{command method_setup} command, for example.
 
   To get a better idea about the range of possibilities, consider the
   following Isar proof schemes. This is the general form of structured proof
   text:
 
   \<^medskip>
   \begin{tabular}{l}
   @{command from}~\<open>facts\<^sub>1\<close>~@{command have}~\<open>props\<close>~@{command using}~\<open>facts\<^sub>2\<close> \\
   @{command proof}~\<open>(initial_method)\<close> \\
   \quad\<open>body\<close> \\
   @{command qed}~\<open>(terminal_method)\<close> \\
   \end{tabular}
   \<^medskip>
 
   The goal configuration consists of \<open>facts\<^sub>1\<close> and \<open>facts\<^sub>2\<close> appended in that
   order, and various \<open>props\<close> being claimed. The \<open>initial_method\<close> is invoked
   with facts and goals together and refines the problem to something that is
   handled recursively in the proof \<open>body\<close>. The \<open>terminal_method\<close> has another
   chance to finish any remaining subgoals, but it does not see the facts of
   the initial step.
 
   \<^medskip>
   This pattern illustrates unstructured proof scripts:
 
   \<^medskip>
   \begin{tabular}{l}
   @{command have}~\<open>props\<close> \\
   \quad@{command using}~\<open>facts\<^sub>1\<close>~@{command apply}~\<open>method\<^sub>1\<close> \\
   \quad@{command apply}~\<open>method\<^sub>2\<close> \\
   \quad@{command using}~\<open>facts\<^sub>3\<close>~@{command apply}~\<open>method\<^sub>3\<close> \\
   \quad@{command done} \\
   \end{tabular}
   \<^medskip>
 
   The \<open>method\<^sub>1\<close> operates on the original claim while using \<open>facts\<^sub>1\<close>. Since
   the @{command apply} command structurally resets the facts, the \<open>method\<^sub>2\<close>
   will operate on the remaining goal state without facts. The \<open>method\<^sub>3\<close> will
   see again a collection of \<open>facts\<^sub>3\<close> that has been inserted into the script
   explicitly.
 
   \<^medskip>
   Empirically, any Isar proof method can be categorized as follows.
 
     \<^enum> \<^emph>\<open>Special method with cases\<close> with named context additions associated
     with the follow-up goal state.
 
     Example: @{method "induct"}, which is also a ``raw'' method since it
     operates on the internal representation of simultaneous claims as Pure
     conjunction (\secref{sec:logic-aux}), instead of separate subgoals
     (\secref{sec:tactical-goals}).
 
     \<^enum> \<^emph>\<open>Structured method\<close> with strong emphasis on facts outside the goal
     state.
 
     Example: @{method "rule"}, which captures the key ideas behind structured
     reasoning in Isar in its purest form.
 
     \<^enum> \<^emph>\<open>Simple method\<close> with weaker emphasis on facts, which are inserted into
     subgoals to emulate old-style tactical ``premises''.
 
     Examples: @{method "simp"}, @{method "blast"}, @{method "auto"}.
 
     \<^enum> \<^emph>\<open>Old-style tactic emulation\<close> with detailed numeric goal addressing and
     explicit references to entities of the internal goal state (which are
     otherwise invisible from proper Isar proof text). The naming convention
     \<open>foo_tac\<close> makes this special non-standard status clear.
 
     Example: @{method "rule_tac"}.
 
   When implementing proof methods, it is advisable to study existing
   implementations carefully and imitate the typical ``boiler plate'' for
   context-sensitive parsing and further combinators to wrap-up tactic
   expressions as methods.\<^footnote>\<open>Aliases or abbreviations of the standard method
   combinators should be avoided. Note that from Isabelle99 until Isabelle2009
   the system did provide various odd combinations of method syntax wrappers
   that made applications more complicated than necessary.\<close>
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
   @{define_ML_type Proof.method} \\
   @{define_ML CONTEXT_METHOD: "(thm list -> context_tactic) -> Proof.method"} \\
   @{define_ML METHOD: "(thm list -> tactic) -> Proof.method"} \\
   @{define_ML SIMPLE_METHOD: "tactic -> Proof.method"} \\
   @{define_ML SIMPLE_METHOD': "(int -> tactic) -> Proof.method"} \\
   @{define_ML Method.insert_tac: "Proof.context -> thm list -> int -> tactic"} \\
   @{define_ML Method.setup: "binding -> (Proof.context -> Proof.method) context_parser ->
   string -> theory -> theory"} \\
   \end{mldecls}
 
   \<^descr> Type \<^ML_type>\<open>Proof.method\<close> represents proof methods as abstract type.
 
   \<^descr> \<^ML>\<open>CONTEXT_METHOD\<close>~\<open>(fn facts => context_tactic)\<close> wraps \<open>context_tactic\<close>
   depending on goal facts as a general proof method that may change the proof
   context dynamically. A typical operation is \<^ML>\<open>Proof_Context.update_cases\<close>, which is wrapped up as combinator @{define_ML
   CONTEXT_CASES} for convenience.
 
   \<^descr> \<^ML>\<open>METHOD\<close>~\<open>(fn facts => tactic)\<close> wraps \<open>tactic\<close> depending on goal facts
   as regular proof method; the goal context is passed via method syntax.
 
   \<^descr> \<^ML>\<open>SIMPLE_METHOD\<close>~\<open>tactic\<close> wraps a tactic that addresses all subgoals
   uniformly as simple proof method. Goal facts are already inserted into all
   subgoals before \<open>tactic\<close> is applied.
 
   \<^descr> \<^ML>\<open>SIMPLE_METHOD'\<close>~\<open>tactic\<close> wraps a tactic that addresses a specific
   subgoal as simple proof method that operates on subgoal 1. Goal facts are
   inserted into the subgoal then the \<open>tactic\<close> is applied.
 
   \<^descr> \<^ML>\<open>Method.insert_tac\<close>~\<open>ctxt facts i\<close> inserts \<open>facts\<close> into subgoal \<open>i\<close>.
   This is convenient to reproduce part of the \<^ML>\<open>SIMPLE_METHOD\<close> or \<^ML>\<open>SIMPLE_METHOD'\<close> wrapping within regular \<^ML>\<open>METHOD\<close>, for example.
 
   \<^descr> \<^ML>\<open>Method.setup\<close>~\<open>name parser description\<close> provides the functionality of
   the Isar command @{command method_setup} as ML function.
 \<close>
 
 text %mlex \<open>
-  See also @{command method_setup} in @{cite "isabelle-isar-ref"} which
+  See also @{command method_setup} in \<^cite>\<open>"isabelle-isar-ref"\<close> which
   includes some abstract examples.
 
   \<^medskip>
   The following toy examples illustrate how the goal facts and state are
   passed to proof methods. The predefined proof method called ``@{method
   tactic}'' wraps ML source of type \<^ML_type>\<open>tactic\<close> (abstracted over
   \<^ML_text>\<open>facts\<close>). This allows immediate experimentation without parsing of
   concrete syntax.
 \<close>
 
 notepad
 begin
   fix A B :: bool
   assume a: A and b: B
 
   have "A \<and> B"
     apply (tactic \<open>resolve_tac \<^context> @{thms conjI} 1\<close>)
     using a apply (tactic \<open>resolve_tac \<^context> facts 1\<close>)
     using b apply (tactic \<open>resolve_tac \<^context> facts 1\<close>)
     done
 
   have "A \<and> B"
     using a and b
     ML_val \<open>@{Isar.goal}\<close>
     apply (tactic \<open>Method.insert_tac \<^context> facts 1\<close>)
     apply (tactic \<open>(resolve_tac \<^context> @{thms conjI} THEN_ALL_NEW assume_tac \<^context>) 1\<close>)
     done
 end
 
 text \<open>
   \<^medskip>
   The next example implements a method that simplifies the first subgoal by
   rewrite rules that are given as arguments.
 \<close>
 
 method_setup my_simp =
   \<open>Attrib.thms >> (fn thms => fn ctxt =>
     SIMPLE_METHOD' (fn i =>
       CHANGED (asm_full_simp_tac
         (put_simpset HOL_basic_ss ctxt addsimps thms) i)))\<close>
   "rewrite subgoal by given rules"
 
 text \<open>
   The concrete syntax wrapping of @{command method_setup} always
   passes-through the proof context at the end of parsing, but it is not used
   in this example.
 
   The \<^ML>\<open>Attrib.thms\<close> parser produces a list of theorems from the usual Isar
   syntax involving attribute expressions etc.\ (syntax category @{syntax
-  thms}) @{cite "isabelle-isar-ref"}. The resulting \<^ML_text>\<open>thms\<close> are
+  thms}) \<^cite>\<open>"isabelle-isar-ref"\<close>. The resulting \<^ML_text>\<open>thms\<close> are
   added to \<^ML>\<open>HOL_basic_ss\<close> which already contains the basic Simplifier
   setup for HOL.
 
   The tactic \<^ML>\<open>asm_full_simp_tac\<close> is the one that is also used in method
   @{method simp} by default. The extra wrapping by the \<^ML>\<open>CHANGED\<close> tactical
   ensures progress of simplification: identical goal states are filtered out
   explicitly to make the raw tactic conform to standard Isar method behaviour.
 
   \<^medskip>
   Method @{method my_simp} can be used in Isar proofs like this:
 \<close>
 
 notepad
 begin
   fix a b c :: 'a
   assume a: "a = b"
   assume b: "b = c"
   have "a = c" by (my_simp a b)
 end
 
 text \<open>
   Here is a similar method that operates on all subgoals, instead of just the
   first one.\<close>
 
 method_setup my_simp_all =
   \<open>Attrib.thms >> (fn thms => fn ctxt =>
     SIMPLE_METHOD
       (CHANGED
         (ALLGOALS (asm_full_simp_tac
           (put_simpset HOL_basic_ss ctxt addsimps thms)))))\<close>
   "rewrite all subgoals by given rules"
 
 notepad
 begin
   fix a b c :: 'a
   assume a: "a = b"
   assume b: "b = c"
   have "a = c" and "c = b" by (my_simp_all a b)
 end
 
 text \<open>
   \<^medskip>
   Apart from explicit arguments, common proof methods typically work with a
   default configuration provided by the context. As a shortcut to rule
   management we use a cheap solution via the @{command named_theorems} command
   to declare a dynamic fact in the context.
 \<close>
 
 named_theorems my_simp
 
 text \<open>
   The proof method is now defined as before, but we append the explicit
   arguments and the rules from the context.
 \<close>
 
 method_setup my_simp' =
   \<open>Attrib.thms >> (fn thms => fn ctxt =>
     let
       val my_simps = Named_Theorems.get ctxt \<^named_theorems>\<open>my_simp\<close>
     in
       SIMPLE_METHOD' (fn i =>
         CHANGED (asm_full_simp_tac
           (put_simpset HOL_basic_ss ctxt
             addsimps (thms @ my_simps)) i))
     end)\<close>
   "rewrite subgoal by given rules and my_simp rules from the context"
 
 text \<open>
   \<^medskip>
   Method @{method my_simp'} can be used in Isar proofs like this:
 \<close>
 
 notepad
 begin
   fix a b c :: 'a
   assume [my_simp]: "a \<equiv> b"
   assume [my_simp]: "b \<equiv> c"
   have "a \<equiv> c" by my_simp'
 end
 
 text \<open>
   \<^medskip>
   The @{method my_simp} variants defined above are ``simple'' methods, i.e.\
   the goal facts are merely inserted as goal premises by the \<^ML>\<open>SIMPLE_METHOD'\<close> or \<^ML>\<open>SIMPLE_METHOD\<close> wrapper. For proof methods that are
   similar to the standard collection of @{method simp}, @{method blast},
   @{method fast}, @{method auto} there is little more that can be done.
 
   Note that using the primary goal facts in the same manner as the method
   arguments obtained via concrete syntax or the context does not meet the
   requirement of ``strong emphasis on facts'' of regular proof methods,
   because rewrite rules as used above can be easily ignored. A proof text
   ``@{command using}~\<open>foo\<close>~@{command "by"}~\<open>my_simp\<close>'' where \<open>foo\<close> is not used
   would deceive the reader.
 
   \<^medskip>
   The technical treatment of rules from the context requires further
   attention. Above we rebuild a fresh \<^ML_type>\<open>simpset\<close> from the arguments
   and \<^emph>\<open>all\<close> rules retrieved from the context on every invocation of the
   method. This does not scale to really large collections of rules, which
   easily emerges in the context of a big theory library, for example.
 
   This is an inherent limitation of the simplistic rule management via
   @{command named_theorems}, because it lacks tool-specific storage and
   retrieval. More realistic applications require efficient index-structures
   that organize theorems in a customized manner, such as a discrimination net
   that is indexed by the left-hand sides of rewrite rules. For variations on
   the Simplifier, re-use of the existing type \<^ML_type>\<open>simpset\<close> is adequate,
   but scalability would require it be maintained statically within the context
   data, not dynamically on each tool invocation.
 \<close>
 
 
 section \<open>Attributes \label{sec:attributes}\<close>
 
 text \<open>
   An \<^emph>\<open>attribute\<close> is a function \<open>context \<times> thm \<rightarrow> context \<times> thm\<close>, which means
   both a (generic) context and a theorem can be modified simultaneously. In
   practice this mixed form is very rare, instead attributes are presented
   either as \<^emph>\<open>declaration attribute:\<close> \<open>thm \<rightarrow> context \<rightarrow> context\<close> or \<^emph>\<open>rule
   attribute:\<close> \<open>context \<rightarrow> thm \<rightarrow> thm\<close>.
 
   Attributes can have additional arguments via concrete syntax. There is a
   collection of context-sensitive parsers for various logical entities (types,
   terms, theorems). These already take care of applying morphisms to the
   arguments when attribute expressions are moved into a different context (see
   also \secref{sec:morphisms}).
 
   When implementing declaration attributes, it is important to operate exactly
   on the variant of the generic context that is provided by the system, which
   is either global theory context or local proof context. In particular, the
   background theory of a local context must not be modified in this
   situation!
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
   @{define_ML_type attribute} \\
   @{define_ML Thm.rule_attribute: "thm list ->
   (Context.generic -> thm -> thm) -> attribute"} \\
   @{define_ML Thm.declaration_attribute: "
   (thm -> Context.generic -> Context.generic) -> attribute"} \\
   @{define_ML Attrib.setup: "binding -> attribute context_parser ->
   string -> theory -> theory"} \\
   \end{mldecls}
 
   \<^descr> Type \<^ML_type>\<open>attribute\<close> represents attributes as concrete type alias.
 
   \<^descr> \<^ML>\<open>Thm.rule_attribute\<close>~\<open>thms (fn context => rule)\<close> wraps a
   context-dependent rule (mapping on \<^ML_type>\<open>thm\<close>) as attribute.
 
   The \<open>thms\<close> are additional parameters: when forming an abstract closure, the
   system may provide dummy facts that are propagated according to strict
   evaluation discipline. In that case, \<open>rule\<close> is bypassed.
 
   \<^descr> \<^ML>\<open>Thm.declaration_attribute\<close>~\<open>(fn thm => decl)\<close> wraps a
   theorem-dependent declaration (mapping on \<^ML_type>\<open>Context.generic\<close>) as
   attribute.
 
   When forming an abstract closure, the system may provide a dummy fact as
   \<open>thm\<close>. In that case, \<open>decl\<close> is bypassed.
 
   \<^descr> \<^ML>\<open>Attrib.setup\<close>~\<open>name parser description\<close> provides the functionality of
   the Isar command @{command attribute_setup} as ML function.
 \<close>
 
 text %mlantiq \<open>
   \begin{matharray}{rcl}
   @{ML_antiquotation_def attributes} & : & \<open>ML_antiquotation\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
   @@{ML_antiquotation attributes} attributes
   \<close>
 
   \<^descr> \<open>@{attributes [\<dots>]}\<close> embeds attribute source representation into the ML
   text, which is particularly useful with declarations like \<^ML>\<open>Local_Theory.note\<close>. Attribute names are internalized at compile time, but
   the source is unevaluated. This means attributes with formal arguments
   (types, terms, theorems) may be subject to odd effects of dynamic scoping!
 \<close>
 
 text %mlex \<open>
-  See also @{command attribute_setup} in @{cite "isabelle-isar-ref"} which
+  See also @{command attribute_setup} in \<^cite>\<open>"isabelle-isar-ref"\<close> which
   includes some abstract examples.
 \<close>
 
 end
diff --git a/src/Doc/Implementation/Local_Theory.thy b/src/Doc/Implementation/Local_Theory.thy
--- a/src/Doc/Implementation/Local_Theory.thy
+++ b/src/Doc/Implementation/Local_Theory.thy
@@ -1,149 +1,149 @@
 (*:maxLineLen=78:*)
 
 theory Local_Theory
 imports Base
 begin
 
 chapter \<open>Local theory specifications \label{ch:local-theory}\<close>
 
 text \<open>
   A \<^emph>\<open>local theory\<close> combines aspects of both theory and proof context (cf.\
   \secref{sec:context}), such that definitional specifications may be given
   relatively to parameters and assumptions. A local theory is represented as a
   regular proof context, augmented by administrative data about the \<^emph>\<open>target
   context\<close>.
 
   The target is usually derived from the background theory by adding local
   \<open>\<FIX>\<close> and \<open>\<ASSUME>\<close> elements, plus suitable modifications of
   non-logical context data (e.g.\ a special type-checking discipline). Once
   initialized, the target is ready to absorb definitional primitives:
   \<open>\<DEFINE>\<close> for terms and \<open>\<NOTE>\<close> for theorems. Such definitions may get
   transformed in a target-specific way, but the programming interface hides
   such details.
 
   Isabelle/Pure provides target mechanisms for locales, type-classes,
   type-class instantiations, and general overloading. In principle, users can
   implement new targets as well, but this rather arcane discipline is beyond
   the scope of this manual. In contrast, implementing derived definitional
   packages to be used within a local theory context is quite easy: the
   interfaces are even simpler and more abstract than the underlying primitives
   for raw theories.
 
   Many definitional packages for local theories are available in Isabelle.
   Although a few old packages only work for global theories, the standard way
   of implementing definitional packages in Isabelle is via the local theory
   interface.
 \<close>
 
 
 section \<open>Definitional elements\<close>
 
 text \<open>
   There are separate elements \<open>\<DEFINE> c \<equiv> t\<close> for terms, and \<open>\<NOTE> b =
   thm\<close> for theorems. Types are treated implicitly, according to Hindley-Milner
   discipline (cf.\ \secref{sec:variables}). These definitional primitives
   essentially act like \<open>let\<close>-bindings within a local context that may already
   contain earlier \<open>let\<close>-bindings and some initial \<open>\<lambda>\<close>-bindings. Thus we gain
   \<^emph>\<open>dependent definitions\<close> that are relative to an initial axiomatic context.
   The following diagram illustrates this idea of axiomatic elements versus
   definitional elements:
 
   \begin{center}
   \begin{tabular}{|l|l|l|}
   \hline
   & \<open>\<lambda>\<close>-binding & \<open>let\<close>-binding \\
   \hline
   types & fixed \<open>\<alpha>\<close> & arbitrary \<open>\<beta>\<close> \\
   terms & \<open>\<FIX> x :: \<tau>\<close> & \<open>\<DEFINE> c \<equiv> t\<close> \\
   theorems & \<open>\<ASSUME> a: A\<close> & \<open>\<NOTE> b = \<^BG>B\<^EN>\<close> \\
   \hline
   \end{tabular}
   \end{center}
 
   A user package merely needs to produce suitable \<open>\<DEFINE>\<close> and \<open>\<NOTE>\<close>
   elements according to the application. For example, a package for inductive
   definitions might first \<open>\<DEFINE>\<close> a certain predicate as some fixed-point
   construction, then \<open>\<NOTE>\<close> a proven result about monotonicity of the
   functor involved here, and then produce further derived concepts via
   additional \<open>\<DEFINE>\<close> and \<open>\<NOTE>\<close> elements.
 
   The cumulative sequence of \<open>\<DEFINE>\<close> and \<open>\<NOTE>\<close> produced at package
   runtime is managed by the local theory infrastructure by means of an
   \<^emph>\<open>auxiliary context\<close>. Thus the system holds up the impression of working
   within a fully abstract situation with hypothetical entities: \<open>\<DEFINE> c \<equiv>
   t\<close> always results in a literal fact \<open>\<^BG>c \<equiv> t\<^EN>\<close>, where \<open>c\<close> is a
   fixed variable \<open>c\<close>. The details about global constants, name spaces etc. are
   handled internally.
 
   So the general structure of a local theory is a sandwich of three layers:
 
   \begin{center}
   \framebox{\quad auxiliary context \quad\framebox{\quad target context \quad\framebox{\quad background theory\quad}}}
   \end{center}
 
   When a definitional package is finished, the auxiliary context is reset to
   the target context. The target now holds definitions for terms and theorems
   that stem from the hypothetical \<open>\<DEFINE>\<close> and \<open>\<NOTE>\<close> elements,
-  transformed by the particular target policy (see @{cite \<open>\S4--5\<close>
-  "Haftmann-Wenzel:2009"} for details).
+  transformed by the particular target policy (see \<^cite>\<open>\<open>\S4--5\<close> in
+  "Haftmann-Wenzel:2009"\<close> for details).
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
   @{define_ML_type local_theory = Proof.context} \\
   @{define_ML Named_Target.init: "string list -> string -> theory -> local_theory"} \\[1ex]
   @{define_ML Local_Theory.define: "(binding * mixfix) * (Attrib.binding * term) ->
     local_theory -> (term * (string * thm)) * local_theory"} \\
   @{define_ML Local_Theory.note: "Attrib.binding * thm list ->
     local_theory -> (string * thm list) * local_theory"} \\
   \end{mldecls}
 
   \<^descr> Type \<^ML_type>\<open>local_theory\<close> represents local theories. Although this is
   merely an alias for \<^ML_type>\<open>Proof.context\<close>, it is semantically a subtype
   of the same: a \<^ML_type>\<open>local_theory\<close> holds target information as special
   context data. Subtyping means that any value \<open>lthy:\<close>~\<^ML_type>\<open>local_theory\<close>
   can be also used with operations on expecting a regular \<open>ctxt:\<close>~\<^ML_type>\<open>Proof.context\<close>.
 
   \<^descr> \<^ML>\<open>Named_Target.init\<close>~\<open>includes name thy\<close> initializes a local theory
   derived from the given background theory. An empty name refers to a \<^emph>\<open>global
   theory\<close> context, and a non-empty name refers to a @{command locale} or
   @{command class} context (a fully-qualified internal name is expected here).
   This is useful for experimentation --- normally the Isar toplevel already
   takes care to initialize the local theory context.
 
   \<^descr> \<^ML>\<open>Local_Theory.define\<close>~\<open>((b, mx), (a, rhs)) lthy\<close> defines a local
   entity according to the specification that is given relatively to the
   current \<open>lthy\<close> context. In particular the term of the RHS may refer to
   earlier local entities from the auxiliary context, or hypothetical
   parameters from the target context. The result is the newly defined term
   (which is always a fixed variable with exactly the same name as specified
   for the LHS), together with an equational theorem that states the definition
   as a hypothetical fact.
 
   Unless an explicit name binding is given for the RHS, the resulting fact
   will be called \<open>b_def\<close>. Any given attributes are applied to that same fact
   --- immediately in the auxiliary context \<^emph>\<open>and\<close> in any transformed versions
   stemming from target-specific policies or any later interpretations of
   results from the target context (think of @{command locale} and @{command
   interpretation}, for example). This means that attributes should be usually
   plain declarations such as @{attribute simp}, while non-trivial rules like
   @{attribute simplified} are better avoided.
 
   \<^descr> \<^ML>\<open>Local_Theory.note\<close>~\<open>(a, ths) lthy\<close> is analogous to \<^ML>\<open>Local_Theory.define\<close>, but defines facts instead of terms. There is also a
   slightly more general variant \<^ML>\<open>Local_Theory.notes\<close> that defines several
   facts (with attribute expressions) simultaneously.
 
   This is essentially the internal version of the @{command lemmas} command,
   or @{command declare} if an empty name binding is given.
 \<close>
 
 
 section \<open>Morphisms and declarations \label{sec:morphisms}\<close>
 
 text \<open>
   %FIXME
 
-  See also @{cite "Chaieb-Wenzel:2007"}.
+  See also \<^cite>\<open>"Chaieb-Wenzel:2007"\<close>.
 \<close>
 
 end
diff --git a/src/Doc/Implementation/Logic.thy b/src/Doc/Implementation/Logic.thy
--- a/src/Doc/Implementation/Logic.thy
+++ b/src/Doc/Implementation/Logic.thy
@@ -1,1365 +1,1362 @@
 (*:maxLineLen=78:*)
 
 theory Logic
 imports Base
 begin
 
 chapter \<open>Primitive logic \label{ch:logic}\<close>
 
 text \<open>
   The logical foundations of Isabelle/Isar are that of the Pure logic, which
-  has been introduced as a Natural Deduction framework in @{cite paulson700}.
+  has been introduced as a Natural Deduction framework in \<^cite>\<open>paulson700\<close>.
   This is essentially the same logic as ``\<open>\<lambda>HOL\<close>'' in the more abstract
-  setting of Pure Type Systems (PTS) @{cite "Barendregt-Geuvers:2001"},
+  setting of Pure Type Systems (PTS) \<^cite>\<open>"Barendregt-Geuvers:2001"\<close>,
   although there are some key differences in the specific treatment of simple
   types in Isabelle/Pure.
 
   Following type-theoretic parlance, the Pure logic consists of three levels
   of \<open>\<lambda>\<close>-calculus with corresponding arrows, \<open>\<Rightarrow>\<close> for syntactic function space
   (terms depending on terms), \<open>\<And>\<close> for universal quantification (proofs
   depending on terms), and \<open>\<Longrightarrow>\<close> for implication (proofs depending on proofs).
 
   Derivations are relative to a logical theory, which declares type
   constructors, constants, and axioms. Theory declarations support schematic
   polymorphism, which is strictly speaking outside the logic.\<^footnote>\<open>This is the
   deeper logical reason, why the theory context \<open>\<Theta>\<close> is separate from the proof
   context \<open>\<Gamma>\<close> of the core calculus: type constructors, term constants, and
   facts (proof constants) may involve arbitrary type schemes, but the type of
   a locally fixed term parameter is also fixed!\<close>
 \<close>
 
 
 section \<open>Types \label{sec:types}\<close>
 
 text \<open>
   The language of types is an uninterpreted order-sorted first-order algebra;
   types are qualified by ordered type classes.
 
   \<^medskip>
   A \<^emph>\<open>type class\<close> is an abstract syntactic entity declared in the theory
   context. The \<^emph>\<open>subclass relation\<close> \<open>c\<^sub>1 \<subseteq> c\<^sub>2\<close> is specified by stating an
   acyclic generating relation; the transitive closure is maintained
   internally. The resulting relation is an ordering: reflexive, transitive,
   and antisymmetric.
 
   A \<^emph>\<open>sort\<close> is a list of type classes written as \<open>s = {c\<^sub>1, \<dots>, c\<^sub>m}\<close>, it
   represents symbolic intersection. Notationally, the curly braces are omitted
   for singleton intersections, i.e.\ any class \<open>c\<close> may be read as a sort
   \<open>{c}\<close>. The ordering on type classes is extended to sorts according to the
   meaning of intersections: \<open>{c\<^sub>1, \<dots> c\<^sub>m} \<subseteq> {d\<^sub>1, \<dots>, d\<^sub>n}\<close> iff \<open>\<forall>j. \<exists>i. c\<^sub>i \<subseteq>
   d\<^sub>j\<close>. The empty intersection \<open>{}\<close> refers to the universal sort, which is the
   largest element wrt.\ the sort order. Thus \<open>{}\<close> represents the ``full
   sort'', not the empty one! The intersection of all (finitely many) classes
   declared in the current theory is the least element wrt.\ the sort ordering.
 
   \<^medskip>
   A \<^emph>\<open>fixed type variable\<close> is a pair of a basic name (starting with a \<open>'\<close>
   character) and a sort constraint, e.g.\ \<open>('a, s)\<close> which is usually printed
   as \<open>\<alpha>\<^sub>s\<close>. A \<^emph>\<open>schematic type variable\<close> is a pair of an indexname and a sort
   constraint, e.g.\ \<open>(('a, 0), s)\<close> which is usually printed as \<open>?\<alpha>\<^sub>s\<close>.
 
   Note that \<^emph>\<open>all\<close> syntactic components contribute to the identity of type
   variables: basic name, index, and sort constraint. The core logic handles
   type variables with the same name but different sorts as different, although
   the type-inference layer (which is outside the core) rejects anything like
   that.
 
   A \<^emph>\<open>type constructor\<close> \<open>\<kappa>\<close> is a \<open>k\<close>-ary operator on types declared in the
   theory. Type constructor application is written postfix as \<open>(\<alpha>\<^sub>1, \<dots>, \<alpha>\<^sub>k)\<kappa>\<close>.
   For \<open>k = 0\<close> the argument tuple is omitted, e.g.\ \<open>prop\<close> instead of \<open>()prop\<close>.
   For \<open>k = 1\<close> the parentheses are omitted, e.g.\ \<open>\<alpha> list\<close> instead of
   \<open>(\<alpha>)list\<close>. Further notation is provided for specific constructors, notably
   the right-associative infix \<open>\<alpha> \<Rightarrow> \<beta>\<close> instead of \<open>(\<alpha>, \<beta>)fun\<close>.
 
   The logical category \<^emph>\<open>type\<close> is defined inductively over type variables and
   type constructors as follows: \<open>\<tau> = \<alpha>\<^sub>s | ?\<alpha>\<^sub>s | (\<tau>\<^sub>1, \<dots>, \<tau>\<^sub>k)\<kappa>\<close>.
 
   A \<^emph>\<open>type abbreviation\<close> is a syntactic definition \<open>(\<^vec>\<alpha>)\<kappa> = \<tau>\<close> of an
   arbitrary type expression \<open>\<tau>\<close> over variables \<open>\<^vec>\<alpha>\<close>. Type abbreviations
   appear as type constructors in the syntax, but are expanded before entering
   the logical core.
 
   A \<^emph>\<open>type arity\<close> declares the image behavior of a type constructor wrt.\ the
   algebra of sorts: \<open>\<kappa> :: (s\<^sub>1, \<dots>, s\<^sub>k)s\<close> means that \<open>(\<tau>\<^sub>1, \<dots>, \<tau>\<^sub>k)\<kappa>\<close> is of
   sort \<open>s\<close> if every argument type \<open>\<tau>\<^sub>i\<close> is of sort \<open>s\<^sub>i\<close>. Arity declarations
   are implicitly completed, i.e.\ \<open>\<kappa> :: (\<^vec>s)c\<close> entails \<open>\<kappa> ::
   (\<^vec>s)c'\<close> for any \<open>c' \<supseteq> c\<close>.
 
   \<^medskip>
   The sort algebra is always maintained as \<^emph>\<open>coregular\<close>, which means that type
   arities are consistent with the subclass relation: for any type constructor
   \<open>\<kappa>\<close>, and classes \<open>c\<^sub>1 \<subseteq> c\<^sub>2\<close>, and arities \<open>\<kappa> :: (\<^vec>s\<^sub>1)c\<^sub>1\<close> and \<open>\<kappa> ::
   (\<^vec>s\<^sub>2)c\<^sub>2\<close> holds \<open>\<^vec>s\<^sub>1 \<subseteq> \<^vec>s\<^sub>2\<close> component-wise.
 
   The key property of a coregular order-sorted algebra is that sort
   constraints can be solved in a most general fashion: for each type
   constructor \<open>\<kappa>\<close> and sort \<open>s\<close> there is a most general vector of argument
   sorts \<open>(s\<^sub>1, \<dots>, s\<^sub>k)\<close> such that a type scheme \<open>(\<alpha>\<^bsub>s\<^sub>1\<^esub>, \<dots>, \<alpha>\<^bsub>s\<^sub>k\<^esub>)\<kappa>\<close> is of
   sort \<open>s\<close>. Consequently, type unification has most general solutions (modulo
   equivalence of sorts), so type-inference produces primary types as expected
-  @{cite "nipkow-prehofer"}.
+  \<^cite>\<open>"nipkow-prehofer"\<close>.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
   @{define_ML_type class = string} \\
   @{define_ML_type sort = "class list"} \\
   @{define_ML_type arity = "string * sort list * sort"} \\
   @{define_ML_type typ} \\
   @{define_ML Term.map_atyps: "(typ -> typ) -> typ -> typ"} \\
   @{define_ML Term.fold_atyps: "(typ -> 'a -> 'a) -> typ -> 'a -> 'a"} \\
   \end{mldecls}
   \begin{mldecls}
   @{define_ML Sign.subsort: "theory -> sort * sort -> bool"} \\
   @{define_ML Sign.of_sort: "theory -> typ * sort -> bool"} \\
   @{define_ML Sign.add_type: "Proof.context -> binding * int * mixfix -> theory -> theory"} \\
   @{define_ML Sign.add_type_abbrev: "Proof.context ->
   binding * string list * typ -> theory -> theory"} \\
   @{define_ML Sign.primitive_class: "binding * class list -> theory -> theory"} \\
   @{define_ML Sign.primitive_classrel: "class * class -> theory -> theory"} \\
   @{define_ML Sign.primitive_arity: "arity -> theory -> theory"} \\
   \end{mldecls}
 
   \<^descr> Type \<^ML_type>\<open>class\<close> represents type classes.
 
   \<^descr> Type \<^ML_type>\<open>sort\<close> represents sorts, i.e.\ finite intersections of
   classes. The empty list \<^ML>\<open>[]: sort\<close> refers to the empty class
   intersection, i.e.\ the ``full sort''.
 
   \<^descr> Type \<^ML_type>\<open>arity\<close> represents type arities. A triple \<open>(\<kappa>, \<^vec>s, s)
   : arity\<close> represents \<open>\<kappa> :: (\<^vec>s)s\<close> as described above.
 
   \<^descr> Type \<^ML_type>\<open>typ\<close> represents types; this is a datatype with constructors
   \<^ML>\<open>TFree\<close>, \<^ML>\<open>TVar\<close>, \<^ML>\<open>Type\<close>.
 
   \<^descr> \<^ML>\<open>Term.map_atyps\<close>~\<open>f \<tau>\<close> applies the mapping \<open>f\<close> to all atomic types
   (\<^ML>\<open>TFree\<close>, \<^ML>\<open>TVar\<close>) occurring in \<open>\<tau>\<close>.
 
   \<^descr> \<^ML>\<open>Term.fold_atyps\<close>~\<open>f \<tau>\<close> iterates the operation \<open>f\<close> over all
   occurrences of atomic types (\<^ML>\<open>TFree\<close>, \<^ML>\<open>TVar\<close>) in \<open>\<tau>\<close>; the type
   structure is traversed from left to right.
 
   \<^descr> \<^ML>\<open>Sign.subsort\<close>~\<open>thy (s\<^sub>1, s\<^sub>2)\<close> tests the subsort relation \<open>s\<^sub>1 \<subseteq>
   s\<^sub>2\<close>.
 
   \<^descr> \<^ML>\<open>Sign.of_sort\<close>~\<open>thy (\<tau>, s)\<close> tests whether type \<open>\<tau>\<close> is of sort \<open>s\<close>.
 
   \<^descr> \<^ML>\<open>Sign.add_type\<close>~\<open>ctxt (\<kappa>, k, mx)\<close> declares a new type constructors \<open>\<kappa>\<close>
   with \<open>k\<close> arguments and optional mixfix syntax.
 
   \<^descr> \<^ML>\<open>Sign.add_type_abbrev\<close>~\<open>ctxt (\<kappa>, \<^vec>\<alpha>, \<tau>)\<close> defines a new type
   abbreviation \<open>(\<^vec>\<alpha>)\<kappa> = \<tau>\<close>.
 
   \<^descr> \<^ML>\<open>Sign.primitive_class\<close>~\<open>(c, [c\<^sub>1, \<dots>, c\<^sub>n])\<close> declares a new class \<open>c\<close>,
   together with class relations \<open>c \<subseteq> c\<^sub>i\<close>, for \<open>i = 1, \<dots>, n\<close>.
 
   \<^descr> \<^ML>\<open>Sign.primitive_classrel\<close>~\<open>(c\<^sub>1, c\<^sub>2)\<close> declares the class relation
   \<open>c\<^sub>1 \<subseteq> c\<^sub>2\<close>.
 
   \<^descr> \<^ML>\<open>Sign.primitive_arity\<close>~\<open>(\<kappa>, \<^vec>s, s)\<close> declares the arity \<open>\<kappa> ::
   (\<^vec>s)s\<close>.
 \<close>
 
 text %mlantiq \<open>
   \begin{matharray}{rcl}
   @{ML_antiquotation_def "class"} & : & \<open>ML_antiquotation\<close> \\
   @{ML_antiquotation_def "sort"} & : & \<open>ML_antiquotation\<close> \\
   @{ML_antiquotation_def "type_name"} & : & \<open>ML_antiquotation\<close> \\
   @{ML_antiquotation_def "type_abbrev"} & : & \<open>ML_antiquotation\<close> \\
   @{ML_antiquotation_def "nonterminal"} & : & \<open>ML_antiquotation\<close> \\
   @{ML_antiquotation_def "typ"} & : & \<open>ML_antiquotation\<close> \\
   @{ML_antiquotation_def "Type"} & : & \<open>ML_antiquotation\<close> \\
   @{ML_antiquotation_def "Type_fn"} & : & \<open>ML_antiquotation\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
   @@{ML_antiquotation class} embedded
   ;
   @@{ML_antiquotation sort} sort
   ;
   (@@{ML_antiquotation type_name} |
    @@{ML_antiquotation type_abbrev} |
    @@{ML_antiquotation nonterminal}) embedded
   ;
   @@{ML_antiquotation typ} type
   ;
   (@@{ML_antiquotation Type} | @@{ML_antiquotation Type_fn}) embedded
   \<close>
 
   \<^descr> \<open>@{class c}\<close> inlines the internalized class \<open>c\<close> --- as \<^ML_type>\<open>string\<close>
   literal.
 
   \<^descr> \<open>@{sort s}\<close> inlines the internalized sort \<open>s\<close> --- as \<^ML_type>\<open>string
   list\<close> literal.
 
   \<^descr> \<open>@{type_name c}\<close> inlines the internalized type constructor \<open>c\<close> --- as
   \<^ML_type>\<open>string\<close> literal.
 
   \<^descr> \<open>@{type_abbrev c}\<close> inlines the internalized type abbreviation \<open>c\<close> --- as
   \<^ML_type>\<open>string\<close> literal.
 
   \<^descr> \<open>@{nonterminal c}\<close> inlines the internalized syntactic type~/ grammar
   nonterminal \<open>c\<close> --- as \<^ML_type>\<open>string\<close> literal.
 
   \<^descr> \<open>@{typ \<tau>}\<close> inlines the internalized type \<open>\<tau>\<close> --- as constructor term for
   datatype \<^ML_type>\<open>typ\<close>.
 
   \<^descr> \<open>@{Type source}\<close> refers to embedded source text to produce a type
   constructor with name (formally checked) and arguments (inlined ML text).
   The embedded \<open>source\<close> follows the syntax category @{syntax type_const}
   defined below.
 
   \<^descr> \<open>@{Type_fn source}\<close> is similar to \<open>@{Type source}\<close>, but produces a partial
   ML function that matches against a type constructor pattern, following
   syntax category @{syntax type_const_fn} below.
 
 
   \<^rail>\<open>
     @{syntax_def type_const}: @{syntax name} (@{syntax embedded_ml}*)
     ;
     @{syntax_def type_const_fn}: @{syntax type_const} @'=>' @{syntax embedded_ml}
     ;
     @{syntax_def embedded_ml}:
       @'_' | @{syntax embedded} | @{syntax control_symbol} @{syntax embedded}
   \<close>
 
   The text provided as @{syntax embedded_ml} is treated as regular Isabelle/ML
   source, possibly with nested antiquotations. ML text that only consists of a
   single antiquotation in compact control-cartouche notation, can be written
   without an extra level of nesting embedded text (see the last example
   below).
 \<close>
 
 text %mlex \<open>
   Here are some minimal examples for type constructor antiquotations.
 \<close>
 
 ML \<open>
   \<comment> \<open>type constructor without arguments:\<close>
   val natT = \<^Type>\<open>nat\<close>;
 
   \<comment> \<open>type constructor with arguments:\<close>
   fun mk_funT (A, B) = \<^Type>\<open>fun A B\<close>;
 
   \<comment> \<open>type constructor decomposition as partial function:\<close>
   val dest_funT = \<^Type_fn>\<open>fun A B => \<open>(A, B)\<close>\<close>;
 
   \<comment> \<open>nested type constructors:\<close>
   fun mk_relT A = \<^Type>\<open>fun A \<^Type>\<open>fun A \<^Type>\<open>bool\<close>\<close>\<close>;
 
   \<^assert> (mk_relT natT = \<^typ>\<open>nat \<Rightarrow> nat \<Rightarrow> bool\<close>);
 \<close>
 
 
 section \<open>Terms \label{sec:terms}\<close>
 
 text \<open>
   The language of terms is that of simply-typed \<open>\<lambda>\<close>-calculus with de-Bruijn
-  indices for bound variables (cf.\ @{cite debruijn72} or @{cite
-  "paulson-ml2"}), with the types being determined by the corresponding
+  indices for bound variables (cf.\ \<^cite>\<open>debruijn72\<close> or \<^cite>\<open>"paulson-ml2"\<close>), with the types being determined by the corresponding
   binders. In contrast, free variables and constants have an explicit name and
   type in each occurrence.
 
   \<^medskip>
   A \<^emph>\<open>bound variable\<close> is a natural number \<open>b\<close>, which accounts for the number
   of intermediate binders between the variable occurrence in the body and its
   binding position. For example, the de-Bruijn term \<open>\<lambda>\<^bsub>bool\<^esub>. \<lambda>\<^bsub>bool\<^esub>. 1 \<and> 0\<close>
   would correspond to \<open>\<lambda>x\<^bsub>bool\<^esub>. \<lambda>y\<^bsub>bool\<^esub>. x \<and> y\<close> in a named representation.
   Note that a bound variable may be represented by different de-Bruijn indices
   at different occurrences, depending on the nesting of abstractions.
 
   A \<^emph>\<open>loose variable\<close> is a bound variable that is outside the scope of local
   binders. The types (and names) for loose variables can be managed as a
   separate context, that is maintained as a stack of hypothetical binders. The
   core logic operates on closed terms, without any loose variables.
 
   A \<^emph>\<open>fixed variable\<close> is a pair of a basic name and a type, e.g.\ \<open>(x, \<tau>)\<close>
   which is usually printed \<open>x\<^sub>\<tau>\<close> here. A \<^emph>\<open>schematic variable\<close> is a pair of an
   indexname and a type, e.g.\ \<open>((x, 0), \<tau>)\<close> which is likewise printed as
   \<open>?x\<^sub>\<tau>\<close>.
 
   \<^medskip>
   A \<^emph>\<open>constant\<close> is a pair of a basic name and a type, e.g.\ \<open>(c, \<tau>)\<close> which is
   usually printed as \<open>c\<^sub>\<tau>\<close> here. Constants are declared in the context as
   polymorphic families \<open>c :: \<sigma>\<close>, meaning that all substitution instances \<open>c\<^sub>\<tau>\<close>
   for \<open>\<tau> = \<sigma>\<vartheta>\<close> are valid.
 
   The vector of \<^emph>\<open>type arguments\<close> of constant \<open>c\<^sub>\<tau>\<close> wrt.\ the declaration \<open>c
   :: \<sigma>\<close> is defined as the codomain of the matcher \<open>\<vartheta> = {?\<alpha>\<^sub>1 \<mapsto> \<tau>\<^sub>1,
   \<dots>, ?\<alpha>\<^sub>n \<mapsto> \<tau>\<^sub>n}\<close> presented in canonical order \<open>(\<tau>\<^sub>1, \<dots>, \<tau>\<^sub>n)\<close>, corresponding
   to the left-to-right occurrences of the \<open>\<alpha>\<^sub>i\<close> in \<open>\<sigma>\<close>. Within a given theory
   context, there is a one-to-one correspondence between any constant \<open>c\<^sub>\<tau>\<close> and
   the application \<open>c(\<tau>\<^sub>1, \<dots>, \<tau>\<^sub>n)\<close> of its type arguments. For example, with
   \<open>plus :: \<alpha> \<Rightarrow> \<alpha> \<Rightarrow> \<alpha>\<close>, the instance \<open>plus\<^bsub>nat \<Rightarrow> nat \<Rightarrow> nat\<^esub>\<close> corresponds to
   \<open>plus(nat)\<close>.
 
   Constant declarations \<open>c :: \<sigma>\<close> may contain sort constraints for type
   variables in \<open>\<sigma>\<close>. These are observed by type-inference as expected, but
   \<^emph>\<open>ignored\<close> by the core logic. This means the primitive logic is able to
   reason with instances of polymorphic constants that the user-level
   type-checker would reject due to violation of type class restrictions.
 
   \<^medskip>
   An \<^emph>\<open>atomic term\<close> is either a variable or constant. The logical category
   \<^emph>\<open>term\<close> is defined inductively over atomic terms, with abstraction and
   application as follows: \<open>t = b | x\<^sub>\<tau> | ?x\<^sub>\<tau> | c\<^sub>\<tau> | \<lambda>\<^sub>\<tau>. t | t\<^sub>1 t\<^sub>2\<close>.
   Parsing and printing takes care of converting between an external
   representation with named bound variables. Subsequently, we shall use the
   latter notation instead of internal de-Bruijn representation.
 
   The inductive relation \<open>t :: \<tau>\<close> assigns a (unique) type to a term according
   to the structure of atomic terms, abstractions, and applications:
   \[
   \infer{\<open>a\<^sub>\<tau> :: \<tau>\<close>}{}
   \qquad
   \infer{\<open>(\<lambda>x\<^sub>\<tau>. t) :: \<tau> \<Rightarrow> \<sigma>\<close>}{\<open>t :: \<sigma>\<close>}
   \qquad
   \infer{\<open>t u :: \<sigma>\<close>}{\<open>t :: \<tau> \<Rightarrow> \<sigma>\<close> & \<open>u :: \<tau>\<close>}
   \]
   A \<^emph>\<open>well-typed term\<close> is a term that can be typed according to these rules.
 
   Typing information can be omitted: type-inference is able to reconstruct the
   most general type of a raw term, while assigning most general types to all
   of its variables and constants. Type-inference depends on a context of type
   constraints for fixed variables, and declarations for polymorphic constants.
 
   The identity of atomic terms consists both of the name and the type
   component. This means that different variables \<open>x\<^bsub>\<tau>\<^sub>1\<^esub>\<close> and \<open>x\<^bsub>\<tau>\<^sub>2\<^esub>\<close> may
   become the same after type instantiation. Type-inference rejects variables
   of the same name, but different types. In contrast, mixed instances of
   polymorphic constants occur routinely.
 
   \<^medskip>
   The \<^emph>\<open>hidden polymorphism\<close> of a term \<open>t :: \<sigma>\<close> is the set of type variables
   occurring in \<open>t\<close>, but not in its type \<open>\<sigma>\<close>. This means that the term
   implicitly depends on type arguments that are not accounted in the result
   type, i.e.\ there are different type instances \<open>t\<vartheta> :: \<sigma>\<close> and
   \<open>t\<vartheta>' :: \<sigma>\<close> with the same type. This slightly pathological
   situation notoriously demands additional care.
 
   \<^medskip>
   A \<^emph>\<open>term abbreviation\<close> is a syntactic definition \<open>c\<^sub>\<sigma> \<equiv> t\<close> of a closed term
   \<open>t\<close> of type \<open>\<sigma>\<close>, without any hidden polymorphism. A term abbreviation looks
   like a constant in the syntax, but is expanded before entering the logical
   core. Abbreviations are usually reverted when printing terms, using \<open>t \<rightarrow>
   c\<^sub>\<sigma>\<close> as rules for higher-order rewriting.
 
   \<^medskip>
   Canonical operations on \<open>\<lambda>\<close>-terms include \<open>\<alpha>\<beta>\<eta>\<close>-conversion: \<open>\<alpha>\<close>-conversion
   refers to capture-free renaming of bound variables; \<open>\<beta>\<close>-conversion contracts
   an abstraction applied to an argument term, substituting the argument in the
   body: \<open>(\<lambda>x. b)a\<close> becomes \<open>b[a/x]\<close>; \<open>\<eta>\<close>-conversion contracts vacuous
   application-abstraction: \<open>\<lambda>x. f x\<close> becomes \<open>f\<close>, provided that the bound
   variable does not occur in \<open>f\<close>.
 
   Terms are normally treated modulo \<open>\<alpha>\<close>-conversion, which is implicit in the
   de-Bruijn representation. Names for bound variables in abstractions are
   maintained separately as (meaningless) comments, mostly for parsing and
   printing. Full \<open>\<alpha>\<beta>\<eta>\<close>-conversion is commonplace in various standard
   operations (\secref{sec:obj-rules}) that are based on higher-order
   unification and matching.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
   @{define_ML_type term} \\
   @{define_ML_infix "aconv": "term * term -> bool"} \\
   @{define_ML Term.map_types: "(typ -> typ) -> term -> term"} \\
   @{define_ML Term.fold_types: "(typ -> 'a -> 'a) -> term -> 'a -> 'a"} \\
   @{define_ML Term.map_aterms: "(term -> term) -> term -> term"} \\
   @{define_ML Term.fold_aterms: "(term -> 'a -> 'a) -> term -> 'a -> 'a"} \\
   \end{mldecls}
   \begin{mldecls}
   @{define_ML fastype_of: "term -> typ"} \\
   @{define_ML lambda: "term -> term -> term"} \\
   @{define_ML betapply: "term * term -> term"} \\
   @{define_ML incr_boundvars: "int -> term -> term"} \\
   @{define_ML Sign.declare_const: "Proof.context ->
   (binding * typ) * mixfix -> theory -> term * theory"} \\
   @{define_ML Sign.add_abbrev: "string -> binding * term ->
   theory -> (term * term) * theory"} \\
   @{define_ML Sign.const_typargs: "theory -> string * typ -> typ list"} \\
   @{define_ML Sign.const_instance: "theory -> string * typ list -> typ"} \\
   \end{mldecls}
 
   \<^descr> Type \<^ML_type>\<open>term\<close> represents de-Bruijn terms, with comments in
   abstractions, and explicitly named free variables and constants; this is a
   datatype with constructors @{define_ML Bound}, @{define_ML Free}, @{define_ML
   Var}, @{define_ML Const}, @{define_ML Abs}, @{define_ML_infix "$"}.
 
   \<^descr> \<open>t\<close>~\<^ML_text>\<open>aconv\<close>~\<open>u\<close> checks \<open>\<alpha>\<close>-equivalence of two terms. This is the
   basic equality relation on type \<^ML_type>\<open>term\<close>; raw datatype equality
   should only be used for operations related to parsing or printing!
 
   \<^descr> \<^ML>\<open>Term.map_types\<close>~\<open>f t\<close> applies the mapping \<open>f\<close> to all types occurring
   in \<open>t\<close>.
 
   \<^descr> \<^ML>\<open>Term.fold_types\<close>~\<open>f t\<close> iterates the operation \<open>f\<close> over all
   occurrences of types in \<open>t\<close>; the term structure is traversed from left to
   right.
 
   \<^descr> \<^ML>\<open>Term.map_aterms\<close>~\<open>f t\<close> applies the mapping \<open>f\<close> to all atomic terms
   (\<^ML>\<open>Bound\<close>, \<^ML>\<open>Free\<close>, \<^ML>\<open>Var\<close>, \<^ML>\<open>Const\<close>) occurring in \<open>t\<close>.
 
   \<^descr> \<^ML>\<open>Term.fold_aterms\<close>~\<open>f t\<close> iterates the operation \<open>f\<close> over all
   occurrences of atomic terms (\<^ML>\<open>Bound\<close>, \<^ML>\<open>Free\<close>, \<^ML>\<open>Var\<close>, \<^ML>\<open>Const\<close>) in \<open>t\<close>; the term structure is traversed from left to right.
 
   \<^descr> \<^ML>\<open>fastype_of\<close>~\<open>t\<close> determines the type of a well-typed term. This
   operation is relatively slow, despite the omission of any sanity checks.
 
   \<^descr> \<^ML>\<open>lambda\<close>~\<open>a b\<close> produces an abstraction \<open>\<lambda>a. b\<close>, where occurrences of
   the atomic term \<open>a\<close> in the body \<open>b\<close> are replaced by bound variables.
 
   \<^descr> \<^ML>\<open>betapply\<close>~\<open>(t, u)\<close> produces an application \<open>t u\<close>, with topmost
   \<open>\<beta>\<close>-conversion if \<open>t\<close> is an abstraction.
 
   \<^descr> \<^ML>\<open>incr_boundvars\<close>~\<open>j\<close> increments a term's dangling bound variables by
   the offset \<open>j\<close>. This is required when moving a subterm into a context where
   it is enclosed by a different number of abstractions. Bound variables with a
   matching abstraction are unaffected.
 
   \<^descr> \<^ML>\<open>Sign.declare_const\<close>~\<open>ctxt ((c, \<sigma>), mx)\<close> declares a new constant \<open>c ::
   \<sigma>\<close> with optional mixfix syntax.
 
   \<^descr> \<^ML>\<open>Sign.add_abbrev\<close>~\<open>print_mode (c, t)\<close> introduces a new term
   abbreviation \<open>c \<equiv> t\<close>.
 
   \<^descr> \<^ML>\<open>Sign.const_typargs\<close>~\<open>thy (c, \<tau>)\<close> and \<^ML>\<open>Sign.const_instance\<close>~\<open>thy
   (c, [\<tau>\<^sub>1, \<dots>, \<tau>\<^sub>n])\<close> convert between two representations of polymorphic
   constants: full type instance vs.\ compact type arguments form.
 \<close>
 
 text %mlantiq \<open>
   \begin{matharray}{rcl}
   @{ML_antiquotation_def "const_name"} & : & \<open>ML_antiquotation\<close> \\
   @{ML_antiquotation_def "const_abbrev"} & : & \<open>ML_antiquotation\<close> \\
   @{ML_antiquotation_def "const"} & : & \<open>ML_antiquotation\<close> \\
   @{ML_antiquotation_def "term"} & : & \<open>ML_antiquotation\<close> \\
   @{ML_antiquotation_def "prop"} & : & \<open>ML_antiquotation\<close> \\
   @{ML_antiquotation_def "Const"} & : & \<open>ML_antiquotation\<close> \\
   @{ML_antiquotation_def "Const_"} & : & \<open>ML_antiquotation\<close> \\
   @{ML_antiquotation_def "Const_fn"} & : & \<open>ML_antiquotation\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
   (@@{ML_antiquotation const_name} |
    @@{ML_antiquotation const_abbrev}) embedded
   ;
   @@{ML_antiquotation const} ('(' (type + ',') ')')?
   ;
   @@{ML_antiquotation term} term
   ;
   @@{ML_antiquotation prop} prop
   ;
   (@@{ML_antiquotation Const} | @@{ML_antiquotation Const_} | @@{ML_antiquotation Const_fn})
     embedded
   \<close>
 
   \<^descr> \<open>@{const_name c}\<close> inlines the internalized logical constant name \<open>c\<close> ---
   as \<^ML_type>\<open>string\<close> literal.
 
   \<^descr> \<open>@{const_abbrev c}\<close> inlines the internalized abbreviated constant name \<open>c\<close>
   --- as \<^ML_type>\<open>string\<close> literal.
 
   \<^descr> \<open>@{const c(\<^vec>\<tau>)}\<close> inlines the internalized constant \<open>c\<close> with precise
   type instantiation in the sense of \<^ML>\<open>Sign.const_instance\<close> --- as \<^ML>\<open>Const\<close> constructor term for datatype \<^ML_type>\<open>term\<close>.
 
   \<^descr> \<open>@{term t}\<close> inlines the internalized term \<open>t\<close> --- as constructor term for
   datatype \<^ML_type>\<open>term\<close>.
 
   \<^descr> \<open>@{prop \<phi>}\<close> inlines the internalized proposition \<open>\<phi>\<close> --- as constructor
   term for datatype \<^ML_type>\<open>term\<close>.
 
   \<^descr> \<open>@{Const source}\<close> refers to embedded source text to produce a term
   constructor with name (formally checked), type arguments and term arguments
   (inlined ML text). The embedded \<open>source\<close> follows the syntax category
   @{syntax term_const} defined below, using @{syntax embedded_ml} from
   antiquotation @{ML_antiquotation Type} (\secref{sec:types}).
 
   \<^descr> \<open>@{Const_ source}\<close> is similar to \<open>@{Const source}\<close> for patterns instead of
   closed values. This distinction is required due to redundant type
   information within term constants: subtrees with duplicate ML pattern
   variable need to be suppressed (replaced by dummy patterns). The embedded \<open>source\<close> follows
   the syntax category @{syntax term_const} defined below.
 
   \<^descr> \<open>@{Const_fn source}\<close> is similar to \<open>@{Const_ source}\<close>, but produces a
   proper \<^verbatim>\<open>fn\<close> expression with function body. The embedded \<open>source\<close> follows
   the syntax category @{syntax term_const_fn} defined below.
 
 
   \<^rail>\<open>
     @{syntax_def term_const}:
       @{syntax name} (@{syntax embedded_ml}*) (@{syntax for_args})?
     ;
     @{syntax_def term_const_fn}:
       @{syntax term_const} @'=>' @{syntax embedded_ml}
     ;
     @{syntax_def for_args}: @'for' (@{syntax embedded_ml}+)
   \<close>
 \<close>
 
 text %mlex \<open>
   Here are some minimal examples for term constant antiquotations. Type
   arguments for constants are analogous to type constructors
   (\secref{sec:types}). Term arguments are different: a flexible number of
   arguments is inserted via curried applications (\<^ML>\<open>op $\<close>).
 \<close>
 
 ML \<open>
   \<comment> \<open>constant without type argument:\<close>
   fun mk_conj (A, B) = \<^Const>\<open>conj for A B\<close>;
   val dest_conj = \<^Const_fn>\<open>conj for A B => \<open>(A, B)\<close>\<close>;
 
   \<comment> \<open>constant with type argument:\<close>
   fun mk_eq T (t, u) = \<^Const>\<open>HOL.eq T for t u\<close>;
   val dest_eq = \<^Const_fn>\<open>HOL.eq T for t u => \<open>(T, (t, u))\<close>\<close>;
 
   \<comment> \<open>constant with variable number of term arguments:\<close>
   val c = Const (\<^const_name>\<open>conj\<close>, \<^typ>\<open>bool \<Rightarrow> bool \<Rightarrow> bool\<close>);
   val P = \<^term>\<open>P::bool\<close>;
   val Q = \<^term>\<open>Q::bool\<close>;
   \<^assert> (\<^Const>\<open>conj\<close> = c);
   \<^assert> (\<^Const>\<open>conj for P\<close> = c $ P);
   \<^assert> (\<^Const>\<open>conj for P Q\<close> = c $ P $ Q);
 \<close>
 
 
 section \<open>Theorems \label{sec:thms}\<close>
 
 text \<open>
   A \<^emph>\<open>proposition\<close> is a well-typed term of type \<open>prop\<close>, a \<^emph>\<open>theorem\<close> is a
   proven proposition (depending on a context of hypotheses and the background
   theory). Primitive inferences include plain Natural Deduction rules for the
   primary connectives \<open>\<And>\<close> and \<open>\<Longrightarrow>\<close> of the framework. There is also a builtin
   notion of equality/equivalence \<open>\<equiv>\<close>.
 \<close>
 
 
 subsection \<open>Primitive connectives and rules \label{sec:prim-rules}\<close>
 
 text \<open>
   The theory \<open>Pure\<close> contains constant declarations for the primitive
   connectives \<open>\<And>\<close>, \<open>\<Longrightarrow>\<close>, and \<open>\<equiv>\<close> of the logical framework, see
   \figref{fig:pure-connectives}. The derivability judgment \<open>A\<^sub>1, \<dots>, A\<^sub>n \<turnstile> B\<close>
   is defined inductively by the primitive inferences given in
   \figref{fig:prim-rules}, with the global restriction that the hypotheses
   must \<^emph>\<open>not\<close> contain any schematic variables. The builtin equality is
   conceptually axiomatized as shown in \figref{fig:pure-equality}, although
   the implementation works directly with derived inferences.
 
   \begin{figure}[htb]
   \begin{center}
   \begin{tabular}{ll}
   \<open>all :: (\<alpha> \<Rightarrow> prop) \<Rightarrow> prop\<close> & universal quantification (binder \<open>\<And>\<close>) \\
   \<open>\<Longrightarrow> :: prop \<Rightarrow> prop \<Rightarrow> prop\<close> & implication (right associative infix) \\
   \<open>\<equiv> :: \<alpha> \<Rightarrow> \<alpha> \<Rightarrow> prop\<close> & equality relation (infix) \\
   \end{tabular}
   \caption{Primitive connectives of Pure}\label{fig:pure-connectives}
   \end{center}
   \end{figure}
 
   \begin{figure}[htb]
   \begin{center}
   \[
   \infer[\<open>(axiom)\<close>]{\<open>\<turnstile> A\<close>}{\<open>A \<in> \<Theta>\<close>}
   \qquad
   \infer[\<open>(assume)\<close>]{\<open>A \<turnstile> A\<close>}{}
   \]
   \[
   \infer[\<open>(\<And>\<hyphen>intro)\<close>]{\<open>\<Gamma> \<turnstile> \<And>x. B[x]\<close>}{\<open>\<Gamma> \<turnstile> B[x]\<close> & \<open>x \<notin> \<Gamma>\<close>}
   \qquad
   \infer[\<open>(\<And>\<hyphen>elim)\<close>]{\<open>\<Gamma> \<turnstile> B[a]\<close>}{\<open>\<Gamma> \<turnstile> \<And>x. B[x]\<close>}
   \]
   \[
   \infer[\<open>(\<Longrightarrow>\<hyphen>intro)\<close>]{\<open>\<Gamma> - A \<turnstile> A \<Longrightarrow> B\<close>}{\<open>\<Gamma> \<turnstile> B\<close>}
   \qquad
   \infer[\<open>(\<Longrightarrow>\<hyphen>elim)\<close>]{\<open>\<Gamma>\<^sub>1 \<union> \<Gamma>\<^sub>2 \<turnstile> B\<close>}{\<open>\<Gamma>\<^sub>1 \<turnstile> A \<Longrightarrow> B\<close> & \<open>\<Gamma>\<^sub>2 \<turnstile> A\<close>}
   \]
   \caption{Primitive inferences of Pure}\label{fig:prim-rules}
   \end{center}
   \end{figure}
 
   \begin{figure}[htb]
   \begin{center}
   \begin{tabular}{ll}
   \<open>\<turnstile> (\<lambda>x. b[x]) a \<equiv> b[a]\<close> & \<open>\<beta>\<close>-conversion \\
   \<open>\<turnstile> x \<equiv> x\<close> & reflexivity \\
   \<open>\<turnstile> x \<equiv> y \<Longrightarrow> P x \<Longrightarrow> P y\<close> & substitution \\
   \<open>\<turnstile> (\<And>x. f x \<equiv> g x) \<Longrightarrow> f \<equiv> g\<close> & extensionality \\
   \<open>\<turnstile> (A \<Longrightarrow> B) \<Longrightarrow> (B \<Longrightarrow> A) \<Longrightarrow> A \<equiv> B\<close> & logical equivalence \\
   \end{tabular}
   \caption{Conceptual axiomatization of Pure equality}\label{fig:pure-equality}
   \end{center}
   \end{figure}
 
   The introduction and elimination rules for \<open>\<And>\<close> and \<open>\<Longrightarrow>\<close> are analogous to
   formation of dependently typed \<open>\<lambda>\<close>-terms representing the underlying proof
   objects. Proof terms are irrelevant in the Pure logic, though; they cannot
   occur within propositions. The system provides a runtime option to record
   explicit proof terms for primitive inferences, see also
   \secref{sec:proof-terms}. Thus all three levels of \<open>\<lambda>\<close>-calculus become
-  explicit: \<open>\<Rightarrow>\<close> for terms, and \<open>\<And>/\<Longrightarrow>\<close> for proofs (cf.\ @{cite
-  "Berghofer-Nipkow:2000:TPHOL"}).
+  explicit: \<open>\<Rightarrow>\<close> for terms, and \<open>\<And>/\<Longrightarrow>\<close> for proofs (cf.\ \<^cite>\<open>"Berghofer-Nipkow:2000:TPHOL"\<close>).
 
   Observe that locally fixed parameters (as in \<open>\<And>\<hyphen>intro\<close>) need not be recorded
   in the hypotheses, because the simple syntactic types of Pure are always
   inhabitable. ``Assumptions'' \<open>x :: \<tau>\<close> for type-membership are only present
   as long as some \<open>x\<^sub>\<tau>\<close> occurs in the statement body.\<^footnote>\<open>This is the key
-  difference to ``\<open>\<lambda>HOL\<close>'' in the PTS framework @{cite
-  "Barendregt-Geuvers:2001"}, where hypotheses \<open>x : A\<close> are treated uniformly
+  difference to ``\<open>\<lambda>HOL\<close>'' in the PTS framework \<^cite>\<open>"Barendregt-Geuvers:2001"\<close>, where hypotheses \<open>x : A\<close> are treated uniformly
   for propositions and types.\<close>
 
   \<^medskip>
   The axiomatization of a theory is implicitly closed by forming all instances
   of type and term variables: \<open>\<turnstile> A\<vartheta>\<close> holds for any substitution
   instance of an axiom \<open>\<turnstile> A\<close>. By pushing substitutions through derivations
   inductively, we also get admissible \<open>generalize\<close> and \<open>instantiate\<close> rules as
   shown in \figref{fig:subst-rules}.
 
   \begin{figure}[htb]
   \begin{center}
   \[
   \infer{\<open>\<Gamma> \<turnstile> B[?\<alpha>]\<close>}{\<open>\<Gamma> \<turnstile> B[\<alpha>]\<close> & \<open>\<alpha> \<notin> \<Gamma>\<close>}
   \quad
   \infer[\quad\<open>(generalize)\<close>]{\<open>\<Gamma> \<turnstile> B[?x]\<close>}{\<open>\<Gamma> \<turnstile> B[x]\<close> & \<open>x \<notin> \<Gamma>\<close>}
   \]
   \[
   \infer{\<open>\<Gamma> \<turnstile> B[\<tau>]\<close>}{\<open>\<Gamma> \<turnstile> B[?\<alpha>]\<close>}
   \quad
   \infer[\quad\<open>(instantiate)\<close>]{\<open>\<Gamma> \<turnstile> B[t]\<close>}{\<open>\<Gamma> \<turnstile> B[?x]\<close>}
   \]
   \caption{Admissible substitution rules}\label{fig:subst-rules}
   \end{center}
   \end{figure}
 
   Note that \<open>instantiate\<close> does not require an explicit side-condition, because
   \<open>\<Gamma>\<close> may never contain schematic variables.
 
   In principle, variables could be substituted in hypotheses as well, but this
   would disrupt the monotonicity of reasoning: deriving \<open>\<Gamma>\<vartheta> \<turnstile>
   B\<vartheta>\<close> from \<open>\<Gamma> \<turnstile> B\<close> is correct, but \<open>\<Gamma>\<vartheta> \<supseteq> \<Gamma>\<close> does not
   necessarily hold: the result belongs to a different proof context.
 
   \<^medskip> An \<^emph>\<open>oracle\<close> is a function that produces axioms on the fly. Logically,
   this is an instance of the \<open>axiom\<close> rule (\figref{fig:prim-rules}), but there
   is an operational difference. The inference kernel records oracle
   invocations within derivations of theorems by a unique tag. This also
   includes implicit type-class reasoning via the order-sorted algebra of class
   relations and type arities (see also @{command_ref instantiation} and
   @{command_ref instance}).
 
   Axiomatizations should be limited to the bare minimum, typically as part of
   the initial logical basis of an object-logic formalization. Later on,
   theories are usually developed in a strictly definitional fashion, by
   stating only certain equalities over new constants.
 
   A \<^emph>\<open>simple definition\<close> consists of a constant declaration \<open>c :: \<sigma>\<close> together
   with an axiom \<open>\<turnstile> c \<equiv> t\<close>, where \<open>t :: \<sigma>\<close> is a closed term without any hidden
   polymorphism. The RHS may depend on further defined constants, but not \<open>c\<close>
   itself. Definitions of functions may be presented as \<open>c \<^vec>x \<equiv> t\<close>
   instead of the puristic \<open>c \<equiv> \<lambda>\<^vec>x. t\<close>.
 
   An \<^emph>\<open>overloaded definition\<close> consists of a collection of axioms for the same
   constant, with zero or one equations \<open>c((\<^vec>\<alpha>)\<kappa>) \<equiv> t\<close> for each type
   constructor \<open>\<kappa>\<close> (for distinct variables \<open>\<^vec>\<alpha>\<close>). The RHS may mention
   previously defined constants as above, or arbitrary constants \<open>d(\<alpha>\<^sub>i)\<close> for
   some \<open>\<alpha>\<^sub>i\<close> projected from \<open>\<^vec>\<alpha>\<close>. Thus overloaded definitions
   essentially work by primitive recursion over the syntactic structure of a
-  single type argument. See also @{cite \<open>\S4.3\<close>
-  "Haftmann-Wenzel:2006:classes"}.
+  single type argument. See also \<^cite>\<open>\<open>\S4.3\<close> in
+  "Haftmann-Wenzel:2006:classes"\<close>.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
   @{define_ML Logic.all: "term -> term -> term"} \\
   @{define_ML Logic.mk_implies: "term * term -> term"} \\
   \end{mldecls}
   \begin{mldecls}
   @{define_ML_type ctyp} \\
   @{define_ML_type cterm} \\
   @{define_ML Thm.ctyp_of: "Proof.context -> typ -> ctyp"} \\
   @{define_ML Thm.cterm_of: "Proof.context -> term -> cterm"} \\
   @{define_ML Thm.apply: "cterm -> cterm -> cterm"} \\
   @{define_ML Thm.lambda: "cterm -> cterm -> cterm"} \\
   @{define_ML Thm.all: "Proof.context -> cterm -> cterm -> cterm"} \\
   @{define_ML Drule.mk_implies: "cterm * cterm -> cterm"} \\
   \end{mldecls}
   \begin{mldecls}
   @{define_ML_type thm} \\
   @{define_ML Thm.transfer: "theory -> thm -> thm"} \\
   @{define_ML Thm.assume: "cterm -> thm"} \\
   @{define_ML Thm.forall_intr: "cterm -> thm -> thm"} \\
   @{define_ML Thm.forall_elim: "cterm -> thm -> thm"} \\
   @{define_ML Thm.implies_intr: "cterm -> thm -> thm"} \\
   @{define_ML Thm.implies_elim: "thm -> thm -> thm"} \\
   @{define_ML Thm.generalize: "Names.set * Names.set -> int -> thm -> thm"} \\
   @{define_ML Thm.instantiate: "ctyp TVars.table * cterm Vars.table -> thm -> thm"} \\
   @{define_ML Thm.add_axiom: "Proof.context ->
   binding * term -> theory -> (string * thm) * theory"} \\
   @{define_ML Thm.add_oracle: "binding * ('a -> cterm) -> theory ->
   (string * ('a -> thm)) * theory"} \\
   @{define_ML Thm.add_def: "Defs.context -> bool -> bool ->
   binding * term -> theory -> (string * thm) * theory"} \\
   \end{mldecls}
   \begin{mldecls}
   @{define_ML Theory.add_deps: "Defs.context -> string ->
   Defs.entry -> Defs.entry list -> theory -> theory"} \\
   @{define_ML Thm_Deps.all_oracles: "thm list -> Proofterm.oracle list"} \\
   \end{mldecls}
 
   \<^descr> \<^ML>\<open>Logic.all\<close>~\<open>a B\<close> produces a Pure quantification \<open>\<And>a. B\<close>, where
   occurrences of the atomic term \<open>a\<close> in the body proposition \<open>B\<close> are replaced
   by bound variables. (See also \<^ML>\<open>lambda\<close> on terms.)
 
   \<^descr> \<^ML>\<open>Logic.mk_implies\<close>~\<open>(A, B)\<close> produces a Pure implication \<open>A \<Longrightarrow> B\<close>.
 
   \<^descr> Types \<^ML_type>\<open>ctyp\<close> and \<^ML_type>\<open>cterm\<close> represent certified types and
   terms, respectively. These are abstract datatypes that guarantee that its
   values have passed the full well-formedness (and well-typedness) checks,
   relative to the declarations of type constructors, constants etc.\ in the
   background theory. The abstract types \<^ML_type>\<open>ctyp\<close> and \<^ML_type>\<open>cterm\<close>
   are part of the same inference kernel that is mainly responsible for
   \<^ML_type>\<open>thm\<close>. Thus syntactic operations on \<^ML_type>\<open>ctyp\<close> and \<^ML_type>\<open>cterm\<close> are located in the \<^ML_structure>\<open>Thm\<close> module, even though theorems
   are not yet involved at that stage.
 
   \<^descr> \<^ML>\<open>Thm.ctyp_of\<close>~\<open>ctxt \<tau>\<close> and \<^ML>\<open>Thm.cterm_of\<close>~\<open>ctxt t\<close> explicitly
   check types and terms, respectively. This also involves some basic
   normalizations, such expansion of type and term abbreviations from the
   underlying theory context. Full re-certification is relatively slow and
   should be avoided in tight reasoning loops.
 
   \<^descr> \<^ML>\<open>Thm.apply\<close>, \<^ML>\<open>Thm.lambda\<close>, \<^ML>\<open>Thm.all\<close>, \<^ML>\<open>Drule.mk_implies\<close>
   etc.\ compose certified terms (or propositions) incrementally. This is
   equivalent to \<^ML>\<open>Thm.cterm_of\<close> after unchecked \<^ML_infix>\<open>$\<close>, \<^ML>\<open>lambda\<close>,
   \<^ML>\<open>Logic.all\<close>, \<^ML>\<open>Logic.mk_implies\<close> etc., but there can be a big
   difference in performance when large existing entities are composed by a few
   extra constructions on top. There are separate operations to decompose
   certified terms and theorems to produce certified terms again.
 
   \<^descr> Type \<^ML_type>\<open>thm\<close> represents proven propositions. This is an abstract
   datatype that guarantees that its values have been constructed by basic
   principles of the \<^ML_structure>\<open>Thm\<close> module. Every \<^ML_type>\<open>thm\<close> value
   refers its background theory, cf.\ \secref{sec:context-theory}.
 
   \<^descr> \<^ML>\<open>Thm.transfer\<close>~\<open>thy thm\<close> transfers the given theorem to a \<^emph>\<open>larger\<close>
   theory, see also \secref{sec:context}. This formal adjustment of the
   background context has no logical significance, but is occasionally required
   for formal reasons, e.g.\ when theorems that are imported from more basic
   theories are used in the current situation.
 
   \<^descr> \<^ML>\<open>Thm.assume\<close>, \<^ML>\<open>Thm.forall_intr\<close>, \<^ML>\<open>Thm.forall_elim\<close>, \<^ML>\<open>Thm.implies_intr\<close>, and \<^ML>\<open>Thm.implies_elim\<close> correspond to the primitive
   inferences of \figref{fig:prim-rules}.
 
   \<^descr> \<^ML>\<open>Thm.generalize\<close>~\<open>(\<^vec>\<alpha>, \<^vec>x)\<close> corresponds to the
   \<open>generalize\<close> rules of \figref{fig:subst-rules}. Here collections of type and
   term variables are generalized simultaneously, specified by the given sets of
   basic names.
 
   \<^descr> \<^ML>\<open>Thm.instantiate\<close>~\<open>(\<^vec>\<alpha>\<^sub>s, \<^vec>x\<^sub>\<tau>)\<close> corresponds to the
   \<open>instantiate\<close> rules of \figref{fig:subst-rules}. Type variables are
   substituted before term variables. Note that the types in \<open>\<^vec>x\<^sub>\<tau>\<close> refer
   to the instantiated versions.
 
   \<^descr> \<^ML>\<open>Thm.add_axiom\<close>~\<open>ctxt (name, A)\<close> declares an arbitrary proposition as
   axiom, and retrieves it as a theorem from the resulting theory, cf.\ \<open>axiom\<close>
   in \figref{fig:prim-rules}. Note that the low-level representation in the
   axiom table may differ slightly from the returned theorem.
 
   \<^descr> \<^ML>\<open>Thm.add_oracle\<close>~\<open>(binding, oracle)\<close> produces a named oracle rule,
   essentially generating arbitrary axioms on the fly, cf.\ \<open>axiom\<close> in
   \figref{fig:prim-rules}.
 
   \<^descr> \<^ML>\<open>Thm.add_def\<close>~\<open>ctxt unchecked overloaded (name, c \<^vec>x \<equiv> t)\<close>
   states a definitional axiom for an existing constant \<open>c\<close>. Dependencies are
   recorded via \<^ML>\<open>Theory.add_deps\<close>, unless the \<open>unchecked\<close> option is set.
   Note that the low-level representation in the axiom table may differ
   slightly from the returned theorem.
 
   \<^descr> \<^ML>\<open>Theory.add_deps\<close>~\<open>ctxt name c\<^sub>\<tau> \<^vec>d\<^sub>\<sigma>\<close> declares dependencies of
   a named specification for constant \<open>c\<^sub>\<tau>\<close>, relative to existing
   specifications for constants \<open>\<^vec>d\<^sub>\<sigma>\<close>. This also works for type
   constructors.
 
   \<^descr> \<^ML>\<open>Thm_Deps.all_oracles\<close>~\<open>thms\<close> returns all oracles used in the
   internal derivation of the given theorems; this covers the full graph of
   transitive dependencies. The result contains an authentic oracle name; if
   @{ML Proofterm.proofs} was at least @{ML 1} during the oracle inference, it
   also contains the position of the oracle invocation and its proposition. See
   also the command @{command_ref "thm_oracles"}.
 \<close>
 
 text %mlantiq \<open>
   \begin{matharray}{rcl}
   @{ML_antiquotation_def "ctyp"} & : & \<open>ML_antiquotation\<close> \\
   @{ML_antiquotation_def "cterm"} & : & \<open>ML_antiquotation\<close> \\
   @{ML_antiquotation_def "cprop"} & : & \<open>ML_antiquotation\<close> \\
   @{ML_antiquotation_def "thm"} & : & \<open>ML_antiquotation\<close> \\
   @{ML_antiquotation_def "thms"} & : & \<open>ML_antiquotation\<close> \\
   @{ML_antiquotation_def "lemma"} & : & \<open>ML_antiquotation\<close> \\
   @{ML_antiquotation_def "oracle_name"} & : & \<open>ML_antiquotation\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
   @@{ML_antiquotation ctyp} typ
   ;
   @@{ML_antiquotation cterm} term
   ;
   @@{ML_antiquotation cprop} prop
   ;
   @@{ML_antiquotation thm} thm
   ;
   @@{ML_antiquotation thms} thms
   ;
   @@{ML_antiquotation lemma} ('(' @'open' ')')? ((prop +) + @'and') \<newline>
     @{syntax for_fixes} @'by' method method?
   ;
   @@{ML_antiquotation oracle_name} embedded
   \<close>
 
   \<^descr> \<open>@{ctyp \<tau>}\<close> produces a certified type wrt.\ the current background theory
   --- as abstract value of type \<^ML_type>\<open>ctyp\<close>.
 
   \<^descr> \<open>@{cterm t}\<close> and \<open>@{cprop \<phi>}\<close> produce a certified term wrt.\ the current
   background theory --- as abstract value of type \<^ML_type>\<open>cterm\<close>.
 
   \<^descr> \<open>@{thm a}\<close> produces a singleton fact --- as abstract value of type
   \<^ML_type>\<open>thm\<close>.
 
   \<^descr> \<open>@{thms a}\<close> produces a general fact --- as abstract value of type
   \<^ML_type>\<open>thm list\<close>.
 
   \<^descr> \<open>@{lemma \<phi> by meth}\<close> produces a fact that is proven on the spot according
   to the minimal proof, which imitates a terminal Isar proof. The result is an
   abstract value of type \<^ML_type>\<open>thm\<close> or \<^ML_type>\<open>thm list\<close>, depending on
   the number of propositions given here.
 
   The internal derivation object lacks a proper theorem name, but it is
   formally closed, unless the \<open>(open)\<close> option is specified (this may impact
   performance of applications with proof terms).
 
   Since ML antiquotations are always evaluated at compile-time, there is no
   run-time overhead even for non-trivial proofs. Nonetheless, the
   justification is syntactically limited to a single @{command "by"} step.
   More complex Isar proofs should be done in regular theory source, before
   compiling the corresponding ML text that uses the result.
 
   \<^descr> \<open>@{oracle_name a}\<close> inlines the internalized oracle name \<open>a\<close> --- as
   \<^ML_type>\<open>string\<close> literal.
 \<close>
 
 
 subsection \<open>Auxiliary connectives \label{sec:logic-aux}\<close>
 
 text \<open>
   Theory \<open>Pure\<close> provides a few auxiliary connectives that are defined on top
   of the primitive ones, see \figref{fig:pure-aux}. These special constants
   are useful in certain internal encodings, and are normally not directly
   exposed to the user.
 
   \begin{figure}[htb]
   \begin{center}
   \begin{tabular}{ll}
   \<open>conjunction :: prop \<Rightarrow> prop \<Rightarrow> prop\<close> & (infix \<open>&&&\<close>) \\
   \<open>\<turnstile> A &&& B \<equiv> (\<And>C. (A \<Longrightarrow> B \<Longrightarrow> C) \<Longrightarrow> C)\<close> \\[1ex]
   \<open>prop :: prop \<Rightarrow> prop\<close> & (prefix \<open>#\<close>, suppressed) \\
   \<open>#A \<equiv> A\<close> \\[1ex]
   \<open>term :: \<alpha> \<Rightarrow> prop\<close> & (prefix \<open>TERM\<close>) \\
   \<open>term x \<equiv> (\<And>A. A \<Longrightarrow> A)\<close> \\[1ex]
   \<open>type :: \<alpha> itself\<close> & (prefix \<open>TYPE\<close>) \\
   \<open>(unspecified)\<close> \\
   \end{tabular}
   \caption{Definitions of auxiliary connectives}\label{fig:pure-aux}
   \end{center}
   \end{figure}
 
   The introduction \<open>A \<Longrightarrow> B \<Longrightarrow> A &&& B\<close>, and eliminations (projections) \<open>A &&& B
   \<Longrightarrow> A\<close> and \<open>A &&& B \<Longrightarrow> B\<close> are available as derived rules. Conjunction allows to
   treat simultaneous assumptions and conclusions uniformly, e.g.\ consider \<open>A
   \<Longrightarrow> B \<Longrightarrow> C &&& D\<close>. In particular, the goal mechanism represents multiple claims
   as explicit conjunction internally, but this is refined (via backwards
   introduction) into separate sub-goals before the user commences the proof;
   the final result is projected into a list of theorems using eliminations
   (cf.\ \secref{sec:tactical-goals}).
 
   The \<open>prop\<close> marker (\<open>#\<close>) makes arbitrarily complex propositions appear as
   atomic, without changing the meaning: \<open>\<Gamma> \<turnstile> A\<close> and \<open>\<Gamma> \<turnstile> #A\<close> are
   interchangeable. See \secref{sec:tactical-goals} for specific operations.
 
   The \<open>term\<close> marker turns any well-typed term into a derivable proposition: \<open>\<turnstile>
   TERM t\<close> holds unconditionally. Although this is logically vacuous, it allows
   to treat terms and proofs uniformly, similar to a type-theoretic framework.
 
   The \<open>TYPE\<close> constructor is the canonical representative of the unspecified
   type \<open>\<alpha> itself\<close>; it essentially injects the language of types into that of
   terms. There is specific notation \<open>TYPE(\<tau>)\<close> for \<open>TYPE\<^bsub>\<tau> itself\<^esub>\<close>. Although
   being devoid of any particular meaning, the term \<open>TYPE(\<tau>)\<close> accounts for the
   type \<open>\<tau>\<close> within the term language. In particular, \<open>TYPE(\<alpha>)\<close> may be used as
   formal argument in primitive definitions, in order to circumvent hidden
   polymorphism (cf.\ \secref{sec:terms}). For example, \<open>c TYPE(\<alpha>) \<equiv> A[\<alpha>]\<close>
   defines \<open>c :: \<alpha> itself \<Rightarrow> prop\<close> in terms of a proposition \<open>A\<close> that depends on
   an additional type argument, which is essentially a predicate on types.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
   @{define_ML Conjunction.intr: "thm -> thm -> thm"} \\
   @{define_ML Conjunction.elim: "thm -> thm * thm"} \\
   @{define_ML Drule.mk_term: "cterm -> thm"} \\
   @{define_ML Drule.dest_term: "thm -> cterm"} \\
   @{define_ML Logic.mk_type: "typ -> term"} \\
   @{define_ML Logic.dest_type: "term -> typ"} \\
   \end{mldecls}
 
   \<^descr> \<^ML>\<open>Conjunction.intr\<close> derives \<open>A &&& B\<close> from \<open>A\<close> and \<open>B\<close>.
 
   \<^descr> \<^ML>\<open>Conjunction.elim\<close> derives \<open>A\<close> and \<open>B\<close> from \<open>A &&& B\<close>.
 
   \<^descr> \<^ML>\<open>Drule.mk_term\<close> derives \<open>TERM t\<close>.
 
   \<^descr> \<^ML>\<open>Drule.dest_term\<close> recovers term \<open>t\<close> from \<open>TERM t\<close>.
 
   \<^descr> \<^ML>\<open>Logic.mk_type\<close>~\<open>\<tau>\<close> produces the term \<open>TYPE(\<tau>)\<close>.
 
   \<^descr> \<^ML>\<open>Logic.dest_type\<close>~\<open>TYPE(\<tau>)\<close> recovers the type \<open>\<tau>\<close>.
 \<close>
 
 
 subsection \<open>Sort hypotheses\<close>
 
 text \<open>
   Type variables are decorated with sorts, as explained in \secref{sec:types}.
   This constrains type instantiation to certain ranges of types: variable
   \<open>\<alpha>\<^sub>s\<close> may only be assigned to types \<open>\<tau>\<close> that belong to sort \<open>s\<close>. Within the
   logic, sort constraints act like implicit preconditions on the result \<open>\<lparr>\<alpha>\<^sub>1
   : s\<^sub>1\<rparr>, \<dots>, \<lparr>\<alpha>\<^sub>n : s\<^sub>n\<rparr>, \<Gamma> \<turnstile> \<phi>\<close> where the type variables \<open>\<alpha>\<^sub>1, \<dots>, \<alpha>\<^sub>n\<close> cover
   the propositions \<open>\<Gamma>\<close>, \<open>\<phi>\<close>, as well as the proof of \<open>\<Gamma> \<turnstile> \<phi>\<close>.
 
   These \<^emph>\<open>sort hypothesis\<close> of a theorem are passed monotonically through
   further derivations. They are redundant, as long as the statement of a
   theorem still contains the type variables that are accounted here. The
   logical significance of sort hypotheses is limited to the boundary case
   where type variables disappear from the proposition, e.g.\ \<open>\<lparr>\<alpha>\<^sub>s : s\<rparr> \<turnstile> \<phi>\<close>.
   Since such dangling type variables can be renamed arbitrarily without
   changing the proposition \<open>\<phi>\<close>, the inference kernel maintains sort hypotheses
   in anonymous form \<open>s \<turnstile> \<phi>\<close>.
 
   In most practical situations, such extra sort hypotheses may be stripped in
   a final bookkeeping step, e.g.\ at the end of a proof: they are typically
   left over from intermediate reasoning with type classes that can be
   satisfied by some concrete type \<open>\<tau>\<close> of sort \<open>s\<close> to replace the hypothetical
   type variable \<open>\<alpha>\<^sub>s\<close>.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
   @{define_ML Thm.extra_shyps: "thm -> sort list"} \\
   @{define_ML Thm.strip_shyps: "thm -> thm"} \\
   \end{mldecls}
 
   \<^descr> \<^ML>\<open>Thm.extra_shyps\<close>~\<open>thm\<close> determines the extraneous sort hypotheses of
   the given theorem, i.e.\ the sorts that are not present within type
   variables of the statement.
 
   \<^descr> \<^ML>\<open>Thm.strip_shyps\<close>~\<open>thm\<close> removes any extraneous sort hypotheses that
   can be witnessed from the type signature.
 \<close>
 
 text %mlex \<open>
   The following artificial example demonstrates the derivation of \<^prop>\<open>False\<close> with a pending sort hypothesis involving a logically empty sort.
 \<close>
 
 class empty =
   assumes bad: "\<And>(x::'a) y. x \<noteq> y"
 
 theorem (in empty) false: False
   using bad by blast
 
 ML_val \<open>\<^assert> (Thm.extra_shyps @{thm false} = [\<^sort>\<open>empty\<close>])\<close>
 
 text \<open>
   Thanks to the inference kernel managing sort hypothesis according to their
   logical significance, this example is merely an instance of \<^emph>\<open>ex falso
   quodlibet consequitur\<close> --- not a collapse of the logical framework!
 \<close>
 
 
 section \<open>Object-level rules \label{sec:obj-rules}\<close>
 
 text \<open>
   The primitive inferences covered so far mostly serve foundational purposes.
   User-level reasoning usually works via object-level rules that are
   represented as theorems of Pure. Composition of rules involves
   \<^emph>\<open>backchaining\<close>, \<^emph>\<open>higher-order unification\<close> modulo \<open>\<alpha>\<beta>\<eta>\<close>-conversion of
   \<open>\<lambda>\<close>-terms, and so-called \<^emph>\<open>lifting\<close> of rules into a context of \<open>\<And>\<close> and \<open>\<Longrightarrow>\<close>
   connectives. Thus the full power of higher-order Natural Deduction in
   Isabelle/Pure becomes readily available.
 \<close>
 
 
 subsection \<open>Hereditary Harrop Formulae\<close>
 
 text \<open>
   The idea of object-level rules is to model Natural Deduction inferences in
-  the style of Gentzen @{cite "Gentzen:1935"}, but we allow arbitrary nesting
-  similar to @{cite "Schroeder-Heister:1984"}. The most basic rule format is
+  the style of Gentzen \<^cite>\<open>"Gentzen:1935"\<close>, but we allow arbitrary nesting
+  similar to \<^cite>\<open>"Schroeder-Heister:1984"\<close>. The most basic rule format is
   that of a \<^emph>\<open>Horn Clause\<close>:
   \[
   \infer{\<open>A\<close>}{\<open>A\<^sub>1\<close> & \<open>\<dots>\<close> & \<open>A\<^sub>n\<close>}
   \]
   where \<open>A, A\<^sub>1, \<dots>, A\<^sub>n\<close> are atomic propositions of the framework, usually of
   the form \<open>Trueprop B\<close>, where \<open>B\<close> is a (compound) object-level statement.
   This object-level inference corresponds to an iterated implication in Pure
   like this:
   \[
   \<open>A\<^sub>1 \<Longrightarrow> \<dots> A\<^sub>n \<Longrightarrow> A\<close>
   \]
   As an example consider conjunction introduction: \<open>A \<Longrightarrow> B \<Longrightarrow> A \<and> B\<close>. Any
   parameters occurring in such rule statements are conceptionally treated as
   arbitrary:
   \[
   \<open>\<And>x\<^sub>1 \<dots> x\<^sub>m. A\<^sub>1 x\<^sub>1 \<dots> x\<^sub>m \<Longrightarrow> \<dots> A\<^sub>n x\<^sub>1 \<dots> x\<^sub>m \<Longrightarrow> A x\<^sub>1 \<dots> x\<^sub>m\<close>
   \]
 
   Nesting of rules means that the positions of \<open>A\<^sub>i\<close> may again hold compound
   rules, not just atomic propositions. Propositions of this format are called
-  \<^emph>\<open>Hereditary Harrop Formulae\<close> in the literature @{cite "Miller:1991"}. Here
+  \<^emph>\<open>Hereditary Harrop Formulae\<close> in the literature \<^cite>\<open>"Miller:1991"\<close>. Here
   we give an inductive characterization as follows:
 
   \<^medskip>
   \begin{tabular}{ll}
   \<open>\<^bold>x\<close> & set of variables \\
   \<open>\<^bold>A\<close> & set of atomic propositions \\
   \<open>\<^bold>H  =  \<And>\<^bold>x\<^sup>*. \<^bold>H\<^sup>* \<Longrightarrow> \<^bold>A\<close> & set of Hereditary Harrop Formulas \\
   \end{tabular}
   \<^medskip>
 
   Thus we essentially impose nesting levels on propositions formed from \<open>\<And>\<close>
   and \<open>\<Longrightarrow>\<close>. At each level there is a prefix of parameters and compound
   premises, concluding an atomic proposition. Typical examples are
   \<open>\<longrightarrow>\<close>-introduction \<open>(A \<Longrightarrow> B) \<Longrightarrow> A \<longrightarrow> B\<close> or mathematical induction \<open>P 0 \<Longrightarrow> (\<And>n. P n
   \<Longrightarrow> P (Suc n)) \<Longrightarrow> P n\<close>. Even deeper nesting occurs in well-founded induction
   \<open>(\<And>x. (\<And>y. y \<prec> x \<Longrightarrow> P y) \<Longrightarrow> P x) \<Longrightarrow> P x\<close>, but this already marks the limit of
   rule complexity that is usually seen in practice.
 
   \<^medskip>
   Regular user-level inferences in Isabelle/Pure always maintain the following
   canonical form of results:
 
   \<^item> Normalization by \<open>(A \<Longrightarrow> (\<And>x. B x)) \<equiv> (\<And>x. A \<Longrightarrow> B x)\<close>, which is a theorem of
   Pure, means that quantifiers are pushed in front of implication at each
   level of nesting. The normal form is a Hereditary Harrop Formula.
 
   \<^item> The outermost prefix of parameters is represented via schematic variables:
   instead of \<open>\<And>\<^vec>x. \<^vec>H \<^vec>x \<Longrightarrow> A \<^vec>x\<close> we have \<open>\<^vec>H
   ?\<^vec>x \<Longrightarrow> A ?\<^vec>x\<close>. Note that this representation looses information
   about the order of parameters, and vacuous quantifiers vanish automatically.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
   @{define_ML Simplifier.norm_hhf: "Proof.context -> thm -> thm"} \\
   \end{mldecls}
 
   \<^descr> \<^ML>\<open>Simplifier.norm_hhf\<close>~\<open>ctxt thm\<close> normalizes the given theorem
   according to the canonical form specified above. This is occasionally
   helpful to repair some low-level tools that do not handle Hereditary Harrop
   Formulae properly.
 \<close>
 
 
 subsection \<open>Rule composition\<close>
 
 text \<open>
   The rule calculus of Isabelle/Pure provides two main inferences: @{inference
   resolution} (i.e.\ back-chaining of rules) and @{inference assumption}
   (i.e.\ closing a branch), both modulo higher-order unification. There are
   also combined variants, notably @{inference elim_resolution} and @{inference
   dest_resolution}.
 
   To understand the all-important @{inference resolution} principle, we first
   consider raw @{inference_def composition} (modulo higher-order unification
   with substitution \<open>\<vartheta>\<close>):
   \[
   \infer[(@{inference_def composition})]{\<open>\<^vec>A\<vartheta> \<Longrightarrow> C\<vartheta>\<close>}
   {\<open>\<^vec>A \<Longrightarrow> B\<close> & \<open>B' \<Longrightarrow> C\<close> & \<open>B\<vartheta> = B'\<vartheta>\<close>}
   \]
   Here the conclusion of the first rule is unified with the premise of the
   second; the resulting rule instance inherits the premises of the first and
   conclusion of the second. Note that \<open>C\<close> can again consist of iterated
   implications. We can also permute the premises of the second rule
   back-and-forth in order to compose with \<open>B'\<close> in any position (subsequently
   we shall always refer to position 1 w.l.o.g.).
 
   In @{inference composition} the internal structure of the common part \<open>B\<close>
   and \<open>B'\<close> is not taken into account. For proper @{inference resolution} we
   require \<open>B\<close> to be atomic, and explicitly observe the structure \<open>\<And>\<^vec>x.
   \<^vec>H \<^vec>x \<Longrightarrow> B' \<^vec>x\<close> of the premise of the second rule. The idea
   is to adapt the first rule by ``lifting'' it into this context, by means of
   iterated application of the following inferences:
   \[
   \infer[(@{inference_def imp_lift})]{\<open>(\<^vec>H \<Longrightarrow> \<^vec>A) \<Longrightarrow> (\<^vec>H \<Longrightarrow> B)\<close>}{\<open>\<^vec>A \<Longrightarrow> B\<close>}
   \]
   \[
   \infer[(@{inference_def all_lift})]{\<open>(\<And>\<^vec>x. \<^vec>A (?\<^vec>a \<^vec>x)) \<Longrightarrow> (\<And>\<^vec>x. B (?\<^vec>a \<^vec>x))\<close>}{\<open>\<^vec>A ?\<^vec>a \<Longrightarrow> B ?\<^vec>a\<close>}
   \]
   By combining raw composition with lifting, we get full @{inference
   resolution} as follows:
   \[
   \infer[(@{inference_def resolution})]
   {\<open>(\<And>\<^vec>x. \<^vec>H \<^vec>x \<Longrightarrow> \<^vec>A (?\<^vec>a \<^vec>x))\<vartheta> \<Longrightarrow> C\<vartheta>\<close>}
   {\begin{tabular}{l}
     \<open>\<^vec>A ?\<^vec>a \<Longrightarrow> B ?\<^vec>a\<close> \\
     \<open>(\<And>\<^vec>x. \<^vec>H \<^vec>x \<Longrightarrow> B' \<^vec>x) \<Longrightarrow> C\<close> \\
     \<open>(\<lambda>\<^vec>x. B (?\<^vec>a \<^vec>x))\<vartheta> = B'\<vartheta>\<close> \\
    \end{tabular}}
   \]
 
   Continued resolution of rules allows to back-chain a problem towards more
   and sub-problems. Branches are closed either by resolving with a rule of 0
   premises, or by producing a ``short-circuit'' within a solved situation
   (again modulo unification):
   \[
   \infer[(@{inference_def assumption})]{\<open>C\<vartheta>\<close>}
   {\<open>(\<And>\<^vec>x. \<^vec>H \<^vec>x \<Longrightarrow> A \<^vec>x) \<Longrightarrow> C\<close> & \<open>A\<vartheta> = H\<^sub>i\<vartheta>\<close>~~\mbox{(for some~\<open>i\<close>)}}
   \]
 
   %FIXME @{inference_def elim_resolution}, @{inference_def dest_resolution}
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
   @{define_ML_infix "RSN": "thm * (int * thm) -> thm"} \\
   @{define_ML_infix "RS": "thm * thm -> thm"} \\
 
   @{define_ML_infix "RLN": "thm list * (int * thm list) -> thm list"} \\
   @{define_ML_infix "RL": "thm list * thm list -> thm list"} \\
 
   @{define_ML_infix "MRS": "thm list * thm -> thm"} \\
   @{define_ML_infix "OF": "thm * thm list -> thm"} \\
   \end{mldecls}
 
   \<^descr> \<open>rule\<^sub>1 RSN (i, rule\<^sub>2)\<close> resolves the conclusion of \<open>rule\<^sub>1\<close> with the
   \<open>i\<close>-th premise of \<open>rule\<^sub>2\<close>, according to the @{inference resolution}
   principle explained above. Unless there is precisely one resolvent it raises
   exception \<^ML>\<open>THM\<close>.
 
   This corresponds to the rule attribute @{attribute THEN} in Isar source
   language.
 
   \<^descr> \<open>rule\<^sub>1 RS rule\<^sub>2\<close> abbreviates \<open>rule\<^sub>1 RSN (1, rule\<^sub>2)\<close>.
 
   \<^descr> \<open>rules\<^sub>1 RLN (i, rules\<^sub>2)\<close> joins lists of rules. For every \<open>rule\<^sub>1\<close> in
   \<open>rules\<^sub>1\<close> and \<open>rule\<^sub>2\<close> in \<open>rules\<^sub>2\<close>, it resolves the conclusion of \<open>rule\<^sub>1\<close>
   with the \<open>i\<close>-th premise of \<open>rule\<^sub>2\<close>, accumulating multiple results in one
   big list. Note that such strict enumerations of higher-order unifications
   can be inefficient compared to the lazy variant seen in elementary tactics
   like \<^ML>\<open>resolve_tac\<close>.
 
   \<^descr> \<open>rules\<^sub>1 RL rules\<^sub>2\<close> abbreviates \<open>rules\<^sub>1 RLN (1, rules\<^sub>2)\<close>.
 
   \<^descr> \<open>[rule\<^sub>1, \<dots>, rule\<^sub>n] MRS rule\<close> resolves \<open>rule\<^sub>i\<close> against premise \<open>i\<close> of
   \<open>rule\<close>, for \<open>i = n, \<dots>, 1\<close>. By working from right to left, newly emerging
   premises are concatenated in the result, without interfering.
 
   \<^descr> \<open>rule OF rules\<close> is an alternative notation for \<open>rules MRS rule\<close>, which
   makes rule composition look more like function application. Note that the
   argument \<open>rules\<close> need not be atomic.
 
   This corresponds to the rule attribute @{attribute OF} in Isar source
   language.
 \<close>
 
 
 section \<open>Proof terms \label{sec:proof-terms}\<close>
 
 text \<open>
   The Isabelle/Pure inference kernel can record the proof of each theorem as a
   proof term that contains all logical inferences in detail. Rule composition
   by resolution (\secref{sec:obj-rules}) and type-class reasoning is broken
   down to primitive rules of the logical framework. The proof term can be
   inspected by a separate proof-checker, for example.
 
   According to the well-known \<^emph>\<open>Curry-Howard isomorphism\<close>, a proof can be
   viewed as a \<open>\<lambda>\<close>-term. Following this idea, proofs in Isabelle are internally
   represented by a datatype similar to the one for terms described in
   \secref{sec:terms}. On top of these syntactic terms, two more layers of
   \<open>\<lambda>\<close>-calculus are added, which correspond to \<open>\<And>x :: \<alpha>. B x\<close> and \<open>A \<Longrightarrow> B\<close>
   according to the propositions-as-types principle. The resulting 3-level
   \<open>\<lambda>\<close>-calculus resembles ``\<open>\<lambda>HOL\<close>'' in the more abstract setting of Pure Type
-  Systems (PTS) @{cite "Barendregt-Geuvers:2001"}, if some fine points like
+  Systems (PTS) \<^cite>\<open>"Barendregt-Geuvers:2001"\<close>, if some fine points like
   schematic polymorphism and type classes are ignored.
 
   \<^medskip>
   \<^emph>\<open>Proof abstractions\<close> of the form \<open>\<^bold>\<lambda>x :: \<alpha>. prf\<close> or \<open>\<^bold>\<lambda>p : A. prf\<close>
   correspond to introduction of \<open>\<And>\<close>/\<open>\<Longrightarrow>\<close>, and \<^emph>\<open>proof applications\<close> of the form
   \<open>p \<cdot> t\<close> or \<open>p \<bullet> q\<close> correspond to elimination of \<open>\<And>\<close>/\<open>\<Longrightarrow>\<close>. Actual types \<open>\<alpha>\<close>,
   propositions \<open>A\<close>, and terms \<open>t\<close> might be suppressed and reconstructed from
   the overall proof term.
 
   \<^medskip>
   Various atomic proofs indicate special situations within the proof
   construction as follows.
 
   A \<^emph>\<open>bound proof variable\<close> is a natural number \<open>b\<close> that acts as de-Bruijn
   index for proof term abstractions.
 
   A \<^emph>\<open>minimal proof\<close> ``\<open>?\<close>'' is a dummy proof term. This indicates some
   unrecorded part of the proof.
 
   \<open>Hyp A\<close> refers to some pending hypothesis by giving its proposition. This
   indicates an open context of implicit hypotheses, similar to loose bound
   variables or free variables within a term (\secref{sec:terms}).
 
   An \<^emph>\<open>axiom\<close> or \<^emph>\<open>oracle\<close> \<open>a : A[\<^vec>\<tau>]\<close> refers some postulated \<open>proof
   constant\<close>, which is subject to schematic polymorphism of theory content, and
   the particular type instantiation may be given explicitly. The vector of
   types \<open>\<^vec>\<tau>\<close> refers to the schematic type variables in the generic
   proposition \<open>A\<close> in canonical order.
 
   A \<^emph>\<open>proof promise\<close> \<open>a : A[\<^vec>\<tau>]\<close> is a placeholder for some proof of
   polymorphic proposition \<open>A\<close>, with explicit type instantiation as given by
   the vector \<open>\<^vec>\<tau>\<close>, as above. Unlike axioms or oracles, proof promises
   may be \<^emph>\<open>fulfilled\<close> eventually, by substituting \<open>a\<close> by some particular proof
   \<open>q\<close> at the corresponding type instance. This acts like Hindley-Milner
   \<open>let\<close>-polymorphism: a generic local proof definition may get used at
   different type instances, and is replaced by the concrete instance
   eventually.
 
   A \<^emph>\<open>named theorem\<close> wraps up some concrete proof as a closed formal entity,
   in the manner of constant definitions for proof terms. The \<^emph>\<open>proof body\<close> of
   such boxed theorems involves some digest about oracles and promises
   occurring in the original proof. This allows the inference kernel to manage
   this critical information without the full overhead of explicit proof terms.
 \<close>
 
 
 subsection \<open>Reconstructing and checking proof terms\<close>
 
 text \<open>
   Fully explicit proof terms can be large, but most of this information is
   redundant and can be reconstructed from the context. Therefore, the
   Isabelle/Pure inference kernel records only \<^emph>\<open>implicit\<close> proof terms, by
   omitting all typing information in terms, all term and type labels of proof
   abstractions, and some argument terms of applications \<open>p \<cdot> t\<close> (if possible).
 
   There are separate operations to reconstruct the full proof term later on,
-  using \<^emph>\<open>higher-order pattern unification\<close> @{cite "nipkow-patterns" and
-  "Berghofer-Nipkow:2000:TPHOL"}.
+  using \<^emph>\<open>higher-order pattern unification\<close> \<^cite>\<open>"nipkow-patterns" and
+  "Berghofer-Nipkow:2000:TPHOL"\<close>.
 
   The \<^emph>\<open>proof checker\<close> expects a fully reconstructed proof term, and can turn
   it into a theorem by replaying its primitive inferences within the kernel.
 \<close>
 
 
 subsection \<open>Concrete syntax of proof terms\<close>
 
 text \<open>
   The concrete syntax of proof terms is a slight extension of the regular
-  inner syntax of Isabelle/Pure @{cite "isabelle-isar-ref"}. Its main
+  inner syntax of Isabelle/Pure \<^cite>\<open>"isabelle-isar-ref"\<close>. Its main
   syntactic category @{syntax (inner) proof} is defined as follows:
 
   \begin{center}
   \begin{supertabular}{rclr}
 
   @{syntax_def (inner) proof} & = & \<open>\<^bold>\<lambda>\<close> \<open>params\<close> \<^verbatim>\<open>.\<close> \<open>proof\<close> \\
     & \<open>|\<close> & \<open>proof\<close> \<open>\<cdot>\<close> \<open>any\<close> \\
     & \<open>|\<close> & \<open>proof\<close> \<open>\<bullet>\<close> \<open>proof\<close> \\
     & \<open>|\<close> & \<open>id  |  longid\<close> \\
   \\
 
   \<open>param\<close> & = & \<open>idt\<close> \\
     & \<open>|\<close> & \<open>idt\<close> \<^verbatim>\<open>:\<close> \<open>prop\<close> \\
     & \<open>|\<close> & \<^verbatim>\<open>(\<close> \<open>param\<close> \<^verbatim>\<open>)\<close> \\
   \\
 
   \<open>params\<close> & = & \<open>param\<close> \\
     & \<open>|\<close> & \<open>param\<close> \<open>params\<close> \\
 
   \end{supertabular}
   \end{center}
 
   Implicit term arguments in partial proofs are indicated by ``\<open>_\<close>''. Type
   arguments for theorems and axioms may be specified using \<open>p \<cdot> TYPE(type)\<close>
   (they must appear before any other term argument of a theorem or axiom, but
   may be omitted altogether).
 
   \<^medskip>
   There are separate read and print operations for proof terms, in order to
   avoid conflicts with the regular term language.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
   @{define_ML_type proof} \\
   @{define_ML_type proof_body} \\
   @{define_ML Proofterm.proofs: "int Unsynchronized.ref"} \\
   @{define_ML Proofterm.reconstruct_proof:
   "theory -> term -> proof -> proof"} \\
   @{define_ML Proofterm.expand_proof: "theory ->
   (Proofterm.thm_header -> string option) -> proof -> proof"} \\
   @{define_ML Proof_Checker.thm_of_proof: "theory -> proof -> thm"} \\
   @{define_ML Proof_Syntax.read_proof: "theory -> bool -> bool -> string -> proof"} \\
   @{define_ML Proof_Syntax.pretty_proof: "Proof.context -> proof -> Pretty.T"} \\
   \end{mldecls}
 
   \<^descr> Type \<^ML_type>\<open>proof\<close> represents proof terms; this is a datatype with
   constructors @{define_ML Abst}, @{define_ML AbsP}, @{define_ML_infix "%"},
   @{define_ML_infix "%%"}, @{define_ML PBound}, @{define_ML MinProof}, @{define_ML
   Hyp}, @{define_ML PAxm}, @{define_ML Oracle}, @{define_ML PThm} as explained
   above. %FIXME PClass (!?)
 
   \<^descr> Type \<^ML_type>\<open>proof_body\<close> represents the nested proof information of a
   named theorem, consisting of a digest of oracles and named theorem over some
   proof term. The digest only covers the directly visible part of the proof:
   in order to get the full information, the implicit graph of nested theorems
   needs to be traversed (e.g.\ using \<^ML>\<open>Proofterm.fold_body_thms\<close>).
 
   \<^descr> \<^ML>\<open>Thm.proof_of\<close>~\<open>thm\<close> and \<^ML>\<open>Thm.proof_body_of\<close>~\<open>thm\<close> produce the
   proof term or proof body (with digest of oracles and theorems) from a given
   theorem. Note that this involves a full join of internal futures that
   fulfill pending proof promises, and thus disrupts the natural bottom-up
   construction of proofs by introducing dynamic ad-hoc dependencies. Parallel
   performance may suffer by inspecting proof terms at run-time.
 
   \<^descr> \<^ML>\<open>Proofterm.proofs\<close> specifies the detail of proof recording within
   \<^ML_type>\<open>thm\<close> values produced by the inference kernel: \<^ML>\<open>0\<close> records only
   the names of oracles, \<^ML>\<open>1\<close> records oracle names and propositions, \<^ML>\<open>2\<close>
   additionally records full proof terms. Officially named theorems that
   contribute to a result are recorded in any case.
 
   \<^descr> \<^ML>\<open>Proofterm.reconstruct_proof\<close>~\<open>thy prop prf\<close> turns the implicit
   proof term \<open>prf\<close> into a full proof of the given proposition.
 
   Reconstruction may fail if \<open>prf\<close> is not a proof of \<open>prop\<close>, or if it does not
   contain sufficient information for reconstruction. Failure may only happen
   for proofs that are constructed manually, but not for those produced
   automatically by the inference kernel.
 
   \<^descr> \<^ML>\<open>Proofterm.expand_proof\<close>~\<open>thy expand prf\<close> reconstructs and expands
   the proofs of nested theorems according to the given \<open>expand\<close> function: a
   result of @{ML \<open>SOME ""\<close>} means full expansion, @{ML \<open>SOME\<close>}~\<open>name\<close> means to
   keep the theorem node but replace its internal name, @{ML NONE} means no
   change.
 
   \<^descr> \<^ML>\<open>Proof_Checker.thm_of_proof\<close>~\<open>thy prf\<close> turns the given (full) proof
   into a theorem, by replaying it using only primitive rules of the inference
   kernel.
 
   \<^descr> \<^ML>\<open>Proof_Syntax.read_proof\<close>~\<open>thy b\<^sub>1 b\<^sub>2 s\<close> reads in a proof term. The
   Boolean flags indicate the use of sort and type information. Usually, typing
   information is left implicit and is inferred during proof reconstruction.
   %FIXME eliminate flags!?
 
   \<^descr> \<^ML>\<open>Proof_Syntax.pretty_proof\<close>~\<open>ctxt prf\<close> pretty-prints the given proof
   term.
 \<close>
 
 text %mlex \<open>
   \<^item> \<^file>\<open>~~/src/HOL/Proofs/ex/Proof_Terms.thy\<close> provides basic examples involving
   proof terms.
 
   \<^item> \<^file>\<open>~~/src/HOL/Proofs/ex/XML_Data.thy\<close> demonstrates export and import of
   proof terms via XML/ML data representation.
 \<close>
 
 end
diff --git a/src/Doc/Implementation/ML.thy b/src/Doc/Implementation/ML.thy
--- a/src/Doc/Implementation/ML.thy
+++ b/src/Doc/Implementation/ML.thy
@@ -1,2240 +1,2238 @@
 (*:maxLineLen=78:*)
 
 theory "ML"
 imports Base
 begin
 
 chapter \<open>Isabelle/ML\<close>
 
 text \<open>
   Isabelle/ML is best understood as a certain culture based on Standard ML.
   Thus it is not a new programming language, but a certain way to use SML at
   an advanced level within the Isabelle environment. This covers a variety of
   aspects that are geared towards an efficient and robust platform for
   applications of formal logic with fully foundational proof construction ---
   according to the well-known \<^emph>\<open>LCF principle\<close>. There is specific
   infrastructure with library modules to address the needs of this difficult
   task. For example, the raw parallel programming model of Poly/ML is
   presented as considerably more abstract concept of \<^emph>\<open>futures\<close>, which is then
   used to augment the inference kernel, Isar theory and proof interpreter, and
   PIDE document management.
 
   The main aspects of Isabelle/ML are introduced below. These first-hand
   explanations should help to understand how proper Isabelle/ML is to be read
   and written, and to get access to the wealth of experience that is expressed
   in the source text and its history of changes.\<^footnote>\<open>See
   \<^url>\<open>https://isabelle.in.tum.de/repos/isabelle\<close> for the full Mercurial history.
   There are symbolic tags to refer to official Isabelle releases, as opposed
   to arbitrary \<^emph>\<open>tip\<close> versions that merely reflect snapshots that are never
   really up-to-date.\<close>
 \<close>
 
 
 section \<open>Style and orthography\<close>
 
 text \<open>
   The sources of Isabelle/Isar are optimized for \<^emph>\<open>readability\<close> and
   \<^emph>\<open>maintainability\<close>. The main purpose is to tell an informed reader what is
   really going on and how things really work. This is a non-trivial aim, but
   it is supported by a certain style of writing Isabelle/ML that has emerged
   from long years of system development.\<^footnote>\<open>See also the interesting style guide
   for OCaml \<^url>\<open>https://caml.inria.fr/resources/doc/guides/guidelines.en.html\<close>
   which shares many of our means and ends.\<close>
 
   The main principle behind any coding style is \<^emph>\<open>consistency\<close>. For a single
   author of a small program this merely means ``choose your style and stick to
   it''. A complex project like Isabelle, with long years of development and
   different contributors, requires more standardization. A coding style that
   is changed every few years or with every new contributor is no style at all,
   because consistency is quickly lost. Global consistency is hard to achieve,
   though. Nonetheless, one should always strive at least for local consistency
   of modules and sub-systems, without deviating from some general principles
   how to write Isabelle/ML.
 
   In a sense, good coding style is like an \<^emph>\<open>orthography\<close> for the sources: it
   helps to read quickly over the text and see through the main points, without
   getting distracted by accidental presentation of free-style code.
 \<close>
 
 
 subsection \<open>Header and sectioning\<close>
 
 text \<open>
   Isabelle source files have a certain standardized header format (with
   precise spacing) that follows ancient traditions reaching back to the
   earliest versions of the system by Larry Paulson. See
   \<^file>\<open>~~/src/Pure/thm.ML\<close>, for example.
 
   The header includes at least \<^verbatim>\<open>Title\<close> and \<^verbatim>\<open>Author\<close> entries, followed by a
   prose description of the purpose of the module. The latter can range from a
   single line to several paragraphs of explanations.
 
   The rest of the file is divided into chapters, sections, subsections,
   subsubsections, paragraphs etc.\ using a simple layout via ML comments as
   follows.
 
   @{verbatim [display]
 \<open>  (**** chapter ****)
  
   (*** section ***)
 
   (** subsection **)
 
   (* subsubsection *)
 
   (*short paragraph*)
 
   (*
     long paragraph,
     with more text
   *)\<close>}
 
   As in regular typography, there is some extra space \<^emph>\<open>before\<close> section
   headings that are adjacent to plain text, but not other headings as in the
   example above.
 
   \<^medskip>
   The precise wording of the prose text given in these headings is chosen
   carefully to introduce the main theme of the subsequent formal ML text.
 \<close>
 
 
 subsection \<open>Naming conventions\<close>
 
 text \<open>
   Since ML is the primary medium to express the meaning of the source text,
   naming of ML entities requires special care.
 \<close>
 
 paragraph \<open>Notation.\<close>
 text \<open>
   A name consists of 1--3 \<^emph>\<open>words\<close> (rarely 4, but not more) that are separated
   by underscore. There are three variants concerning upper or lower case
   letters, which are used for certain ML categories as follows:
 
   \<^medskip>
   \begin{tabular}{lll}
   variant & example & ML categories \\\hline
   lower-case & \<^ML_text>\<open>foo_bar\<close> & values, types, record fields \\
   capitalized & \<^ML_text>\<open>Foo_Bar\<close> & datatype constructors, structures, functors \\
   upper-case & \<^ML_text>\<open>FOO_BAR\<close> & special values, exception constructors, signatures \\
   \end{tabular}
   \<^medskip>
 
   For historical reasons, many capitalized names omit underscores, e.g.\
   old-style \<^ML_text>\<open>FooBar\<close> instead of \<^ML_text>\<open>Foo_Bar\<close>. Genuine
   mixed-case names are \<^emph>\<open>not\<close> used, because clear division of words is
   essential for readability.\<^footnote>\<open>Camel-case was invented to workaround the lack
   of underscore in some early non-ASCII character sets. Later it became
   habitual in some language communities that are now strong in numbers.\<close>
 
   A single (capital) character does not count as ``word'' in this respect:
   some Isabelle/ML names are suffixed by extra markers like this: \<^ML_text>\<open>foo_barT\<close>.
 
   Name variants are produced by adding 1--3 primes, e.g.\ \<^ML_text>\<open>foo'\<close>,
   \<^ML_text>\<open>foo''\<close>, or \<^ML_text>\<open>foo'''\<close>, but not \<^ML_text>\<open>foo''''\<close> or more.
   Decimal digits scale better to larger numbers, e.g.\ \<^ML_text>\<open>foo0\<close>,
   \<^ML_text>\<open>foo1\<close>, \<^ML_text>\<open>foo42\<close>.
 \<close>
 
 paragraph \<open>Scopes.\<close>
 text \<open>
   Apart from very basic library modules, ML structures are not ``opened'', but
   names are referenced with explicit qualification, as in
   \<^ML>\<open>Syntax.string_of_term\<close> for example. When devising names for
   structures and their components it is important to aim at eye-catching
   compositions of both parts, because this is how they are seen in the sources
   and documentation. For the same reasons, aliases of well-known library
   functions should be avoided.
 
   Local names of function abstraction or case/let bindings are typically
   shorter, sometimes using only rudiments of ``words'', while still avoiding
   cryptic shorthands. An auxiliary function called \<^ML_text>\<open>helper\<close>,
   \<^ML_text>\<open>aux\<close>, or \<^ML_text>\<open>f\<close> is considered bad style.
 
   Example:
 
   @{verbatim [display]
 \<open>  (* RIGHT *)
 
   fun print_foo ctxt foo =
     let
       fun print t = ... Syntax.string_of_term ctxt t ...
     in ... end;
 
 
   (* RIGHT *)
 
   fun print_foo ctxt foo =
     let
       val string_of_term = Syntax.string_of_term ctxt;
       fun print t = ... string_of_term t ...
     in ... end;
 
 
   (* WRONG *)
 
   val string_of_term = Syntax.string_of_term;
 
   fun print_foo ctxt foo =
     let
       fun aux t = ... string_of_term ctxt t ...
     in ... end;\<close>}
 \<close>
 
 paragraph \<open>Specific conventions.\<close>
 text \<open>
   Here are some specific name forms that occur frequently in the sources.
 
   \<^item> A function that maps \<^ML_text>\<open>foo\<close> to \<^ML_text>\<open>bar\<close> is called
   \<^ML_text>\<open>foo_to_bar\<close> or \<^ML_text>\<open>bar_of_foo\<close> (never
   \<^ML_text>\<open>foo2bar\<close>, nor \<^ML_text>\<open>bar_from_foo\<close>, nor
   \<^ML_text>\<open>bar_for_foo\<close>, nor \<^ML_text>\<open>bar4foo\<close>).
 
   \<^item> The name component \<^ML_text>\<open>legacy\<close> means that the operation is about to
   be discontinued soon.
 
   \<^item> The name component \<^ML_text>\<open>global\<close> means that this works with the
   background theory instead of the regular local context
   (\secref{sec:context}), sometimes for historical reasons, sometimes due a
   genuine lack of locality of the concept involved, sometimes as a fall-back
   for the lack of a proper context in the application code. Whenever there is
   a non-global variant available, the application should be migrated to use it
   with a proper local context.
 
   \<^item> Variables of the main context types of the Isabelle/Isar framework
   (\secref{sec:context} and \chref{ch:local-theory}) have firm naming
   conventions as follows:
 
     \<^item> theories are called \<^ML_text>\<open>thy\<close>, rarely \<^ML_text>\<open>theory\<close>
     (never \<^ML_text>\<open>thry\<close>)
 
     \<^item> proof contexts are called \<^ML_text>\<open>ctxt\<close>, rarely \<^ML_text>\<open>context\<close>
     (never \<^ML_text>\<open>ctx\<close>)
 
     \<^item> generic contexts are called \<^ML_text>\<open>context\<close>
 
     \<^item> local theories are called \<^ML_text>\<open>lthy\<close>, except for local
     theories that are treated as proof context (which is a semantic
     super-type)
 
   Variations with primed or decimal numbers are always possible, as well as
   semantic prefixes like \<^ML_text>\<open>foo_thy\<close> or \<^ML_text>\<open>bar_ctxt\<close>, but the
   base conventions above need to be preserved. This allows to emphasize their
   data flow via plain regular expressions in the text editor.
 
   \<^item> The main logical entities (\secref{ch:logic}) have established naming
   convention as follows:
 
     \<^item> sorts are called \<^ML_text>\<open>S\<close>
 
     \<^item> types are called \<^ML_text>\<open>T\<close>, \<^ML_text>\<open>U\<close>, or \<^ML_text>\<open>ty\<close> (never
     \<^ML_text>\<open>t\<close>)
 
     \<^item> terms are called \<^ML_text>\<open>t\<close>, \<^ML_text>\<open>u\<close>, or \<^ML_text>\<open>tm\<close> (never
     \<^ML_text>\<open>trm\<close>)
 
     \<^item> certified types are called \<^ML_text>\<open>cT\<close>, rarely \<^ML_text>\<open>T\<close>, with
     variants as for types
 
     \<^item> certified terms are called \<^ML_text>\<open>ct\<close>, rarely \<^ML_text>\<open>t\<close>, with
     variants as for terms (never \<^ML_text>\<open>ctrm\<close>)
 
     \<^item> theorems are called \<^ML_text>\<open>th\<close>, or \<^ML_text>\<open>thm\<close>
 
   Proper semantic names override these conventions completely. For example,
   the left-hand side of an equation (as a term) can be called \<^ML_text>\<open>lhs\<close>
   (not \<^ML_text>\<open>lhs_tm\<close>). Or a term that is known to be a variable can be
   called \<^ML_text>\<open>v\<close> or \<^ML_text>\<open>x\<close>.
 
   \<^item> Tactics (\secref{sec:tactics}) are sufficiently important to have specific
   naming conventions. The name of a basic tactic definition always has a
   \<^ML_text>\<open>_tac\<close> suffix, the subgoal index (if applicable) is always called
   \<^ML_text>\<open>i\<close>, and the goal state (if made explicit) is usually called
   \<^ML_text>\<open>st\<close> instead of the somewhat misleading \<^ML_text>\<open>thm\<close>. Any other
   arguments are given before the latter two, and the general context is given
   first. Example:
 
   @{verbatim [display] \<open>  fun my_tac ctxt arg1 arg2 i st = ...\<close>}
 
   Note that the goal state \<^ML_text>\<open>st\<close> above is rarely made explicit, if
   tactic combinators (tacticals) are used as usual.
 
   A tactic that requires a proof context needs to make that explicit as seen
   in the \<^verbatim>\<open>ctxt\<close> argument above. Do not refer to the background theory of
   \<^verbatim>\<open>st\<close> -- it is not a proper context, but merely a formal certificate.
 \<close>
 
 
 subsection \<open>General source layout\<close>
 
 text \<open>
   The general Isabelle/ML source layout imitates regular type-setting
   conventions, augmented by the requirements for deeply nested expressions
   that are commonplace in functional programming.
 \<close>
 
 paragraph \<open>Line length\<close>
 text \<open>
   is limited to 80 characters according to ancient standards, but we allow as
   much as 100 characters (not more).\<^footnote>\<open>Readability requires to keep the
   beginning of a line in view while watching its end. Modern wide-screen
   displays do not change the way how the human brain works. Sources also need
   to be printable on plain paper with reasonable font-size.\<close> The extra 20
   characters acknowledge the space requirements due to qualified library
   references in Isabelle/ML.
 \<close>
 
 paragraph \<open>White-space\<close>
 text \<open>
   is used to emphasize the structure of expressions, following mostly standard
   conventions for mathematical typesetting, as can be seen in plain {\TeX} or
   {\LaTeX}. This defines positioning of spaces for parentheses, punctuation,
   and infixes as illustrated here:
 
   @{verbatim [display]
 \<open>  val x = y + z * (a + b);
   val pair = (a, b);
   val record = {foo = 1, bar = 2};\<close>}
 
   Lines are normally broken \<^emph>\<open>after\<close> an infix operator or punctuation
   character. For example:
 
   @{verbatim [display]
 \<open>
   val x =
     a +
     b +
     c;
 
   val tuple =
    (a,
     b,
     c);
 \<close>}
 
   Some special infixes (e.g.\ \<^ML_text>\<open>|>\<close>) work better at the start of the
   line, but punctuation is always at the end.
 
   Function application follows the tradition of \<open>\<lambda>\<close>-calculus, not informal
   mathematics. For example: \<^ML_text>\<open>f a b\<close> for a curried function, or
   \<^ML_text>\<open>g (a, b)\<close> for a tupled function. Note that the space between
   \<^ML_text>\<open>g\<close> and the pair \<^ML_text>\<open>(a, b)\<close> follows the important
   principle of \<^emph>\<open>compositionality\<close>: the layout of \<^ML_text>\<open>g p\<close> does not
   change when \<^ML_text>\<open>p\<close> is refined to the concrete pair \<^ML_text>\<open>(a,
   b)\<close>.
 \<close>
 
 paragraph \<open>Indentation\<close>
 text \<open>
   uses plain spaces, never hard tabulators.\<^footnote>\<open>Tabulators were invented to move
   the carriage of a type-writer to certain predefined positions. In software
   they could be used as a primitive run-length compression of consecutive
   spaces, but the precise result would depend on non-standardized text editor
   configuration.\<close>
 
   Each level of nesting is indented by 2 spaces, sometimes 1, very rarely 4,
   never 8 or any other odd number.
 
   Indentation follows a simple logical format that only depends on the nesting
   depth, not the accidental length of the text that initiates a level of
   nesting. Example:
 
   @{verbatim [display]
 \<open>  (* RIGHT *)
 
   if b then
     expr1_part1
     expr1_part2
   else
     expr2_part1
     expr2_part2
 
 
   (* WRONG *)
 
   if b then expr1_part1
             expr1_part2
   else expr2_part1
        expr2_part2\<close>}
 
   The second form has many problems: it assumes a fixed-width font when
   viewing the sources, it uses more space on the line and thus makes it hard
   to observe its strict length limit (working against \<^emph>\<open>readability\<close>), it
   requires extra editing to adapt the layout to changes of the initial text
   (working against \<^emph>\<open>maintainability\<close>) etc.
 
   \<^medskip>
   For similar reasons, any kind of two-dimensional or tabular layouts,
   ASCII-art with lines or boxes of asterisks etc.\ should be avoided.
 \<close>
 
 paragraph \<open>Complex expressions\<close>
 text \<open>
   that consist of multi-clausal function definitions, \<^ML_text>\<open>handle\<close>,
   \<^ML_text>\<open>case\<close>, \<^ML_text>\<open>let\<close> (and combinations) require special
   attention. The syntax of Standard ML is quite ambitious and admits a lot of
   variance that can distort the meaning of the text.
 
   Multiple clauses of \<^ML_text>\<open>fun\<close>, \<^ML_text>\<open>fn\<close>, \<^ML_text>\<open>handle\<close>,
   \<^ML_text>\<open>case\<close> get extra indentation to indicate the nesting clearly.
   Example:
 
   @{verbatim [display]
 \<open>  (* RIGHT *)
 
   fun foo p1 =
         expr1
     | foo p2 =
         expr2
 
 
   (* WRONG *)
 
   fun foo p1 =
     expr1
     | foo p2 =
     expr2\<close>}
 
   Body expressions consisting of \<^ML_text>\<open>case\<close> or \<^ML_text>\<open>let\<close> require
   care to maintain compositionality, to prevent loss of logical indentation
   where it is especially important to see the structure of the text. Example:
 
   @{verbatim [display]
 \<open>  (* RIGHT *)
 
   fun foo p1 =
         (case e of
           q1 => ...
         | q2 => ...)
     | foo p2 =
         let
           ...
         in
           ...
         end
 
 
   (* WRONG *)
 
   fun foo p1 = case e of
       q1 => ...
     | q2 => ...
     | foo p2 =
     let
       ...
     in
       ...
     end\<close>}
 
   Extra parentheses around \<^ML_text>\<open>case\<close> expressions are optional, but help
   to analyse the nesting based on character matching in the text editor.
 
   \<^medskip>
   There are two main exceptions to the overall principle of compositionality
   in the layout of complex expressions.
 
   \<^enum> \<^ML_text>\<open>if\<close> expressions are iterated as if ML had multi-branch
   conditionals, e.g.
 
   @{verbatim [display]
 \<open>  (* RIGHT *)
 
   if b1 then e1
   else if b2 then e2
   else e3\<close>}
 
   \<^enum> \<^ML_text>\<open>fn\<close> abstractions are often layed-out as if they would lack any
   structure by themselves. This traditional form is motivated by the
   possibility to shift function arguments back and forth wrt.\ additional
   combinators. Example:
 
   @{verbatim [display]
 \<open>  (* RIGHT *)
 
   fun foo x y = fold (fn z =>
     expr)\<close>}
 
   Here the visual appearance is that of three arguments \<^ML_text>\<open>x\<close>,
   \<^ML_text>\<open>y\<close>, \<^ML_text>\<open>z\<close> in a row.
 
 
   Such weakly structured layout should be use with great care. Here are some
   counter-examples involving \<^ML_text>\<open>let\<close> expressions:
 
   @{verbatim [display]
 \<open>  (* WRONG *)
 
   fun foo x = let
       val y = ...
     in ... end
 
 
   (* WRONG *)
 
   fun foo x = let
     val y = ...
   in ... end
 
 
   (* WRONG *)
 
   fun foo x =
   let
     val y = ...
   in ... end
 
 
   (* WRONG *)
 
   fun foo x =
     let
       val y = ...
     in
       ... end\<close>}
 
   \<^medskip>
   In general the source layout is meant to emphasize the structure of complex
   language expressions, not to pretend that SML had a completely different
   syntax (say that of Haskell, Scala, Java).
 \<close>
 
 
 section \<open>ML embedded into Isabelle/Isar\<close>
 
 text \<open>
   ML and Isar are intertwined via an open-ended bootstrap process that
   provides more and more programming facilities and logical content in an
   alternating manner. Bootstrapping starts from the raw environment of
   existing implementations of Standard ML (mainly Poly/ML).
 
   Isabelle/Pure marks the point where the raw ML toplevel is superseded by
   Isabelle/ML within the Isar theory and proof language, with a uniform
   context for arbitrary ML values (see also \secref{sec:context}). This formal
   environment holds ML compiler bindings, logical entities, and many other
   things.
 
   Object-logics like Isabelle/HOL are built within the Isabelle/ML/Isar
   environment by introducing suitable theories with associated ML modules,
   either inlined within \<^verbatim>\<open>.thy\<close> files, or as separate \<^verbatim>\<open>.ML\<close> files that are
   loading from some theory. Thus Isabelle/HOL is defined as a regular
   user-space application within the Isabelle framework. Further add-on tools
   can be implemented in ML within the Isar context in the same manner: ML is
   part of the standard repertoire of Isabelle, and there is no distinction
   between ``users'' and ``developers'' in this respect.
 \<close>
 
 
 subsection \<open>Isar ML commands\<close>
 
 text \<open>
   The primary Isar source language provides facilities to ``open a window'' to
   the underlying ML compiler. Especially see the Isar commands @{command_ref
   "ML_file"} and @{command_ref "ML"}: both work the same way, but the source
   text is provided differently, via a file vs.\ inlined, respectively. Apart
   from embedding ML into the main theory definition like that, there are many
   more commands that refer to ML source, such as @{command_ref setup} or
   @{command_ref declaration}. Even more fine-grained embedding of ML into Isar
   is encountered in the proof method @{method_ref tactic}, which refines the
   pending goal state via a given expression of type \<^ML_type>\<open>tactic\<close>.
 \<close>
 
 text %mlex \<open>
   The following artificial example demonstrates some ML toplevel declarations
   within the implicit Isar theory context. This is regular functional
   programming without referring to logical entities yet.
 \<close>
 
 ML \<open>
   fun factorial 0 = 1
     | factorial n = n * factorial (n - 1)
 \<close>
 
 text \<open>
   Here the ML environment is already managed by Isabelle, i.e.\ the
   \<^ML>\<open>factorial\<close> function is not yet accessible in the preceding paragraph,
   nor in a different theory that is independent from the current one in the
   import hierarchy.
 
   Removing the above ML declaration from the source text will remove any trace
   of this definition, as expected. The Isabelle/ML toplevel environment is
   managed in a \<^emph>\<open>stateless\<close> way: in contrast to the raw ML toplevel, there are
   no global side-effects involved here.\<^footnote>\<open>Such a stateless compilation
   environment is also a prerequisite for robust parallel compilation within
   independent nodes of the implicit theory development graph.\<close>
 
   \<^medskip>
   The next example shows how to embed ML into Isar proofs, using @{command_ref
   "ML_prf"} instead of @{command_ref "ML"}. As illustrated below, the effect
   on the ML environment is local to the whole proof body, but ignoring the
   block structure.
 \<close>
 
 notepad
 begin
   ML_prf %"ML" \<open>val a = 1\<close>
   {
     ML_prf %"ML" \<open>val b = a + 1\<close>
   } \<comment> \<open>Isar block structure ignored by ML environment\<close>
   ML_prf %"ML" \<open>val c = b + 1\<close>
 end
 
 text \<open>
   By side-stepping the normal scoping rules for Isar proof blocks, embedded ML
   code can refer to the different contexts and manipulate corresponding
   entities, e.g.\ export a fact from a block context.
 
   \<^medskip>
   Two further ML commands are useful in certain situations: @{command_ref
   ML_val} and @{command_ref ML_command} are \<^emph>\<open>diagnostic\<close> in the sense that
   there is no effect on the underlying environment, and can thus be used
   anywhere. The examples below produce long strings of digits by invoking
   \<^ML>\<open>factorial\<close>: @{command ML_val} takes care of printing the ML toplevel
   result, but @{command ML_command} is silent so we produce an explicit output
   message.
 \<close>
 
 ML_val \<open>factorial 100\<close>
 ML_command \<open>writeln (string_of_int (factorial 100))\<close>
 
 notepad
 begin
   ML_val \<open>factorial 100\<close>
   ML_command \<open>writeln (string_of_int (factorial 100))\<close>
 end
 
 
 subsection \<open>Compile-time context\<close>
 
 text \<open>
   Whenever the ML compiler is invoked within Isabelle/Isar, the formal context
   is passed as a thread-local reference variable. Thus ML code may access the
   theory context during compilation, by reading or writing the (local) theory
   under construction. Note that such direct access to the compile-time context
   is rare. In practice it is typically done via some derived ML functions
   instead.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
   @{define_ML Context.the_generic_context: "unit -> Context.generic"} \\
   @{define_ML "Context.>>": "(Context.generic -> Context.generic) -> unit"} \\
   @{define_ML ML_Thms.bind_thms: "string * thm list -> unit"} \\
   @{define_ML ML_Thms.bind_thm: "string * thm -> unit"} \\
   \end{mldecls}
 
     \<^descr> \<^ML>\<open>Context.the_generic_context ()\<close> refers to the theory context of
     the ML toplevel --- at compile time. ML code needs to take care to refer to
     \<^ML>\<open>Context.the_generic_context ()\<close> correctly. Recall that evaluation
     of a function body is delayed until actual run-time.
 
     \<^descr> \<^ML>\<open>Context.>>\<close>~\<open>f\<close> applies context transformation \<open>f\<close> to the implicit
     context of the ML toplevel.
 
     \<^descr> \<^ML>\<open>ML_Thms.bind_thms\<close>~\<open>(name, thms)\<close> stores a list of theorems produced
     in ML both in the (global) theory context and the ML toplevel, associating
     it with the provided name.
 
     \<^descr> \<^ML>\<open>ML_Thms.bind_thm\<close> is similar to \<^ML>\<open>ML_Thms.bind_thms\<close> but refers to
     a singleton fact.
 
   It is important to note that the above functions are really restricted to
   the compile time, even though the ML compiler is invoked at run-time. The
   majority of ML code either uses static antiquotations
   (\secref{sec:ML-antiq}) or refers to the theory or proof context at
   run-time, by explicit functional abstraction.
 \<close>
 
 
 subsection \<open>Antiquotations \label{sec:ML-antiq}\<close>
 
 text \<open>
   A very important consequence of embedding ML into Isar is the concept of
   \<^emph>\<open>ML antiquotation\<close>. The standard token language of ML is augmented by
   special syntactic entities of the following form:
 
   \<^rail>\<open>
   @{syntax_def antiquote}: '@{' name args '}'
   \<close>
 
   Here @{syntax name} and @{syntax args} are outer syntax categories, as
-  defined in @{cite "isabelle-isar-ref"}.
+  defined in \<^cite>\<open>"isabelle-isar-ref"\<close>.
 
   \<^medskip>
   A regular antiquotation \<open>@{name args}\<close> processes its arguments by the usual
   means of the Isar source language, and produces corresponding ML source
   text, either as literal \<^emph>\<open>inline\<close> text (e.g.\ \<open>@{term t}\<close>) or abstract
   \<^emph>\<open>value\<close> (e.g. \<open>@{thm th}\<close>). This pre-compilation scheme allows to refer to
   formal entities in a robust manner, with proper static scoping and with some
   degree of logical checking of small portions of the code.
 \<close>
 
 
 subsection \<open>Printing ML values\<close>
 
 text \<open>
   The ML compiler knows about the structure of values according to their
   static type, and can print them in the manner of its toplevel, although the
   details are non-portable. The antiquotations @{ML_antiquotation_def
   "make_string"} and @{ML_antiquotation_def "print"} provide a quasi-portable
   way to refer to this potential capability of the underlying ML system in
   generic Isabelle/ML sources.
 
   This is occasionally useful for diagnostic or demonstration purposes. Note
   that production-quality tools require proper user-level error messages,
   avoiding raw ML values in the output.
 \<close>
 
 text %mlantiq \<open>
   \begin{matharray}{rcl}
   @{ML_antiquotation_def "make_string"} & : & \<open>ML_antiquotation\<close> \\
   @{ML_antiquotation_def "print"} & : & \<open>ML_antiquotation\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
   @@{ML_antiquotation make_string}
   ;
   @@{ML_antiquotation print} embedded?
   \<close>
 
   \<^descr> \<open>@{make_string}\<close> inlines a function to print arbitrary values similar to
   the ML toplevel. The result is compiler dependent and may fall back on "?"
   in certain situations. The value of configuration option @{attribute_ref
   ML_print_depth} determines further details of output.
 
   \<^descr> \<open>@{print f}\<close> uses the ML function \<open>f: string -> unit\<close> to output the result
   of \<open>@{make_string}\<close> above, together with the source position of the
   antiquotation. The default output function is \<^ML>\<open>writeln\<close>.
 \<close>
 
 text %mlex \<open>
   The following artificial examples show how to produce adhoc output of ML
   values for debugging purposes.
 \<close>
 
 ML_val \<open>
   val x = 42;
   val y = true;
 
   writeln (\<^make_string> {x = x, y = y});
 
   \<^print> {x = x, y = y};
   \<^print>\<open>tracing\<close> {x = x, y = y};
 \<close>
 
 
 section \<open>Canonical argument order \label{sec:canonical-argument-order}\<close>
 
 text \<open>
   Standard ML is a language in the tradition of \<open>\<lambda>\<close>-calculus and
   \<^emph>\<open>higher-order functional programming\<close>, similar to OCaml, Haskell, or
   Isabelle/Pure and HOL as logical languages. Getting acquainted with the
   native style of representing functions in that setting can save a lot of
   extra boiler-plate of redundant shuffling of arguments, auxiliary
   abstractions etc.
 
   Functions are usually \<^emph>\<open>curried\<close>: the idea of turning arguments of type
   \<open>\<tau>\<^sub>i\<close> (for \<open>i \<in> {1, \<dots> n}\<close>) into a result of type \<open>\<tau>\<close> is represented by the
   iterated function space \<open>\<tau>\<^sub>1 \<rightarrow> \<dots> \<rightarrow> \<tau>\<^sub>n \<rightarrow> \<tau>\<close>. This is isomorphic to the
   well-known encoding via tuples \<open>\<tau>\<^sub>1 \<times> \<dots> \<times> \<tau>\<^sub>n \<rightarrow> \<tau>\<close>, but the curried version
   fits more smoothly into the basic calculus.\<^footnote>\<open>The difference is even more
   significant in HOL, because the redundant tuple structure needs to be
   accommodated extraneous proof steps.\<close>
 
   Currying gives some flexibility due to \<^emph>\<open>partial application\<close>. A function
   \<open>f: \<tau>\<^sub>1 \<rightarrow> \<tau>\<^sub>2 \<rightarrow> \<tau>\<close> can be applied to \<open>x: \<tau>\<^sub>1\<close> and the remaining \<open>(f x): \<tau>\<^sub>2
   \<rightarrow> \<tau>\<close> passed to another function etc. How well this works in practice depends
   on the order of arguments. In the worst case, arguments are arranged
   erratically, and using a function in a certain situation always requires
   some glue code. Thus we would get exponentially many opportunities to
   decorate the code with meaningless permutations of arguments.
 
   This can be avoided by \<^emph>\<open>canonical argument order\<close>, which observes certain
   standard patterns and minimizes adhoc permutations in their application. In
   Isabelle/ML, large portions of text can be written without auxiliary
   operations like \<open>swap: \<alpha> \<times> \<beta> \<rightarrow> \<beta> \<times> \<alpha>\<close> or \<open>C: (\<alpha> \<rightarrow> \<beta> \<rightarrow> \<gamma>) \<rightarrow> (\<beta> \<rightarrow> \<alpha> \<rightarrow> \<gamma>)\<close> (the
   latter is not present in the Isabelle/ML library).
 
   \<^medskip>
   The main idea is that arguments that vary less are moved further to the left
   than those that vary more. Two particularly important categories of
   functions are \<^emph>\<open>selectors\<close> and \<^emph>\<open>updates\<close>.
 
   The subsequent scheme is based on a hypothetical set-like container of type
   \<open>\<beta>\<close> that manages elements of type \<open>\<alpha>\<close>. Both the names and types of the
   associated operations are canonical for Isabelle/ML.
 
   \begin{center}
   \begin{tabular}{ll}
   kind & canonical name and type \\\hline
   selector & \<open>member: \<beta> \<rightarrow> \<alpha> \<rightarrow> bool\<close> \\
   update & \<open>insert: \<alpha> \<rightarrow> \<beta> \<rightarrow> \<beta>\<close> \\
   \end{tabular}
   \end{center}
 
   Given a container \<open>B: \<beta>\<close>, the partially applied \<open>member B\<close> is a predicate
   over elements \<open>\<alpha> \<rightarrow> bool\<close>, and thus represents the intended denotation
   directly. It is customary to pass the abstract predicate to further
   operations, not the concrete container. The argument order makes it easy to
   use other combinators: \<open>forall (member B) list\<close> will check a list of
   elements for membership in \<open>B\<close> etc. Often the explicit \<open>list\<close> is pointless
   and can be contracted to \<open>forall (member B)\<close> to get directly a predicate
   again.
 
   In contrast, an update operation varies the container, so it moves to the
   right: \<open>insert a\<close> is a function \<open>\<beta> \<rightarrow> \<beta>\<close> to insert a value \<open>a\<close>. These can be
   composed naturally as \<open>insert c \<circ> insert b \<circ> insert a\<close>. The slightly awkward
   inversion of the composition order is due to conventional mathematical
   notation, which can be easily amended as explained below.
 \<close>
 
 
 subsection \<open>Forward application and composition\<close>
 
 text \<open>
   Regular function application and infix notation works best for relatively
   deeply structured expressions, e.g.\ \<open>h (f x y + g z)\<close>. The important
   special case of \<^emph>\<open>linear transformation\<close> applies a cascade of functions \<open>f\<^sub>n
   (\<dots> (f\<^sub>1 x))\<close>. This becomes hard to read and maintain if the functions are
   themselves given as complex expressions. The notation can be significantly
   improved by introducing \<^emph>\<open>forward\<close> versions of application and composition
   as follows:
 
   \<^medskip>
   \begin{tabular}{lll}
   \<open>x |> f\<close> & \<open>\<equiv>\<close> & \<open>f x\<close> \\
   \<open>(f #> g) x\<close> & \<open>\<equiv>\<close> & \<open>x |> f |> g\<close> \\
   \end{tabular}
   \<^medskip>
 
   This enables to write conveniently \<open>x |> f\<^sub>1 |> \<dots> |> f\<^sub>n\<close> or \<open>f\<^sub>1 #> \<dots> #>
   f\<^sub>n\<close> for its functional abstraction over \<open>x\<close>.
 
   \<^medskip>
   There is an additional set of combinators to accommodate multiple results
   (via pairs) that are passed on as multiple arguments (via currying).
 
   \<^medskip>
   \begin{tabular}{lll}
   \<open>(x, y) |-> f\<close> & \<open>\<equiv>\<close> & \<open>f x y\<close> \\
   \<open>(f #-> g) x\<close> & \<open>\<equiv>\<close> & \<open>x |> f |-> g\<close> \\
   \end{tabular}
   \<^medskip>
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
   @{define_ML_infix "|>" : "'a * ('a -> 'b) -> 'b"} \\
   @{define_ML_infix "|->" : "('c * 'a) * ('c -> 'a -> 'b) -> 'b"} \\
   @{define_ML_infix "#>" : "('a -> 'b) * ('b -> 'c) -> 'a -> 'c"} \\
   @{define_ML_infix "#->" : "('a -> 'c * 'b) * ('c -> 'b -> 'd) -> 'a -> 'd"} \\
   \end{mldecls}
 \<close>
 
 
 subsection \<open>Canonical iteration\<close>
 
 text \<open>
   As explained above, a function \<open>f: \<alpha> \<rightarrow> \<beta> \<rightarrow> \<beta>\<close> can be understood as update on
   a configuration of type \<open>\<beta>\<close>, parameterized by an argument of type \<open>\<alpha>\<close>. Given
   \<open>a: \<alpha>\<close> the partial application \<open>(f a): \<beta> \<rightarrow> \<beta>\<close> operates homogeneously on \<open>\<beta>\<close>.
   This can be iterated naturally over a list of parameters \<open>[a\<^sub>1, \<dots>, a\<^sub>n]\<close> as
   \<open>f a\<^sub>1 #> \<dots> #> f a\<^sub>n\<close>. The latter expression is again a function \<open>\<beta> \<rightarrow> \<beta>\<close>. It
   can be applied to an initial configuration \<open>b: \<beta>\<close> to start the iteration
   over the given list of arguments: each \<open>a\<close> in \<open>a\<^sub>1, \<dots>, a\<^sub>n\<close> is applied
   consecutively by updating a cumulative configuration.
 
   The \<open>fold\<close> combinator in Isabelle/ML lifts a function \<open>f\<close> as above to its
   iterated version over a list of arguments. Lifting can be repeated, e.g.\
   \<open>(fold \<circ> fold) f\<close> iterates over a list of lists as expected.
 
   The variant \<open>fold_rev\<close> works inside-out over the list of arguments, such
   that \<open>fold_rev f \<equiv> fold f \<circ> rev\<close> holds.
 
   The \<open>fold_map\<close> combinator essentially performs \<open>fold\<close> and \<open>map\<close>
   simultaneously: each application of \<open>f\<close> produces an updated configuration
   together with a side-result; the iteration collects all such side-results as
   a separate list.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
   @{define_ML fold: "('a -> 'b -> 'b) -> 'a list -> 'b -> 'b"} \\
   @{define_ML fold_rev: "('a -> 'b -> 'b) -> 'a list -> 'b -> 'b"} \\
   @{define_ML fold_map: "('a -> 'b -> 'c * 'b) -> 'a list -> 'b -> 'c list * 'b"} \\
   \end{mldecls}
 
   \<^descr> \<^ML>\<open>fold\<close>~\<open>f\<close> lifts the parametrized update function \<open>f\<close> to a list of
   parameters.
 
   \<^descr> \<^ML>\<open>fold_rev\<close>~\<open>f\<close> is similar to \<^ML>\<open>fold\<close>~\<open>f\<close>, but works inside-out, as
   if the list would be reversed.
 
   \<^descr> \<^ML>\<open>fold_map\<close>~\<open>f\<close> lifts the parametrized update function \<open>f\<close> (with
   side-result) to a list of parameters and cumulative side-results.
 
 
   \begin{warn}
   The literature on functional programming provides a confusing multitude of
   combinators called \<open>foldl\<close>, \<open>foldr\<close> etc. SML97 provides its own variations
   as \<^ML>\<open>List.foldl\<close> and \<^ML>\<open>List.foldr\<close>, while the classic Isabelle library
   also has the historic \<^ML>\<open>Library.foldl\<close> and \<^ML>\<open>Library.foldr\<close>. To avoid
   unnecessary complication, all these historical versions should be ignored,
   and the canonical \<^ML>\<open>fold\<close> (or \<^ML>\<open>fold_rev\<close>) used exclusively.
   \end{warn}
 \<close>
 
 text %mlex \<open>
   The following example shows how to fill a text buffer incrementally by
   adding strings, either individually or from a given list.
 \<close>
 
 ML_val \<open>
   val s =
     Buffer.empty
     |> Buffer.add "digits: "
     |> fold (Buffer.add o string_of_int) (0 upto 9)
     |> Buffer.content;
 
   \<^assert> (s = "digits: 0123456789");
 \<close>
 
 text \<open>
   Note how \<^ML>\<open>fold (Buffer.add o string_of_int)\<close> above saves an extra
   \<^ML>\<open>map\<close> over the given list. This kind of peephole optimization reduces
   both the code size and the tree structures in memory (``deforestation''),
   but it requires some practice to read and write fluently.
 
   \<^medskip>
   The next example elaborates the idea of canonical iteration, demonstrating
   fast accumulation of tree content using a text buffer.
 \<close>
 
 ML \<open>
   datatype tree = Text of string | Elem of string * tree list;
 
   fun slow_content (Text txt) = txt
     | slow_content (Elem (name, ts)) =
         "<" ^ name ^ ">" ^
         implode (map slow_content ts) ^
         "</" ^ name ^ ">"
 
   fun add_content (Text txt) = Buffer.add txt
     | add_content (Elem (name, ts)) =
         Buffer.add ("<" ^ name ^ ">") #>
         fold add_content ts #>
         Buffer.add ("</" ^ name ^ ">");
 
   fun fast_content tree =
     Buffer.empty |> add_content tree |> Buffer.content;
 \<close>
 
 text \<open>
   The slowness of \<^ML>\<open>slow_content\<close> is due to the \<^ML>\<open>implode\<close> of the
   recursive results, because it copies previously produced strings again and
   again.
 
   The incremental \<^ML>\<open>add_content\<close> avoids this by operating on a buffer that
   is passed through in a linear fashion. Using \<^ML_text>\<open>#>\<close> and contraction
   over the actual buffer argument saves some additional boiler-plate. Of
   course, the two \<^ML>\<open>Buffer.add\<close> invocations with concatenated strings
   could have been split into smaller parts, but this would have obfuscated the
   source without making a big difference in performance. Here we have done
   some peephole-optimization for the sake of readability.
 
   Another benefit of \<^ML>\<open>add_content\<close> is its ``open'' form as a function on
   buffers that can be continued in further linear transformations, folding
   etc. Thus it is more compositional than the naive \<^ML>\<open>slow_content\<close>. As
   realistic example, compare the old-style
   \<^ML>\<open>Term.maxidx_of_term: term -> int\<close> with the newer
   \<^ML>\<open>Term.maxidx_term: term -> int -> int\<close> in Isabelle/Pure.
 
   Note that \<^ML>\<open>fast_content\<close> above is only defined as example. In many
   practical situations, it is customary to provide the incremental
   \<^ML>\<open>add_content\<close> only and leave the initialization and termination to the
   concrete application to the user.
 \<close>
 
 
 section \<open>Message output channels \label{sec:message-channels}\<close>
 
 text \<open>
   Isabelle provides output channels for different kinds of messages: regular
   output, high-volume tracing information, warnings, and errors.
 
   Depending on the user interface involved, these messages may appear in
   different text styles or colours. The standard output for batch sessions
   prefixes each line of warnings by \<^verbatim>\<open>###\<close> and errors by \<^verbatim>\<open>***\<close>, but leaves
   anything else unchanged. The message body may contain further markup and
-  formatting, which is routinely used in the Prover IDE @{cite
-  "isabelle-jedit"}.
+  formatting, which is routinely used in the Prover IDE \<^cite>\<open>"isabelle-jedit"\<close>.
 
   Messages are associated with the transaction context of the running Isar
   command. This enables the front-end to manage commands and resulting
   messages together. For example, after deleting a command from a given theory
   document version, the corresponding message output can be retracted from the
   display.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
   @{define_ML writeln: "string -> unit"} \\
   @{define_ML tracing: "string -> unit"} \\
   @{define_ML warning: "string -> unit"} \\
   @{define_ML error: "string -> 'a"} % FIXME Output.error_message (!?) \\
   \end{mldecls}
 
   \<^descr> \<^ML>\<open>writeln\<close>~\<open>text\<close> outputs \<open>text\<close> as regular message. This is the
   primary message output operation of Isabelle and should be used by default.
 
   \<^descr> \<^ML>\<open>tracing\<close>~\<open>text\<close> outputs \<open>text\<close> as special tracing message, indicating
   potential high-volume output to the front-end (hundreds or thousands of
   messages issued by a single command). The idea is to allow the
   user-interface to downgrade the quality of message display to achieve higher
   throughput.
 
   Note that the user might have to take special actions to see tracing output,
   e.g.\ switch to a different output window. So this channel should not be
   used for regular output.
 
   \<^descr> \<^ML>\<open>warning\<close>~\<open>text\<close> outputs \<open>text\<close> as warning, which typically means some
   extra emphasis on the front-end side (color highlighting, icons, etc.).
 
   \<^descr> \<^ML>\<open>error\<close>~\<open>text\<close> raises exception \<^ML>\<open>ERROR\<close>~\<open>text\<close> and thus lets the
   Isar toplevel print \<open>text\<close> on the error channel, which typically means some
   extra emphasis on the front-end side (color highlighting, icons, etc.).
 
   This assumes that the exception is not handled before the command
   terminates. Handling exception \<^ML>\<open>ERROR\<close>~\<open>text\<close> is a perfectly legal
   alternative: it means that the error is absorbed without any message output.
 
   \begin{warn}
   The actual error channel is accessed via \<^ML>\<open>Output.error_message\<close>, but
   this is normally not used directly in user code.
   \end{warn}
 
 
   \begin{warn}
   Regular Isabelle/ML code should output messages exclusively by the official
   channels. Using raw I/O on \<^emph>\<open>stdout\<close> or \<^emph>\<open>stderr\<close> instead (e.g.\ via
   \<^ML>\<open>TextIO.output\<close>) is apt to cause problems in the presence of parallel
   and asynchronous processing of Isabelle theories. Such raw output might be
   displayed by the front-end in some system console log, with a low chance
   that the user will ever see it. Moreover, as a genuine side-effect on global
   process channels, there is no proper way to retract output when Isar command
   transactions are reset by the system.
   \end{warn}
 
   \begin{warn}
   The message channels should be used in a message-oriented manner. This means
   that multi-line output that logically belongs together is issued by a single
   invocation of \<^ML>\<open>writeln\<close> etc.\ with the functional concatenation of all
   message constituents.
   \end{warn}
 \<close>
 
 text %mlex \<open>
   The following example demonstrates a multi-line warning. Note that in some
   situations the user sees only the first line, so the most important point
   should be made first.
 \<close>
 
 ML_command \<open>
   warning (cat_lines
    ["Beware the Jabberwock, my son!",
     "The jaws that bite, the claws that catch!",
     "Beware the Jubjub Bird, and shun",
     "The frumious Bandersnatch!"]);
 \<close>
 
 text \<open>
   \<^medskip>
   An alternative is to make a paragraph of freely-floating words as follows.
 \<close>
 
 ML_command \<open>
   warning (Pretty.string_of (Pretty.para
     "Beware the Jabberwock, my son! \
     \The jaws that bite, the claws that catch! \
     \Beware the Jubjub Bird, and shun \
     \The frumious Bandersnatch!"))
 \<close>
 
 text \<open>
   This has advantages with variable window / popup sizes, but might make it
   harder to search for message content systematically, e.g.\ by other tools or
   by humans expecting the ``verse'' of a formal message in a fixed layout.
 \<close>
 
 
 section \<open>Exceptions \label{sec:exceptions}\<close>
 
 text \<open>
   The Standard ML semantics of strict functional evaluation together with
   exceptions is rather well defined, but some delicate points need to be
   observed to avoid that ML programs go wrong despite static type-checking.
   Exceptions in Isabelle/ML are subsequently categorized as follows.
 \<close>
 
 paragraph \<open>Regular user errors.\<close>
 text \<open>
   These are meant to provide informative feedback about malformed input etc.
 
   The \<^emph>\<open>error\<close> function raises the corresponding \<^ML>\<open>ERROR\<close> exception, with a
   plain text message as argument. \<^ML>\<open>ERROR\<close> exceptions can be handled
   internally, in order to be ignored, turned into other exceptions, or
   cascaded by appending messages. If the corresponding Isabelle/Isar command
   terminates with an \<^ML>\<open>ERROR\<close> exception state, the system will print the
   result on the error channel (see \secref{sec:message-channels}).
 
   It is considered bad style to refer to internal function names or values in
   ML source notation in user error messages. Do not use \<open>@{make_string}\<close> nor
   \<open>@{here}\<close>!
 
   Grammatical correctness of error messages can be improved by \<^emph>\<open>omitting\<close>
   final punctuation: messages are often concatenated or put into a larger
   context (e.g.\ augmented with source position). Note that punctuation after
   formal entities (types, terms, theorems) is particularly prone to user
   confusion.
 \<close>
 
 paragraph \<open>Program failures.\<close>
 text \<open>
   There is a handful of standard exceptions that indicate general failure
   situations, or failures of core operations on logical entities (types,
   terms, theorems, theories, see \chref{ch:logic}).
 
   These exceptions indicate a genuine breakdown of the program, so the main
   purpose is to determine quickly what has happened where. Traditionally, the
   (short) exception message would include the name of an ML function, although
   this is no longer necessary, because the ML runtime system attaches detailed
   source position stemming from the corresponding \<^ML_text>\<open>raise\<close> keyword.
 
   \<^medskip>
   User modules can always introduce their own custom exceptions locally, e.g.\
   to organize internal failures robustly without overlapping with existing
   exceptions. Exceptions that are exposed in module signatures require extra
   care, though, and should \<^emph>\<open>not\<close> be introduced by default. Surprise by users
   of a module can be often minimized by using plain user errors instead.
 \<close>
 
 paragraph \<open>Interrupts.\<close>
 text \<open>
   These indicate arbitrary system events: both the ML runtime system and the
   Isabelle/ML infrastructure signal various exceptional situations by raising
   the special \<^ML>\<open>Exn.Interrupt\<close> exception in user code.
 
   This is the one and only way that physical events can intrude an Isabelle/ML
   program. Such an interrupt can mean out-of-memory, stack overflow, timeout,
   internal signaling of threads, or a POSIX process signal. An Isabelle/ML
   program that intercepts interrupts becomes dependent on physical effects of
   the environment. Even worse, exception handling patterns that are too
   general by accident, e.g.\ by misspelled exception constructors, will cover
   interrupts unintentionally and thus render the program semantics
   ill-defined.
 
   Note that the Interrupt exception dates back to the original SML90 language
   definition. It was excluded from the SML97 version to avoid its malign
   impact on ML program semantics, but without providing a viable alternative.
   Isabelle/ML recovers physical interruptibility (which is an indispensable
   tool to implement managed evaluation of command transactions), but requires
   user code to be strictly transparent wrt.\ interrupts.
 
   \begin{warn}
   Isabelle/ML user code needs to terminate promptly on interruption, without
   guessing at its meaning to the system infrastructure. Temporary handling of
   interrupts for cleanup of global resources etc.\ needs to be followed
   immediately by re-raising of the original exception.
   \end{warn}
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
   @{define_ML try: "('a -> 'b) -> 'a -> 'b option"} \\
   @{define_ML can: "('a -> 'b) -> 'a -> bool"} \\
   @{define_ML_exception ERROR of string} \\
   @{define_ML_exception Fail of string} \\
   @{define_ML Exn.is_interrupt: "exn -> bool"} \\
   @{define_ML Exn.reraise: "exn -> 'a"} \\
   @{define_ML Runtime.exn_trace: "(unit -> 'a) -> 'a"} \\
   \end{mldecls}
 
   \<^rail>\<open>
     (@@{ML_antiquotation try} | @@{ML_antiquotation can}) embedded
   \<close>
 
   \<^descr> \<^ML>\<open>try\<close>~\<open>f x\<close> makes the partiality of evaluating \<open>f x\<close> explicit via the
   option datatype. Interrupts are \<^emph>\<open>not\<close> handled here, i.e.\ this form serves
   as safe replacement for the \<^emph>\<open>unsafe\<close> version \<^ML_text>\<open>(SOME\<close>~\<open>f
   x\<close>~\<^ML_text>\<open>handle _ => NONE)\<close> that is occasionally seen in books about
   SML97, but not in Isabelle/ML.
 
   \<^descr> \<^ML>\<open>can\<close> is similar to \<^ML>\<open>try\<close> with more abstract result.
 
   \<^descr> \<^ML>\<open>ERROR\<close>~\<open>msg\<close> represents user errors; this exception is normally
   raised indirectly via the \<^ML>\<open>error\<close> function (see
   \secref{sec:message-channels}).
 
   \<^descr> \<^ML>\<open>Fail\<close>~\<open>msg\<close> represents general program failures.
 
   \<^descr> \<^ML>\<open>Exn.is_interrupt\<close> identifies interrupts robustly, without mentioning
   concrete exception constructors in user code. Handled interrupts need to be
   re-raised promptly!
 
   \<^descr> \<^ML>\<open>Exn.reraise\<close>~\<open>exn\<close> raises exception \<open>exn\<close> while preserving its implicit
   position information (if possible, depending on the ML platform).
 
   \<^descr> \<^ML>\<open>Runtime.exn_trace\<close>~\<^ML_text>\<open>(fn () =>\<close>~\<open>e\<close>\<^ML_text>\<open>)\<close> evaluates
   expression \<open>e\<close> while printing a full trace of its stack of nested exceptions
   (if possible, depending on the ML platform).
 
   Inserting \<^ML>\<open>Runtime.exn_trace\<close> into ML code temporarily is useful for
   debugging, but not suitable for production code.
 \<close>
 
 text %mlantiq \<open>
   \begin{matharray}{rcl}
   @{ML_antiquotation_def "try"} & : & \<open>ML_antiquotation\<close> \\
   @{ML_antiquotation_def "can"} & : & \<open>ML_antiquotation\<close> \\
   @{ML_antiquotation_def "assert"} & : & \<open>ML_antiquotation\<close> \\
   @{ML_antiquotation_def "undefined"} & : & \<open>ML_antiquotation\<close> \\
   \end{matharray}
 
   \<^descr> \<open>@{try}\<close> and \<open>{can}\<close> are similar to the corresponding functions, but the
   argument is taken directly as ML expression: functional abstraction and
   application is done implicitly.
 
   \<^descr> \<open>@{assert}\<close> inlines a function \<^ML_type>\<open>bool -> unit\<close> that raises
   \<^ML>\<open>Fail\<close> if the argument is \<^ML>\<open>false\<close>. Due to inlining the source
   position of failed assertions is included in the error output.
 
   \<^descr> \<open>@{undefined}\<close> inlines \<^verbatim>\<open>raise\<close>~\<^ML>\<open>Match\<close>, i.e.\ the ML program
   behaves as in some function application of an undefined case.
 \<close>
 
 text %mlex \<open>
   We define a total version of division: any failures are swept under the
   carpet and mapped to a default value. Thus division-by-zero becomes 0, but
   there could be other exceptions like overflow that produce the same result
   (for unbounded integers this does not happen).
 \<close>
 
 ML \<open>
   fun div_total x y = \<^try>\<open>x div y\<close> |> the_default 0;
 
   \<^assert> (div_total 1 0 = 0);
 \<close>
 
 text \<open>
   The ML function \<^ML>\<open>undefined\<close> is defined in \<^file>\<open>~~/src/Pure/library.ML\<close>
   as follows:
 \<close>
 
 ML \<open>fun undefined _ = raise Match\<close>
 
 text \<open>
   \<^medskip>
   The following variant uses the antiquotation @{ML_antiquotation undefined}
   instead:
 \<close>
 
 ML \<open>fun undefined _ = \<^undefined>\<close>
 
 text \<open>
   \<^medskip>
   Here is the same, using control-symbol notation for the antiquotation, with
   special rendering of \<^verbatim>\<open>\<^undefined>\<close>:
 \<close>
 
 ML \<open>fun undefined _ = \<^undefined>\<close>
 
 text \<open>
   \<^medskip> Semantically, all forms are equivalent to a function definition
   without any clauses, but that is syntactically not allowed in ML.
 \<close>
 
 
 section \<open>Strings of symbols \label{sec:symbols}\<close>
 
 text \<open>
   A \<^emph>\<open>symbol\<close> constitutes the smallest textual unit in Isabelle/ML --- raw ML
   characters are normally not encountered at all. Isabelle strings consist of
   a sequence of symbols, represented as a packed string or an exploded list of
   strings. Each symbol is in itself a small string, which has either one of
   the following forms:
 
     \<^enum> a single ASCII character ``\<open>c\<close>'', for example ``\<^verbatim>\<open>a\<close>'',
 
     \<^enum> a codepoint according to UTF-8 (non-ASCII byte sequence),
 
     \<^enum> a regular symbol ``\<^verbatim>\<open>\<ident>\<close>'', for example ``\<^verbatim>\<open>\<alpha>\<close>'',
 
     \<^enum> a control symbol ``\<^verbatim>\<open>\<^ident>\<close>'', for example ``\<^verbatim>\<open>\<^bold>\<close>'',
 
   The \<open>ident\<close> syntax for symbol names is \<open>letter (letter | digit)\<^sup>*\<close>, where
   \<open>letter = A..Za..z\<close> and \<open>digit = 0..9\<close>. There are infinitely many regular
   symbols and control symbols, but a fixed collection of standard symbols is
   treated specifically. For example, ``\<^verbatim>\<open>\<alpha>\<close>'' is classified as a letter, which
   means it may occur within regular Isabelle identifiers.
 
   The character set underlying Isabelle symbols is 7-bit ASCII, but 8-bit
   character sequences are passed-through unchanged. Unicode/UCS data in UTF-8
   encoding is processed in a non-strict fashion, such that well-formed code
   sequences are recognized accordingly. Unicode provides its own collection of
   mathematical symbols, but within the core Isabelle/ML world there is no link
   to the standard collection of Isabelle regular symbols.
 
   \<^medskip>
   Output of Isabelle symbols depends on the print mode. For example, the
   standard {\LaTeX} setup of the Isabelle document preparation system would
   present ``\<^verbatim>\<open>\<alpha>\<close>'' as \<open>\<alpha>\<close>, and ``\<^verbatim>\<open>\<^bold>\<alpha>\<close>'' as \<open>\<^bold>\<alpha>\<close>. On-screen rendering usually
   works by mapping a finite subset of Isabelle symbols to suitable Unicode
   characters.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
   @{define_ML_type Symbol.symbol = string} \\
   @{define_ML Symbol.explode: "string -> Symbol.symbol list"} \\
   @{define_ML Symbol.is_letter: "Symbol.symbol -> bool"} \\
   @{define_ML Symbol.is_digit: "Symbol.symbol -> bool"} \\
   @{define_ML Symbol.is_quasi: "Symbol.symbol -> bool"} \\
   @{define_ML Symbol.is_blank: "Symbol.symbol -> bool"} \\
   \end{mldecls}
   \begin{mldecls}
   @{define_ML_type "Symbol.sym"} \\
   @{define_ML Symbol.decode: "Symbol.symbol -> Symbol.sym"} \\
   \end{mldecls}
 
   \<^descr> Type \<^ML_type>\<open>Symbol.symbol\<close> represents individual Isabelle symbols.
 
   \<^descr> \<^ML>\<open>Symbol.explode\<close>~\<open>str\<close> produces a symbol list from the packed form.
   This function supersedes \<^ML>\<open>String.explode\<close> for virtually all purposes
   of manipulating text in Isabelle!\<^footnote>\<open>The runtime overhead for exploded strings
   is mainly that of the list structure: individual symbols that happen to be a
   singleton string do not require extra memory in Poly/ML.\<close>
 
   \<^descr> \<^ML>\<open>Symbol.is_letter\<close>, \<^ML>\<open>Symbol.is_digit\<close>,
   \<^ML>\<open>Symbol.is_quasi\<close>, \<^ML>\<open>Symbol.is_blank\<close> classify standard symbols
-  according to fixed syntactic conventions of Isabelle, cf.\ @{cite
-  "isabelle-isar-ref"}.
+  according to fixed syntactic conventions of Isabelle, cf.\ \<^cite>\<open>"isabelle-isar-ref"\<close>.
 
   \<^descr> Type \<^ML_type>\<open>Symbol.sym\<close> is a concrete datatype that represents the
   different kinds of symbols explicitly, with constructors
   \<^ML>\<open>Symbol.Char\<close>, \<^ML>\<open>Symbol.UTF8\<close>, \<^ML>\<open>Symbol.Sym\<close>,
   \<^ML>\<open>Symbol.Control\<close>, \<^ML>\<open>Symbol.Malformed\<close>.
 
   \<^descr> \<^ML>\<open>Symbol.decode\<close> converts the string representation of a symbol into
   the datatype version.
 \<close>
 
 paragraph \<open>Historical note.\<close>
 text \<open>
   In the original SML90 standard the primitive ML type \<^ML_type>\<open>char\<close> did not
   exists, and \<^ML_text>\<open>explode: string -> string list\<close> produced a list of
   singleton strings like \<^ML>\<open>raw_explode: string -> string list\<close> in
   Isabelle/ML today. When SML97 came out, Isabelle did not adopt its somewhat
   anachronistic 8-bit or 16-bit characters, but the idea of exploding a string
   into a list of small strings was extended to ``symbols'' as explained above.
   Thus Isabelle sources can refer to an infinite store of user-defined
   symbols, without having to worry about the multitude of Unicode encodings
   that have emerged over the years.
 \<close>
 
 
 section \<open>Basic data types\<close>
 
 text \<open>
   The basis library proposal of SML97 needs to be treated with caution. Many
   of its operations simply do not fit with important Isabelle/ML conventions
   (like ``canonical argument order'', see
   \secref{sec:canonical-argument-order}), others cause problems with the
   parallel evaluation model of Isabelle/ML (such as \<^ML>\<open>TextIO.print\<close> or
   \<^ML>\<open>OS.Process.system\<close>).
 
   Subsequently we give a brief overview of important operations on basic ML
   data types.
 \<close>
 
 
 subsection \<open>Characters\<close>
 
 text %mlref \<open>
   \begin{mldecls}
   @{define_ML_type char} \\
   \end{mldecls}
 
   \<^descr> Type \<^ML_type>\<open>char\<close> is \<^emph>\<open>not\<close> used. The smallest textual unit in Isabelle
   is represented as a ``symbol'' (see \secref{sec:symbols}).
 \<close>
 
 
 subsection \<open>Strings\<close>
 
 text %mlref \<open>
   \begin{mldecls}
   @{define_ML_type string} \\
   \end{mldecls}
 
   \<^descr> Type \<^ML_type>\<open>string\<close> represents immutable vectors of 8-bit characters.
   There are operations in SML to convert back and forth to actual byte
   vectors, which are seldom used.
 
   This historically important raw text representation is used for
   Isabelle-specific purposes with the following implicit substructures packed
   into the string content:
 
     \<^enum> sequence of Isabelle symbols (see also \secref{sec:symbols}), with
     \<^ML>\<open>Symbol.explode\<close> as key operation;
   
-    \<^enum> XML tree structure via YXML (see also @{cite "isabelle-system"}), with
+    \<^enum> XML tree structure via YXML (see also \<^cite>\<open>"isabelle-system"\<close>), with
     \<^ML>\<open>YXML.parse_body\<close> as key operation.
 
   Note that Isabelle/ML string literals may refer Isabelle symbols like
   ``\<^verbatim>\<open>\<alpha>\<close>'' natively, \<^emph>\<open>without\<close> escaping the backslash. This is a consequence
   of Isabelle treating all source text as strings of symbols, instead of raw
   characters.
 
 
   \begin{warn}
   The regular \<^verbatim>\<open>64_32\<close> platform of Poly/ML has a size limit of 64\,MB for
   \<^ML_type>\<open>string\<close> values. This is usually sufficient for text
   applications, with a little bit of YXML markup. Very large XML trees or
   binary blobs are better stored as scalable byte strings, see type
   \<^ML_type>\<open>Bytes.T\<close> and corresponding operations in
   \<^file>\<open>~~/src/Pure/General/bytes.ML\<close>.
   \end{warn}
 \<close>
 
 text %mlex \<open>
   The subsequent example illustrates the difference of physical addressing of
   bytes versus logical addressing of symbols in Isabelle strings.
 \<close>
 
 ML_val \<open>
   val s = "\<A>";
 
   \<^assert> (length (Symbol.explode s) = 1);
   \<^assert> (size s = 4);
 \<close>
 
 text \<open>
   Note that in Unicode renderings of the symbol \<open>\<A>\<close>, variations of encodings
   like UTF-8 or UTF-16 pose delicate questions about the multi-byte
   representations of its codepoint, which is outside of the 16-bit address
   space of the original Unicode standard from the 1990-ies. In Isabelle/ML it
   is just ``\<^verbatim>\<open>\<A>\<close>'' literally, using plain ASCII characters beyond any
   doubts.
 \<close>
 
 
 subsection \<open>Integers\<close>
 
 text %mlref \<open>
   \begin{mldecls}
   @{define_ML_type int} \\
   \end{mldecls}
 
   \<^descr> Type \<^ML_type>\<open>int\<close> represents regular mathematical integers, which are
   \<^emph>\<open>unbounded\<close>. Overflow is treated properly, but should never happen in
   practice.\<^footnote>\<open>The size limit for integer bit patterns in memory is 64\,MB for
   the regular \<^verbatim>\<open>64_32\<close> platform, and much higher for native \<^verbatim>\<open>64\<close>
   architecture.\<close>
 
   Structure \<^ML_structure>\<open>IntInf\<close> of SML97 is obsolete and superseded by
   \<^ML_structure>\<open>Int\<close>. Structure \<^ML_structure>\<open>Integer\<close> in
   \<^file>\<open>~~/src/Pure/General/integer.ML\<close> provides some additional operations.
 \<close>
 
 
 subsection \<open>Rational numbers\<close>
 
 text %mlref \<open>
   \begin{mldecls}
   @{define_ML_type Rat.rat} \\
   \end{mldecls}
 
   \<^descr> Type \<^ML_type>\<open>Rat.rat\<close> represents rational numbers, based on the
   unbounded integers of Poly/ML.
 
   Literal rationals may be written with special antiquotation syntax
   \<^verbatim>\<open>@\<close>\<open>int\<close>\<^verbatim>\<open>/\<close>\<open>nat\<close> or \<^verbatim>\<open>@\<close>\<open>int\<close> (without any white space). For example
   \<^verbatim>\<open>@~1/4\<close> or \<^verbatim>\<open>@10\<close>. The ML toplevel pretty printer uses the same format.
 
   Standard operations are provided via ad-hoc overloading of \<^verbatim>\<open>+\<close>, \<^verbatim>\<open>-\<close>, \<^verbatim>\<open>*\<close>,
   \<^verbatim>\<open>/\<close>, etc.
 \<close>
 
 
 subsection \<open>Time\<close>
 
 text %mlref \<open>
   \begin{mldecls}
   @{define_ML_type Time.time} \\
   @{define_ML seconds: "real -> Time.time"} \\
   \end{mldecls}
 
   \<^descr> Type \<^ML_type>\<open>Time.time\<close> represents time abstractly according to the
   SML97 basis library definition. This is adequate for internal ML operations,
   but awkward in concrete time specifications.
 
   \<^descr> \<^ML>\<open>seconds\<close>~\<open>s\<close> turns the concrete scalar \<open>s\<close> (measured in seconds) into
   an abstract time value. Floating point numbers are easy to use as
   configuration options in the context (see \secref{sec:config-options}) or
   system options that are maintained externally.
 \<close>
 
 
 subsection \<open>Options\<close>
 
 text %mlref \<open>
   \begin{mldecls}
   @{define_ML Option.map: "('a -> 'b) -> 'a option -> 'b option"} \\
   @{define_ML is_some: "'a option -> bool"} \\
   @{define_ML is_none: "'a option -> bool"} \\
   @{define_ML the: "'a option -> 'a"} \\
   @{define_ML these: "'a list option -> 'a list"} \\
   @{define_ML the_list: "'a option -> 'a list"} \\
   @{define_ML the_default: "'a -> 'a option -> 'a"} \\
   \end{mldecls}
 \<close>
 
 text \<open>
   Apart from \<^ML>\<open>Option.map\<close> most other operations defined in structure
   \<^ML_structure>\<open>Option\<close> are alien to Isabelle/ML and never used. The
   operations shown above are defined in \<^file>\<open>~~/src/Pure/General/basics.ML\<close>.
 \<close>
 
 
 subsection \<open>Lists\<close>
 
 text \<open>
   Lists are ubiquitous in ML as simple and light-weight ``collections'' for
   many everyday programming tasks. Isabelle/ML provides important additions
   and improvements over operations that are predefined in the SML97 library.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
   @{define_ML cons: "'a -> 'a list -> 'a list"} \\
   @{define_ML member: "('b * 'a -> bool) -> 'a list -> 'b -> bool"} \\
   @{define_ML insert: "('a * 'a -> bool) -> 'a -> 'a list -> 'a list"} \\
   @{define_ML remove: "('b * 'a -> bool) -> 'b -> 'a list -> 'a list"} \\
   @{define_ML update: "('a * 'a -> bool) -> 'a -> 'a list -> 'a list"} \\
   \end{mldecls}
 
   \<^descr> \<^ML>\<open>cons\<close>~\<open>x xs\<close> evaluates to \<open>x :: xs\<close>.
 
   Tupled infix operators are a historical accident in Standard ML. The curried
   \<^ML>\<open>cons\<close> amends this, but it should be only used when partial application
   is required.
 
   \<^descr> \<^ML>\<open>member\<close>, \<^ML>\<open>insert\<close>, \<^ML>\<open>remove\<close>, \<^ML>\<open>update\<close> treat lists as a
   set-like container that maintains the order of elements. See
   \<^file>\<open>~~/src/Pure/library.ML\<close> for the full specifications (written in ML).
   There are some further derived operations like \<^ML>\<open>union\<close> or \<^ML>\<open>inter\<close>.
 
   Note that \<^ML>\<open>insert\<close> is conservative about elements that are already a
   \<^ML>\<open>member\<close> of the list, while \<^ML>\<open>update\<close> ensures that the latest entry
   is always put in front. The latter discipline is often more appropriate in
   declarations of context data (\secref{sec:context-data}) that are issued by
   the user in Isar source: later declarations take precedence over earlier
   ones. \<close>
 
 text %mlex \<open>
   Using canonical \<^ML>\<open>fold\<close> together with \<^ML>\<open>cons\<close> (or similar standard
   operations) alternates the orientation of data. The is quite natural and
   should not be altered forcible by inserting extra applications of \<^ML>\<open>rev\<close>.
   The alternative \<^ML>\<open>fold_rev\<close> can be used in the few situations, where
   alternation should be prevented.
 \<close>
 
 ML_val \<open>
   val items = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10];
 
   val list1 = fold cons items [];
   \<^assert> (list1 = rev items);
 
   val list2 = fold_rev cons items [];
   \<^assert> (list2 = items);
 \<close>
 
 text \<open>
   The subsequent example demonstrates how to \<^emph>\<open>merge\<close> two lists in a natural
   way.
 \<close>
 
 ML_val \<open>
   fun merge_lists eq (xs, ys) = fold_rev (insert eq) ys xs;
 \<close>
 
 text \<open>
   Here the first list is treated conservatively: only the new elements from
   the second list are inserted. The inside-out order of insertion via
   \<^ML>\<open>fold_rev\<close> attempts to preserve the order of elements in the result.
 
   This way of merging lists is typical for context data
   (\secref{sec:context-data}). See also \<^ML>\<open>merge\<close> as defined in
   \<^file>\<open>~~/src/Pure/library.ML\<close>.
 \<close>
 
 
 subsection \<open>Association lists\<close>
 
 text \<open>
   The operations for association lists interpret a concrete list of pairs as a
   finite function from keys to values. Redundant representations with multiple
   occurrences of the same key are implicitly normalized: lookup and update
   only take the first occurrence into account.
 \<close>
 
 text \<open>
   \begin{mldecls}
   @{define_ML AList.lookup: "('a * 'b -> bool) -> ('b * 'c) list -> 'a -> 'c option"} \\
   @{define_ML AList.defined: "('a * 'b -> bool) -> ('b * 'c) list -> 'a -> bool"} \\
   @{define_ML AList.update: "('a * 'a -> bool) -> 'a * 'b -> ('a * 'b) list -> ('a * 'b) list"} \\
   \end{mldecls}
 
   \<^descr> \<^ML>\<open>AList.lookup\<close>, \<^ML>\<open>AList.defined\<close>, \<^ML>\<open>AList.update\<close> implement the
   main ``framework operations'' for mappings in Isabelle/ML, following
   standard conventions for their names and types.
 
   Note that a function called \<^verbatim>\<open>lookup\<close> is obliged to express its partiality
   via an explicit option element. There is no choice to raise an exception,
   without changing the name to something like \<open>the_element\<close> or \<open>get\<close>.
 
   The \<open>defined\<close> operation is essentially a contraction of \<^ML>\<open>is_some\<close> and
   \<^verbatim>\<open>lookup\<close>, but this is sufficiently frequent to justify its independent
   existence. This also gives the implementation some opportunity for peep-hole
   optimization.
 
 
   Association lists are adequate as simple implementation of finite mappings
   in many practical situations. A more advanced table structure is defined in
   \<^file>\<open>~~/src/Pure/General/table.ML\<close>; that version scales easily to thousands or
   millions of elements.
 \<close>
 
 
 subsection \<open>Unsynchronized references\<close>
 
 text %mlref \<open>
   \begin{mldecls}
   @{define_ML_type 'a "Unsynchronized.ref"} \\
   @{define_ML Unsynchronized.ref: "'a -> 'a Unsynchronized.ref"} \\
   @{define_ML "!": "'a Unsynchronized.ref -> 'a"} \\
   @{define_ML_infix ":=" : "'a Unsynchronized.ref * 'a -> unit"} \\
   \end{mldecls}
 \<close>
 
 text \<open>
   Due to ubiquitous parallelism in Isabelle/ML (see also
   \secref{sec:multi-threading}), the mutable reference cells of Standard ML
   are notorious for causing problems. In a highly parallel system, both
   correctness \<^emph>\<open>and\<close> performance are easily degraded when using mutable data.
 
   The unwieldy name of \<^ML>\<open>Unsynchronized.ref\<close> for the constructor for
   references in Isabelle/ML emphasizes the inconveniences caused by
   mutability. Existing operations \<^ML>\<open>!\<close> and \<^ML_infix>\<open>:=\<close> are unchanged,
   but should be used with special precautions, say in a strictly local
   situation that is guaranteed to be restricted to sequential evaluation ---
   now and in the future.
 
   \begin{warn}
   Never \<^ML_text>\<open>open Unsynchronized\<close>, not even in a local scope!
   Pretending that mutable state is no problem is a very bad idea.
   \end{warn}
 \<close>
 
 
 section \<open>Thread-safe programming \label{sec:multi-threading}\<close>
 
 text \<open>
   Multi-threaded execution has become an everyday reality in Isabelle since
   Poly/ML 5.2.1 and Isabelle2008. Isabelle/ML provides implicit and explicit
   parallelism by default, and there is no way for user-space tools to ``opt
   out''. ML programs that are purely functional, output messages only via the
   official channels (\secref{sec:message-channels}), and do not intercept
   interrupts (\secref{sec:exceptions}) can participate in the multi-threaded
   environment immediately without further ado.
 
   More ambitious tools with more fine-grained interaction with the environment
   need to observe the principles explained below.
 \<close>
 
 
 subsection \<open>Multi-threading with shared memory\<close>
 
 text \<open>
   Multiple threads help to organize advanced operations of the system, such as
   real-time conditions on command transactions, sub-components with explicit
   communication, general asynchronous interaction etc. Moreover, parallel
   evaluation is a prerequisite to make adequate use of the CPU resources that
   are available on multi-core systems.\<^footnote>\<open>Multi-core computing does not mean
   that there are ``spare cycles'' to be wasted. It means that the continued
   exponential speedup of CPU performance due to ``Moore's Law'' follows
   different rules: clock frequency has reached its peak around 2005, and
   applications need to be parallelized in order to avoid a perceived loss of
-  performance. See also @{cite "Sutter:2005"}.\<close>
+  performance. See also \<^cite>\<open>"Sutter:2005"\<close>.\<close>
 
   Isabelle/Isar exploits the inherent structure of theories and proofs to
   support \<^emph>\<open>implicit parallelism\<close> to a large extent. LCF-style theorem proving
-  provides almost ideal conditions for that, see also @{cite "Wenzel:2009"}.
+  provides almost ideal conditions for that, see also \<^cite>\<open>"Wenzel:2009"\<close>.
   This means, significant parts of theory and proof checking is parallelized
   by default. In Isabelle2013, a maximum speedup-factor of 3.5 on 4 cores and
-  6.5 on 8 cores can be expected @{cite "Wenzel:2013:ITP"}.
+  6.5 on 8 cores can be expected \<^cite>\<open>"Wenzel:2013:ITP"\<close>.
 
   \<^medskip>
   ML threads lack the memory protection of separate processes, and operate
   concurrently on shared heap memory. This has the advantage that results of
   independent computations are directly available to other threads: abstract
   values can be passed without copying or awkward serialization that is
   typically required for separate processes.
 
   To make shared-memory multi-threading work robustly and efficiently, some
   programming guidelines need to be observed. While the ML system is
   responsible to maintain basic integrity of the representation of ML values
   in memory, the application programmer needs to ensure that multi-threaded
   execution does not break the intended semantics.
 
   \begin{warn}
   To participate in implicit parallelism, tools need to be thread-safe. A
   single ill-behaved tool can affect the stability and performance of the
   whole system.
   \end{warn}
 
   Apart from observing the principles of thread-safeness passively, advanced
   tools may also exploit parallelism actively, e.g.\ by using library
   functions for parallel list operations (\secref{sec:parlist}).
 
   \begin{warn}
   Parallel computing resources are managed centrally by the Isabelle/ML
   infrastructure. User programs should not fork their own ML threads to
   perform heavy computations.
   \end{warn}
 \<close>
 
 
 subsection \<open>Critical shared resources\<close>
 
 text \<open>
   Thread-safeness is mainly concerned about concurrent read/write access to
   shared resources, which are outside the purely functional world of ML. This
   covers the following in particular.
 
     \<^item> Global references (or arrays), i.e.\ mutable memory cells that persist
     over several invocations of associated operations.\<^footnote>\<open>This is independent of
     the visibility of such mutable values in the toplevel scope.\<close>
 
     \<^item> Global state of the running Isabelle/ML process, i.e.\ raw I/O channels,
     environment variables, current working directory.
 
     \<^item> Writable resources in the file-system that are shared among different
     threads or external processes.
 
   Isabelle/ML provides various mechanisms to avoid critical shared resources
   in most situations. As last resort there are some mechanisms for explicit
   synchronization. The following guidelines help to make Isabelle/ML programs
   work smoothly in a concurrent environment.
 
   \<^item> Avoid global references altogether. Isabelle/Isar maintains a uniform
   context that incorporates arbitrary data declared by user programs
   (\secref{sec:context-data}). This context is passed as plain value and user
   tools can get/map their own data in a purely functional manner.
   Configuration options within the context (\secref{sec:config-options})
   provide simple drop-in replacements for historic reference variables.
 
   \<^item> Keep components with local state information re-entrant. Instead of poking
   initial values into (private) global references, a new state record can be
   created on each invocation, and passed through any auxiliary functions of
   the component. The state record contain mutable references in special
   situations, without requiring any synchronization, as long as each
   invocation gets its own copy and the tool itself is single-threaded.
 
   \<^item> Avoid raw output on \<open>stdout\<close> or \<open>stderr\<close>. The Poly/ML library is
   thread-safe for each individual output operation, but the ordering of
   parallel invocations is arbitrary. This means raw output will appear on some
   system console with unpredictable interleaving of atomic chunks.
 
   Note that this does not affect regular message output channels
   (\secref{sec:message-channels}). An official message id is associated with
   the command transaction from where it originates, independently of other
   transactions. This means each running Isar command has effectively its own
   set of message channels, and interleaving can only happen when commands use
   parallelism internally (and only at message boundaries).
 
   \<^item> Treat environment variables and the current working directory of the
   running process as read-only.
 
   \<^item> Restrict writing to the file-system to unique temporary files. Isabelle
   already provides a temporary directory that is unique for the running
   process, and there is a centralized source of unique serial numbers in
   Isabelle/ML. Thus temporary files that are passed to to some external
   process will be always disjoint, and thus thread-safe.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
   @{define_ML File.tmp_path: "Path.T -> Path.T"} \\
   @{define_ML serial_string: "unit -> string"} \\
   \end{mldecls}
 
   \<^descr> \<^ML>\<open>File.tmp_path\<close>~\<open>path\<close> relocates the base component of \<open>path\<close> into the
   unique temporary directory of the running Isabelle/ML process.
 
   \<^descr> \<^ML>\<open>serial_string\<close>~\<open>()\<close> creates a new serial number that is unique over
   the runtime of the Isabelle/ML process.
 \<close>
 
 text %mlex \<open>
   The following example shows how to create unique temporary file names.
 \<close>
 
 ML_val \<open>
   val tmp1 = File.tmp_path (Path.basic ("foo" ^ serial_string ()));
   val tmp2 = File.tmp_path (Path.basic ("foo" ^ serial_string ()));
   \<^assert> (tmp1 <> tmp2);
 \<close>
 
 
 subsection \<open>Explicit synchronization\<close>
 
 text \<open>
   Isabelle/ML provides explicit synchronization for mutable variables over
   immutable data, which may be updated atomically and exclusively. This
   addresses the rare situations where mutable shared resources are really
   required. Synchronization in Isabelle/ML is based on primitives of Poly/ML,
   which have been adapted to the specific assumptions of the concurrent
   Isabelle environment. User code should not break this abstraction, but stay
   within the confines of concurrent Isabelle/ML.
 
   A \<^emph>\<open>synchronized variable\<close> is an explicit state component associated with
   mechanisms for locking and signaling. There are operations to await a
   condition, change the state, and signal the change to all other waiting
   threads. Synchronized access to the state variable is \<^emph>\<open>not\<close> re-entrant:
   direct or indirect nesting within the same thread will cause a deadlock!
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
   @{define_ML_type 'a "Synchronized.var"} \\
   @{define_ML Synchronized.var: "string -> 'a -> 'a Synchronized.var"} \\
   @{define_ML Synchronized.guarded_access: "'a Synchronized.var ->
   ('a -> ('b * 'a) option) -> 'b"} \\
   \end{mldecls}
 
     \<^descr> Type \<^ML_type>\<open>'a Synchronized.var\<close> represents synchronized variables
     with state of type \<^ML_type>\<open>'a\<close>.
 
     \<^descr> \<^ML>\<open>Synchronized.var\<close>~\<open>name x\<close> creates a synchronized variable that is
     initialized with value \<open>x\<close>. The \<open>name\<close> is used for tracing.
 
     \<^descr> \<^ML>\<open>Synchronized.guarded_access\<close>~\<open>var f\<close> lets the function \<open>f\<close> operate
     within a critical section on the state \<open>x\<close> as follows: if \<open>f x\<close> produces
     \<^ML>\<open>NONE\<close>, it continues to wait on the internal condition variable,
     expecting that some other thread will eventually change the content in a
     suitable manner; if \<open>f x\<close> produces \<^ML>\<open>SOME\<close>~\<open>(y, x')\<close> it is satisfied and
     assigns the new state value \<open>x'\<close>, broadcasts a signal to all waiting threads
     on the associated condition variable, and returns the result \<open>y\<close>.
 
   There are some further variants of the \<^ML>\<open>Synchronized.guarded_access\<close>
   combinator, see \<^file>\<open>~~/src/Pure/Concurrent/synchronized.ML\<close> for details.
 \<close>
 
 text %mlex \<open>
   The following example implements a counter that produces positive integers
   that are unique over the runtime of the Isabelle process:
 \<close>
 
 ML_val \<open>
   local
     val counter = Synchronized.var "counter" 0;
   in
     fun next () =
       Synchronized.guarded_access counter
         (fn i =>
           let val j = i + 1
           in SOME (j, j) end);
   end;
 
   val a = next ();
   val b = next ();
   \<^assert> (a <> b);
 \<close>
 
 text \<open>
   \<^medskip>
   See \<^file>\<open>~~/src/Pure/Concurrent/mailbox.ML\<close> how to implement a mailbox as
   synchronized variable over a purely functional list.
 \<close>
 
 
 section \<open>Managed evaluation\<close>
 
 text \<open>
   Execution of Standard ML follows the model of strict functional evaluation
   with optional exceptions. Evaluation happens whenever some function is
   applied to (sufficiently many) arguments. The result is either an explicit
   value or an implicit exception.
 
   \<^emph>\<open>Managed evaluation\<close> in Isabelle/ML organizes expressions and results to
   control certain physical side-conditions, to say more specifically when and
   how evaluation happens. For example, the Isabelle/ML library supports lazy
   evaluation with memoing, parallel evaluation via futures, asynchronous
   evaluation via promises, evaluation with time limit etc.
 
   \<^medskip>
   An \<^emph>\<open>unevaluated expression\<close> is represented either as unit abstraction
   \<^verbatim>\<open>fn () => a\<close> of type \<^verbatim>\<open>unit -> 'a\<close> or as regular function \<^verbatim>\<open>fn a => b\<close> of
   type \<^verbatim>\<open>'a -> 'b\<close>. Both forms occur routinely, and special care is required
   to tell them apart --- the static type-system of SML is only of limited help
   here.
 
   The first form is more intuitive: some combinator \<^verbatim>\<open>(unit -> 'a) -> 'a\<close>
   applies the given function to \<^verbatim>\<open>()\<close> to initiate the postponed evaluation
   process. The second form is more flexible: some combinator
   \<^verbatim>\<open>('a -> 'b) -> 'a -> 'b\<close> acts like a modified form of function application;
   several such combinators may be cascaded to modify a given function, before
   it is ultimately applied to some argument.
 
   \<^medskip>
   \<^emph>\<open>Reified results\<close> make the disjoint sum of regular values versions
   exceptional situations explicit as ML datatype: \<open>'a result = Res of 'a | Exn
   of exn\<close>. This is typically used for administrative purposes, to store the
   overall outcome of an evaluation process.
 
   \<^emph>\<open>Parallel exceptions\<close> aggregate reified results, such that multiple
   exceptions are digested as a collection in canonical form that identifies
   exceptions according to their original occurrence. This is particular
   important for parallel evaluation via futures \secref{sec:futures}, which
   are organized as acyclic graph of evaluations that depend on other
   evaluations: exceptions stemming from shared sub-graphs are exposed exactly
   once and in the order of their original occurrence (e.g.\ when printed at
   the toplevel). Interrupt counts as neutral element here: it is treated as
   minimal information about some canceled evaluation process, and is absorbed
   by the presence of regular program exceptions.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
   @{define_ML_type 'a "Exn.result"} \\
   @{define_ML Exn.capture: "('a -> 'b) -> 'a -> 'b Exn.result"} \\
   @{define_ML Exn.interruptible_capture: "('a -> 'b) -> 'a -> 'b Exn.result"} \\
   @{define_ML Exn.release: "'a Exn.result -> 'a"} \\
   @{define_ML Par_Exn.release_all: "'a Exn.result list -> 'a list"} \\
   @{define_ML Par_Exn.release_first: "'a Exn.result list -> 'a list"} \\
   \end{mldecls}
 
   \<^descr> Type \<^ML_type>\<open>'a Exn.result\<close> represents the disjoint sum of ML results
   explicitly, with constructor \<^ML>\<open>Exn.Res\<close> for regular values and \<^ML>\<open>Exn.Exn\<close> for exceptions.
 
   \<^descr> \<^ML>\<open>Exn.capture\<close>~\<open>f x\<close> manages the evaluation of \<open>f x\<close> such that
   exceptions are made explicit as \<^ML>\<open>Exn.Exn\<close>. Note that this includes
   physical interrupts (see also \secref{sec:exceptions}), so the same
   precautions apply to user code: interrupts must not be absorbed
   accidentally!
 
   \<^descr> \<^ML>\<open>Exn.interruptible_capture\<close> is similar to \<^ML>\<open>Exn.capture\<close>, but
   interrupts are immediately re-raised as required for user code.
 
   \<^descr> \<^ML>\<open>Exn.release\<close>~\<open>result\<close> releases the original runtime result, exposing
   its regular value or raising the reified exception.
 
   \<^descr> \<^ML>\<open>Par_Exn.release_all\<close>~\<open>results\<close> combines results that were produced
   independently (e.g.\ by parallel evaluation). If all results are regular
   values, that list is returned. Otherwise, the collection of all exceptions
   is raised, wrapped-up as collective parallel exception. Note that the latter
   prevents access to individual exceptions by conventional \<^verbatim>\<open>handle\<close> of ML.
 
   \<^descr> \<^ML>\<open>Par_Exn.release_first\<close> is similar to \<^ML>\<open>Par_Exn.release_all\<close>, but
   only the first (meaningful) exception that has occurred in the original
   evaluation process is raised again, the others are ignored. That single
   exception may get handled by conventional means in ML.
 \<close>
 
 
 subsection \<open>Parallel skeletons \label{sec:parlist}\<close>
 
 text \<open>
   Algorithmic skeletons are combinators that operate on lists in parallel, in
   the manner of well-known \<open>map\<close>, \<open>exists\<close>, \<open>forall\<close> etc. Management of
   futures (\secref{sec:futures}) and their results as reified exceptions is
   wrapped up into simple programming interfaces that resemble the sequential
   versions.
 
   What remains is the application-specific problem to present expressions with
   suitable \<^emph>\<open>granularity\<close>: each list element corresponds to one evaluation
   task. If the granularity is too coarse, the available CPUs are not
   saturated. If it is too fine-grained, CPU cycles are wasted due to the
   overhead of organizing parallel processing. In the worst case, parallel
   performance will be less than the sequential counterpart!
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
   @{define_ML Par_List.map: "('a -> 'b) -> 'a list -> 'b list"} \\
   @{define_ML Par_List.get_some: "('a -> 'b option) -> 'a list -> 'b option"} \\
   \end{mldecls}
 
   \<^descr> \<^ML>\<open>Par_List.map\<close>~\<open>f [x\<^sub>1, \<dots>, x\<^sub>n]\<close> is like \<^ML>\<open>map\<close>~\<open>f [x\<^sub>1, \<dots>,
   x\<^sub>n]\<close>, but the evaluation of \<open>f x\<^sub>i\<close> for \<open>i = 1, \<dots>, n\<close> is performed in
   parallel.
 
   An exception in any \<open>f x\<^sub>i\<close> cancels the overall evaluation process. The
   final result is produced via \<^ML>\<open>Par_Exn.release_first\<close> as explained above,
   which means the first program exception that happened to occur in the
   parallel evaluation is propagated, and all other failures are ignored.
 
   \<^descr> \<^ML>\<open>Par_List.get_some\<close>~\<open>f [x\<^sub>1, \<dots>, x\<^sub>n]\<close> produces some \<open>f x\<^sub>i\<close> that is of
   the form \<open>SOME y\<^sub>i\<close>, if that exists, otherwise \<open>NONE\<close>. Thus it is similar to
   \<^ML>\<open>Library.get_first\<close>, but subject to a non-deterministic parallel choice
   process. The first successful result cancels the overall evaluation process;
   other exceptions are propagated as for \<^ML>\<open>Par_List.map\<close>.
 
   This generic parallel choice combinator is the basis for derived forms, such
   as \<^ML>\<open>Par_List.find_some\<close>, \<^ML>\<open>Par_List.exists\<close>, \<^ML>\<open>Par_List.forall\<close>.
 \<close>
 
 text %mlex \<open>
   Subsequently, the Ackermann function is evaluated in parallel for some
   ranges of arguments.
 \<close>
 
 ML_val \<open>
   fun ackermann 0 n = n + 1
     | ackermann m 0 = ackermann (m - 1) 1
     | ackermann m n = ackermann (m - 1) (ackermann m (n - 1));
 
   Par_List.map (ackermann 2) (500 upto 1000);
   Par_List.map (ackermann 3) (5 upto 10);
 \<close>
 
 
 subsection \<open>Lazy evaluation\<close>
 
 text \<open>
   Classic lazy evaluation works via the \<open>lazy\<close>~/ \<open>force\<close> pair of operations:
   \<open>lazy\<close> to wrap an unevaluated expression, and \<open>force\<close> to evaluate it once
   and store its result persistently. Later invocations of \<open>force\<close> retrieve the
   stored result without another evaluation. Isabelle/ML refines this idea to
   accommodate the aspects of multi-threading, synchronous program exceptions
   and asynchronous interrupts.
 
   The first thread that invokes \<open>force\<close> on an unfinished lazy value changes
   its state into a \<^emph>\<open>promise\<close> of the eventual result and starts evaluating it.
   Any other threads that \<open>force\<close> the same lazy value in the meantime need to
   wait for it to finish, by producing a regular result or program exception.
   If the evaluation attempt is interrupted, this event is propagated to all
   waiting threads and the lazy value is reset to its original state.
 
   This means a lazy value is completely evaluated at most once, in a
   thread-safe manner. There might be multiple interrupted evaluation attempts,
   and multiple receivers of intermediate interrupt events. Interrupts are
   \<^emph>\<open>not\<close> made persistent: later evaluation attempts start again from the
   original expression.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
   @{define_ML_type 'a "lazy"} \\
   @{define_ML Lazy.lazy: "(unit -> 'a) -> 'a lazy"} \\
   @{define_ML Lazy.value: "'a -> 'a lazy"} \\
   @{define_ML Lazy.force: "'a lazy -> 'a"} \\
   \end{mldecls}
 
   \<^descr> Type \<^ML_type>\<open>'a lazy\<close> represents lazy values over type \<^verbatim>\<open>'a\<close>.
 
   \<^descr> \<^ML>\<open>Lazy.lazy\<close>~\<open>(fn () => e)\<close> wraps the unevaluated expression \<open>e\<close> as
   unfinished lazy value.
 
   \<^descr> \<^ML>\<open>Lazy.value\<close>~\<open>a\<close> wraps the value \<open>a\<close> as finished lazy value. When
   forced, it returns \<open>a\<close> without any further evaluation.
 
   There is very low overhead for this proforma wrapping of strict values as
   lazy values.
 
   \<^descr> \<^ML>\<open>Lazy.force\<close>~\<open>x\<close> produces the result of the lazy value in a
   thread-safe manner as explained above. Thus it may cause the current thread
   to wait on a pending evaluation attempt by another thread.
 \<close>
 
 
 subsection \<open>Futures \label{sec:futures}\<close>
 
 text \<open>
   Futures help to organize parallel execution in a value-oriented manner, with
   \<open>fork\<close>~/ \<open>join\<close> as the main pair of operations, and some further variants;
-  see also @{cite "Wenzel:2009" and "Wenzel:2013:ITP"}. Unlike lazy values,
+  see also \<^cite>\<open>"Wenzel:2009" and "Wenzel:2013:ITP"\<close>. Unlike lazy values,
   futures are evaluated strictly and spontaneously on separate worker threads.
   Futures may be canceled, which leads to interrupts on running evaluation
   attempts, and forces structurally related futures to fail for all time;
   already finished futures remain unchanged. Exceptions between related
   futures are propagated as well, and turned into parallel exceptions (see
   above).
 
   Technically, a future is a single-assignment variable together with a
   \<^emph>\<open>task\<close> that serves administrative purposes, notably within the \<^emph>\<open>task
   queue\<close> where new futures are registered for eventual evaluation and the
   worker threads retrieve their work.
 
   The pool of worker threads is limited, in correlation with the number of
   physical cores on the machine. Note that allocation of runtime resources may
   be distorted either if workers yield CPU time (e.g.\ via system sleep or
   wait operations), or if non-worker threads contend for significant runtime
   resources independently. There is a limited number of replacement worker
   threads that get activated in certain explicit wait conditions, after a
   timeout.
 
   \<^medskip>
   Each future task belongs to some \<^emph>\<open>task group\<close>, which represents the
   hierarchic structure of related tasks, together with the exception status a
   that point. By default, the task group of a newly created future is a new
   sub-group of the presently running one, but it is also possible to indicate
   different group layouts under program control.
 
   Cancellation of futures actually refers to the corresponding task group and
   all its sub-groups. Thus interrupts are propagated down the group hierarchy.
   Regular program exceptions are treated likewise: failure of the evaluation
   of some future task affects its own group and all sub-groups. Given a
   particular task group, its \<^emph>\<open>group status\<close> cumulates all relevant exceptions
   according to its position within the group hierarchy. Interrupted tasks that
   lack regular result information, will pick up parallel exceptions from the
   cumulative group status.
 
   \<^medskip>
   A \<^emph>\<open>passive future\<close> or \<^emph>\<open>promise\<close> is a future with slightly different
   evaluation policies: there is only a single-assignment variable and some
   expression to evaluate for the \<^emph>\<open>failed\<close> case (e.g.\ to clean up resources
   when canceled). A regular result is produced by external means, using a
   separate \<^emph>\<open>fulfill\<close> operation.
 
   Promises are managed in the same task queue, so regular futures may depend
   on them. This allows a form of reactive programming, where some promises are
   used as minimal elements (or guards) within the future dependency graph:
   when these promises are fulfilled the evaluation of subsequent futures
   starts spontaneously, according to their own inter-dependencies.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
   @{define_ML_type 'a "future"} \\
   @{define_ML Future.fork: "(unit -> 'a) -> 'a future"} \\
   @{define_ML Future.forks: "Future.params -> (unit -> 'a) list -> 'a future list"} \\
   @{define_ML Future.join: "'a future -> 'a"} \\
   @{define_ML Future.joins: "'a future list -> 'a list"} \\
   @{define_ML Future.value: "'a -> 'a future"} \\
   @{define_ML Future.map: "('a -> 'b) -> 'a future -> 'b future"} \\
   @{define_ML Future.cancel: "'a future -> unit"} \\
   @{define_ML Future.cancel_group: "Future.group -> unit"} \\[0.5ex]
   @{define_ML Future.promise: "(unit -> unit) -> 'a future"} \\
   @{define_ML Future.fulfill: "'a future -> 'a -> unit"} \\
   \end{mldecls}
 
   \<^descr> Type \<^ML_type>\<open>'a future\<close> represents future values over type \<^verbatim>\<open>'a\<close>.
 
   \<^descr> \<^ML>\<open>Future.fork\<close>~\<open>(fn () => e)\<close> registers the unevaluated expression \<open>e\<close>
   as unfinished future value, to be evaluated eventually on the parallel
   worker-thread farm. This is a shorthand for \<^ML>\<open>Future.forks\<close> below, with
   default parameters and a single expression.
 
   \<^descr> \<^ML>\<open>Future.forks\<close>~\<open>params exprs\<close> is the general interface to fork several
   futures simultaneously. The \<open>params\<close> consist of the following fields:
 
     \<^item> \<open>name : string\<close> (default \<^ML>\<open>""\<close>) specifies a common name for the
     tasks of the forked futures, which serves diagnostic purposes.
 
     \<^item> \<open>group : Future.group option\<close> (default \<^ML>\<open>NONE\<close>) specifies an optional
     task group for the forked futures. \<^ML>\<open>NONE\<close> means that a new sub-group
     of the current worker-thread task context is created. If this is not a
     worker thread, the group will be a new root in the group hierarchy.
 
     \<^item> \<open>deps : Future.task list\<close> (default \<^ML>\<open>[]\<close>) specifies dependencies on
     other future tasks, i.e.\ the adjacency relation in the global task queue.
     Dependencies on already finished tasks are ignored.
 
     \<^item> \<open>pri : int\<close> (default \<^ML>\<open>0\<close>) specifies a priority within the task
     queue.
 
     Typically there is only little deviation from the default priority
     \<^ML>\<open>0\<close>. As a rule of thumb, \<^ML>\<open>~1\<close> means ``low priority" and
     \<^ML>\<open>1\<close> means ``high priority''.
 
     Note that the task priority only affects the position in the queue, not
     the thread priority. When a worker thread picks up a task for processing,
     it runs with the normal thread priority to the end (or until canceled).
     Higher priority tasks that are queued later need to wait until this (or
     another) worker thread becomes free again.
 
     \<^item> \<open>interrupts : bool\<close> (default \<^ML>\<open>true\<close>) tells whether the worker thread
     that processes the corresponding task is initially put into interruptible
     state. This state may change again while running, by modifying the thread
     attributes.
 
     With interrupts disabled, a running future task cannot be canceled. It is
     the responsibility of the programmer that this special state is retained
     only briefly.
 
   \<^descr> \<^ML>\<open>Future.join\<close>~\<open>x\<close> retrieves the value of an already finished future,
   which may lead to an exception, according to the result of its previous
   evaluation.
 
   For an unfinished future there are several cases depending on the role of
   the current thread and the status of the future. A non-worker thread waits
   passively until the future is eventually evaluated. A worker thread
   temporarily changes its task context and takes over the responsibility to
   evaluate the future expression on the spot. The latter is done in a
   thread-safe manner: other threads that intend to join the same future need
   to wait until the ongoing evaluation is finished.
 
   Note that excessive use of dynamic dependencies of futures by adhoc joining
   may lead to bad utilization of CPU cores, due to threads waiting on other
   threads to finish required futures. The future task farm has a limited
   amount of replacement threads that continue working on unrelated tasks after
   some timeout.
 
   Whenever possible, static dependencies of futures should be specified
   explicitly when forked (see \<open>deps\<close> above). Thus the evaluation can work from
   the bottom up, without join conflicts and wait states.
 
   \<^descr> \<^ML>\<open>Future.joins\<close>~\<open>xs\<close> joins the given list of futures simultaneously,
   which is more efficient than \<^ML>\<open>map Future.join\<close>~\<open>xs\<close>.
 
   Based on the dependency graph of tasks, the current thread takes over the
   responsibility to evaluate future expressions that are required for the main
   result, working from the bottom up. Waiting on future results that are
   presently evaluated on other threads only happens as last resort, when no
   other unfinished futures are left over.
 
   \<^descr> \<^ML>\<open>Future.value\<close>~\<open>a\<close> wraps the value \<open>a\<close> as finished future value,
   bypassing the worker-thread farm. When joined, it returns \<open>a\<close> without any
   further evaluation.
 
   There is very low overhead for this proforma wrapping of strict values as
   futures.
 
   \<^descr> \<^ML>\<open>Future.map\<close>~\<open>f x\<close> is a fast-path implementation of
   \<^ML>\<open>Future.fork\<close>~\<open>(fn () => f (\<close>\<^ML>\<open>Future.join\<close>~\<open>x))\<close>, which avoids
   the full overhead of the task queue and worker-thread farm as far as
   possible. The function \<open>f\<close> is supposed to be some trivial post-processing or
   projection of the future result.
 
   \<^descr> \<^ML>\<open>Future.cancel\<close>~\<open>x\<close> cancels the task group of the given future, using
   \<^ML>\<open>Future.cancel_group\<close> below.
 
   \<^descr> \<^ML>\<open>Future.cancel_group\<close>~\<open>group\<close> cancels all tasks of the given task
   group for all time. Threads that are presently processing a task of the
   given group are interrupted: it may take some time until they are actually
   terminated. Tasks that are queued but not yet processed are dequeued and
   forced into interrupted state. Since the task group is itself invalidated,
   any further attempt to fork a future that belongs to it will yield a
   canceled result as well.
 
   \<^descr> \<^ML>\<open>Future.promise\<close>~\<open>abort\<close> registers a passive future with the given
   \<open>abort\<close> operation: it is invoked when the future task group is canceled.
 
   \<^descr> \<^ML>\<open>Future.fulfill\<close>~\<open>x a\<close> finishes the passive future \<open>x\<close> by the given
   value \<open>a\<close>. If the promise has already been canceled, the attempt to fulfill
   it causes an exception.
 \<close>
 
 end
diff --git a/src/Doc/Implementation/Prelim.thy b/src/Doc/Implementation/Prelim.thy
--- a/src/Doc/Implementation/Prelim.thy
+++ b/src/Doc/Implementation/Prelim.thy
@@ -1,973 +1,973 @@
 (*:maxLineLen=78:*)
 
 theory Prelim
 imports Base
 begin
 
 chapter \<open>Preliminaries\<close>
 
 section \<open>Contexts \label{sec:context}\<close>
 
 text \<open>
   A logical context represents the background that is required for formulating
   statements and composing proofs. It acts as a medium to produce formal
   content, depending on earlier material (declarations, results etc.).
 
   For example, derivations within the Isabelle/Pure logic can be described as
   a judgment \<open>\<Gamma> \<turnstile>\<^sub>\<Theta> \<phi>\<close>, which means that a proposition \<open>\<phi>\<close> is derivable from
   hypotheses \<open>\<Gamma>\<close> within the theory \<open>\<Theta>\<close>. There are logical reasons for keeping
   \<open>\<Theta>\<close> and \<open>\<Gamma>\<close> separate: theories can be liberal about supporting type
   constructors and schematic polymorphism of constants and axioms, while the
   inner calculus of \<open>\<Gamma> \<turnstile> \<phi>\<close> is strictly limited to Simple Type Theory (with
   fixed type variables in the assumptions).
 
   \<^medskip>
   Contexts and derivations are linked by the following key principles:
 
   \<^item> Transfer: monotonicity of derivations admits results to be transferred
   into a \<^emph>\<open>larger\<close> context, i.e.\ \<open>\<Gamma> \<turnstile>\<^sub>\<Theta> \<phi>\<close> implies \<open>\<Gamma>' \<turnstile>\<^sub>\<Theta>\<^sub>' \<phi>\<close> for contexts
   \<open>\<Theta>' \<supseteq> \<Theta>\<close> and \<open>\<Gamma>' \<supseteq> \<Gamma>\<close>.
 
   \<^item> Export: discharge of hypotheses admits results to be exported into a
   \<^emph>\<open>smaller\<close> context, i.e.\ \<open>\<Gamma>' \<turnstile>\<^sub>\<Theta> \<phi>\<close> implies \<open>\<Gamma> \<turnstile>\<^sub>\<Theta> \<Delta> \<Longrightarrow> \<phi>\<close> where \<open>\<Gamma>' \<supseteq> \<Gamma>\<close>
   and \<open>\<Delta> = \<Gamma>' - \<Gamma>\<close>. Note that \<open>\<Theta>\<close> remains unchanged here, only the \<open>\<Gamma>\<close> part is
   affected.
 
 
   \<^medskip>
   By modeling the main characteristics of the primitive \<open>\<Theta>\<close> and \<open>\<Gamma>\<close> above, and
   abstracting over any particular logical content, we arrive at the
   fundamental notions of \<^emph>\<open>theory context\<close> and \<^emph>\<open>proof context\<close> in
   Isabelle/Isar. These implement a certain policy to manage arbitrary
   \<^emph>\<open>context data\<close>. There is a strongly-typed mechanism to declare new kinds of
   data at compile time.
 
   The internal bootstrap process of Isabelle/Pure eventually reaches a stage
   where certain data slots provide the logical content of \<open>\<Theta>\<close> and \<open>\<Gamma>\<close> sketched
   above, but this does not stop there! Various additional data slots support
   all kinds of mechanisms that are not necessarily part of the core logic.
 
   For example, there would be data for canonical introduction and elimination
   rules for arbitrary operators (depending on the object-logic and
   application), which enables users to perform standard proof steps implicitly
-  (cf.\ the \<open>rule\<close> method @{cite "isabelle-isar-ref"}).
+  (cf.\ the \<open>rule\<close> method \<^cite>\<open>"isabelle-isar-ref"\<close>).
 
   \<^medskip>
   Thus Isabelle/Isar is able to bring forth more and more concepts
   successively. In particular, an object-logic like Isabelle/HOL continues the
   Isabelle/Pure setup by adding specific components for automated reasoning
   (classical reasoner, tableau prover, structured induction etc.) and derived
   specification mechanisms (inductive predicates, recursive functions etc.).
   All of this is ultimately based on the generic data management by theory and
   proof contexts introduced here.
 \<close>
 
 
 subsection \<open>Theory context \label{sec:context-theory}\<close>
 
 text \<open>
   A \<^emph>\<open>theory\<close> is a data container with explicit name and unique identifier.
   Theories are related by a (nominal) sub-theory relation, which corresponds
   to the dependency graph of the original construction; each theory is derived
   from a certain sub-graph of ancestor theories. To this end, the system
   maintains a set of symbolic ``identification stamps'' within each theory.
 
   The \<open>begin\<close> operation starts a new theory by importing several parent
   theories (with merged contents) and entering a special mode of nameless
   incremental updates, until the final \<open>end\<close> operation is performed.
 
   \<^medskip>
   The example in \figref{fig:ex-theory} below shows a theory graph derived
   from \<open>Pure\<close>, with theory \<open>Length\<close> importing \<open>Nat\<close> and \<open>List\<close>. The body of
   \<open>Length\<close> consists of a sequence of updates, resulting in locally a linear
   sub-theory relation for each intermediate step.
 
   \begin{figure}[htb]
   \begin{center}
   \begin{tabular}{rcccl}
         &            & \<open>Pure\<close> \\
         &            & \<open>\<down>\<close> \\
         &            & \<open>FOL\<close> \\
         & $\swarrow$ &              & $\searrow$ & \\
   \<open>Nat\<close> &    &              &            & \<open>List\<close> \\
         & $\searrow$ &              & $\swarrow$ \\
         &            & \<open>Length\<close> \\
         &            & \multicolumn{3}{l}{~~@{keyword "begin"}} \\
         &            & $\vdots$~~ \\
         &            & \multicolumn{3}{l}{~~@{command "end"}} \\
   \end{tabular}
   \caption{A theory definition depending on ancestors}\label{fig:ex-theory}
   \end{center}
   \end{figure}
 
   \<^medskip>
   Derived formal entities may retain a reference to the background theory in
   order to indicate the formal context from which they were produced. This
   provides an immutable certificate of the background theory.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
   @{define_ML_type theory} \\
   @{define_ML Context.eq_thy: "theory * theory -> bool"} \\
   @{define_ML Context.subthy: "theory * theory -> bool"} \\
   @{define_ML Theory.begin_theory: "string * Position.T -> theory list -> theory"} \\
   @{define_ML Theory.parents_of: "theory -> theory list"} \\
   @{define_ML Theory.ancestors_of: "theory -> theory list"} \\
   \end{mldecls}
 
   \<^descr> Type \<^ML_type>\<open>theory\<close> represents theory contexts.
 
   \<^descr> \<^ML>\<open>Context.eq_thy\<close>~\<open>(thy\<^sub>1, thy\<^sub>2)\<close> check strict identity of two
   theories.
 
   \<^descr> \<^ML>\<open>Context.subthy\<close>~\<open>(thy\<^sub>1, thy\<^sub>2)\<close> compares theories according to the
   intrinsic graph structure of the construction. This sub-theory relation is a
   nominal approximation of inclusion (\<open>\<subseteq>\<close>) of the corresponding content
   (according to the semantics of the ML modules that implement the data).
 
   \<^descr> \<^ML>\<open>Theory.begin_theory\<close>~\<open>name parents\<close> constructs a new theory based
   on the given parents. This ML function is normally not invoked directly.
 
   \<^descr> \<^ML>\<open>Theory.parents_of\<close>~\<open>thy\<close> returns the direct ancestors of \<open>thy\<close>.
 
   \<^descr> \<^ML>\<open>Theory.ancestors_of\<close>~\<open>thy\<close> returns all ancestors of \<open>thy\<close> (not
   including \<open>thy\<close> itself).
 \<close>
 
 text %mlantiq \<open>
   \begin{matharray}{rcl}
   @{ML_antiquotation_def "theory"} & : & \<open>ML_antiquotation\<close> \\
   @{ML_antiquotation_def "theory_context"} & : & \<open>ML_antiquotation\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
   @@{ML_antiquotation theory} embedded?
   ;
   @@{ML_antiquotation theory_context} embedded
   \<close>
 
   \<^descr> \<open>@{theory}\<close> refers to the background theory of the current context --- as
   abstract value.
 
   \<^descr> \<open>@{theory A}\<close> refers to an explicitly named ancestor theory \<open>A\<close> of the
   background theory of the current context --- as abstract value.
 
   \<^descr> \<open>@{theory_context A}\<close> is similar to \<open>@{theory A}\<close>, but presents the result
   as initial \<^ML_type>\<open>Proof.context\<close> (see also \<^ML>\<open>Proof_Context.init_global\<close>).
 \<close>
 
 
 subsection \<open>Proof context \label{sec:context-proof}\<close>
 
 text \<open>
   A proof context is a container for pure data that refers to the theory from
   which it is derived. The \<open>init\<close> operation creates a proof context from a
   given theory. There is an explicit \<open>transfer\<close> operation to force
   resynchronization with updates to the background theory -- this is rarely
   required in practice.
 
   Entities derived in a proof context need to record logical requirements
   explicitly, since there is no separate context identification or symbolic
   inclusion as for theories. For example, hypotheses used in primitive
   derivations (cf.\ \secref{sec:thms}) are recorded separately within the
   sequent \<open>\<Gamma> \<turnstile> \<phi>\<close>, just to make double sure. Results could still leak into an
   alien proof context due to programming errors, but Isabelle/Isar includes
   some extra validity checks in critical positions, notably at the end of a
   sub-proof.
 
   Proof contexts may be manipulated arbitrarily, although the common
   discipline is to follow block structure as a mental model: a given context
   is extended consecutively, and results are exported back into the original
   context. Note that an Isar proof state models block-structured reasoning
   explicitly, using a stack of proof contexts internally. For various
   technical reasons, the background theory of an Isar proof state must not be
   changed while the proof is still under construction!
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
   @{define_ML_type Proof.context} \\
   @{define_ML Proof_Context.init_global: "theory -> Proof.context"} \\
   @{define_ML Proof_Context.theory_of: "Proof.context -> theory"} \\
   @{define_ML Proof_Context.transfer: "theory -> Proof.context -> Proof.context"} \\
   \end{mldecls}
 
   \<^descr> Type \<^ML_type>\<open>Proof.context\<close> represents proof contexts.
 
   \<^descr> \<^ML>\<open>Proof_Context.init_global\<close>~\<open>thy\<close> produces a proof context derived
   from \<open>thy\<close>, initializing all data.
 
   \<^descr> \<^ML>\<open>Proof_Context.theory_of\<close>~\<open>ctxt\<close> selects the background theory from
   \<open>ctxt\<close>.
 
   \<^descr> \<^ML>\<open>Proof_Context.transfer\<close>~\<open>thy ctxt\<close> promotes the background theory of
   \<open>ctxt\<close> to the super theory \<open>thy\<close>.
 \<close>
 
 text %mlantiq \<open>
   \begin{matharray}{rcl}
   @{ML_antiquotation_def "context"} & : & \<open>ML_antiquotation\<close> \\
   \end{matharray}
 
   \<^descr> \<open>@{context}\<close> refers to \<^emph>\<open>the\<close> context at compile-time --- as abstract
   value. Independently of (local) theory or proof mode, this always produces a
   meaningful result.
 
   This is probably the most common antiquotation in interactive
   experimentation with ML inside Isar.
 \<close>
 
 
 subsection \<open>Generic contexts \label{sec:generic-context}\<close>
 
 text \<open>
   A generic context is the disjoint sum of either a theory or proof context.
   Occasionally, this enables uniform treatment of generic context data,
   typically extra-logical information. Operations on generic contexts include
   the usual injections, partial selections, and combinators for lifting
   operations on either component of the disjoint sum.
 
   Moreover, there are total operations \<open>theory_of\<close> and \<open>proof_of\<close> to convert a
   generic context into either kind: a theory can always be selected from the
   sum, while a proof context might have to be constructed by an ad-hoc \<open>init\<close>
   operation, which incurs a small runtime overhead.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
   @{define_ML_type Context.generic} \\
   @{define_ML Context.theory_of: "Context.generic -> theory"} \\
   @{define_ML Context.proof_of: "Context.generic -> Proof.context"} \\
   \end{mldecls}
 
   \<^descr> Type \<^ML_type>\<open>Context.generic\<close> is the direct sum of \<^ML_type>\<open>theory\<close>
   and \<^ML_type>\<open>Proof.context\<close>, with the datatype constructors \<^ML>\<open>Context.Theory\<close> and \<^ML>\<open>Context.Proof\<close>.
 
   \<^descr> \<^ML>\<open>Context.theory_of\<close>~\<open>context\<close> always produces a theory from the
   generic \<open>context\<close>, using \<^ML>\<open>Proof_Context.theory_of\<close> as required.
 
   \<^descr> \<^ML>\<open>Context.proof_of\<close>~\<open>context\<close> always produces a proof context from the
   generic \<open>context\<close>, using \<^ML>\<open>Proof_Context.init_global\<close> as required (note
   that this re-initializes the context data with each invocation).
 \<close>
 
 
 subsection \<open>Context data \label{sec:context-data}\<close>
 
 text \<open>
   The main purpose of theory and proof contexts is to manage arbitrary (pure)
   data. New data types can be declared incrementally at compile time. There
   are separate declaration mechanisms for any of the three kinds of contexts:
   theory, proof, generic.
 \<close>
 
 paragraph \<open>Theory data\<close>
 text \<open>declarations need to implement the following ML signature:
 
   \<^medskip>
   \begin{tabular}{ll}
   \<open>\<type> T\<close> & representing type \\
   \<open>\<val> empty: T\<close> & empty default value \\
   \<open>\<val> extend: T \<rightarrow> T\<close> & obsolete (identity function) \\
   \<open>\<val> merge: T \<times> T \<rightarrow> T\<close> & merge data \\
   \end{tabular}
   \<^medskip>
 
   The \<open>empty\<close> value acts as initial default for \<^emph>\<open>any\<close> theory that does not
   declare actual data content; \<open>extend\<close> is obsolete: it needs to be the
   identity function.
 
   The \<open>merge\<close> operation needs to join the data from two theories in a
   conservative manner. The standard scheme for \<open>merge (data\<^sub>1, data\<^sub>2)\<close>
   inserts those parts of \<open>data\<^sub>2\<close> into \<open>data\<^sub>1\<close> that are not yet present,
   while keeping the general order of things. The \<^ML>\<open>Library.merge\<close>
   function on plain lists may serve as canonical template. Particularly note
   that shared parts of the data must not be duplicated by naive concatenation,
   or a theory graph that resembles a chain of diamonds would cause an
   exponential blowup!
 
   Sometimes, the data consists of a single item that cannot be ``merged'' in a
   sensible manner. Then the standard scheme degenerates to the projection to
   \<open>data\<^sub>1\<close>, ignoring \<open>data\<^sub>2\<close> outright.
 \<close>
 
 paragraph \<open>Proof context data\<close>
 text \<open>declarations need to implement the following ML signature:
 
   \<^medskip>
   \begin{tabular}{ll}
   \<open>\<type> T\<close> & representing type \\
   \<open>\<val> init: theory \<rightarrow> T\<close> & produce initial value \\
   \end{tabular}
   \<^medskip>
 
   The \<open>init\<close> operation is supposed to produce a pure value from the given
   background theory and should be somehow ``immediate''. Whenever a proof
   context is initialized, which happens frequently, the the system invokes the
   \<open>init\<close> operation of \<^emph>\<open>all\<close> theory data slots ever declared. This also means
   that one needs to be economic about the total number of proof data
   declarations in the system, i.e.\ each ML module should declare at most one,
   sometimes two data slots for its internal use. Repeated data declarations to
   simulate a record type should be avoided!
 \<close>
 
 paragraph \<open>Generic data\<close>
 text \<open>
   provides a hybrid interface for both theory and proof data. The \<open>init\<close>
   operation for proof contexts is predefined to select the current data value
   from the background theory.
 
   \<^bigskip>
   Any of the above data declarations over type \<open>T\<close> result in an ML structure
   with the following signature:
 
   \<^medskip>
   \begin{tabular}{ll}
   \<open>get: context \<rightarrow> T\<close> \\
   \<open>put: T \<rightarrow> context \<rightarrow> context\<close> \\
   \<open>map: (T \<rightarrow> T) \<rightarrow> context \<rightarrow> context\<close> \\
   \end{tabular}
   \<^medskip>
 
   These other operations provide exclusive access for the particular kind of
   context (theory, proof, or generic context). This interface observes the ML
   discipline for types and scopes: there is no other way to access the
   corresponding data slot of a context. By keeping these operations private,
   an Isabelle/ML module may maintain abstract values authentically.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
   @{define_ML_functor Theory_Data} \\
   @{define_ML_functor Proof_Data} \\
   @{define_ML_functor Generic_Data} \\
   \end{mldecls}
 
   \<^descr> \<^ML_functor>\<open>Theory_Data\<close>\<open>(spec)\<close> declares data for type \<^ML_type>\<open>theory\<close>
   according to the specification provided as argument structure. The resulting
   structure provides data init and access operations as described above.
 
   \<^descr> \<^ML_functor>\<open>Proof_Data\<close>\<open>(spec)\<close> is analogous to \<^ML_functor>\<open>Theory_Data\<close>
   for type \<^ML_type>\<open>Proof.context\<close>.
 
   \<^descr> \<^ML_functor>\<open>Generic_Data\<close>\<open>(spec)\<close> is analogous to \<^ML_functor>\<open>Theory_Data\<close> for type \<^ML_type>\<open>Context.generic\<close>. \<close>
 
 text %mlex \<open>
   The following artificial example demonstrates theory data: we maintain a set
   of terms that are supposed to be wellformed wrt.\ the enclosing theory. The
   public interface is as follows:
 \<close>
 
 ML \<open>
   signature WELLFORMED_TERMS =
   sig
     val get: theory -> term list
     val add: term -> theory -> theory
   end;
 \<close>
 
 text \<open>
   The implementation uses private theory data internally, and only exposes an
   operation that involves explicit argument checking wrt.\ the given theory.
 \<close>
 
 ML \<open>
   structure Wellformed_Terms: WELLFORMED_TERMS =
   struct
 
   structure Terms = Theory_Data
   (
     type T = term Ord_List.T;
     val empty = [];
     fun merge (ts1, ts2) =
       Ord_List.union Term_Ord.fast_term_ord ts1 ts2;
   );
 
   val get = Terms.get;
 
   fun add raw_t thy =
     let
       val t = Sign.cert_term thy raw_t;
     in
       Terms.map (Ord_List.insert Term_Ord.fast_term_ord t) thy
     end;
 
   end;
 \<close>
 
 text \<open>
   Type \<^ML_type>\<open>term Ord_List.T\<close> is used for reasonably efficient
   representation of a set of terms: all operations are linear in the number of
   stored elements. Here we assume that users of this module do not care about
   the declaration order, since that data structure forces its own arrangement
   of elements.
 
   Observe how the \<^ML_text>\<open>merge\<close> operation joins the data slots of the two
   constituents: \<^ML>\<open>Ord_List.union\<close> prevents duplication of common data from
   different branches, thus avoiding the danger of exponential blowup. Plain
   list append etc.\ must never be used for theory data merges!
 
   \<^medskip>
   Our intended invariant is achieved as follows:
 
     \<^enum> \<^ML>\<open>Wellformed_Terms.add\<close> only admits terms that have passed the \<^ML>\<open>Sign.cert_term\<close> check of the given theory at that point.
   
     \<^enum> Wellformedness in the sense of \<^ML>\<open>Sign.cert_term\<close> is monotonic wrt.\
     the sub-theory relation. So our data can move upwards in the hierarchy
     (via extension or merges), and maintain wellformedness without further
     checks.
 
   Note that all basic operations of the inference kernel (which includes \<^ML>\<open>Sign.cert_term\<close>) observe this monotonicity principle, but other user-space
   tools don't. For example, fully-featured type-inference via \<^ML>\<open>Syntax.check_term\<close> (cf.\ \secref{sec:term-check}) is not necessarily
   monotonic wrt.\ the background theory, since constraints of term constants
   can be modified by later declarations, for example.
 
   In most cases, user-space context data does not have to take such invariants
   too seriously. The situation is different in the implementation of the
   inference kernel itself, which uses the very same data mechanisms for types,
   constants, axioms etc.
 \<close>
 
 
 subsection \<open>Configuration options \label{sec:config-options}\<close>
 
 text \<open>
   A \<^emph>\<open>configuration option\<close> is a named optional value of some basic type
   (Boolean, integer, string) that is stored in the context. It is a simple
   application of general context data (\secref{sec:context-data}) that is
   sufficiently common to justify customized setup, which includes some
   concrete declarations for end-users using existing notation for attributes
   (cf.\ \secref{sec:attributes}).
 
   For example, the predefined configuration option @{attribute show_types}
   controls output of explicit type constraints for variables in printed terms
   (cf.\ \secref{sec:read-print}). Its value can be modified within Isar text
   like this:
 \<close>
 
 experiment
 begin
 
 declare [[show_types = false]]
   \<comment> \<open>declaration within (local) theory context\<close>
 
 notepad
 begin
   note [[show_types = true]]
     \<comment> \<open>declaration within proof (forward mode)\<close>
   term x
 
   have "x = x"
     using [[show_types = false]]
       \<comment> \<open>declaration within proof (backward mode)\<close>
     ..
 end
 
 end
 
 text \<open>
   Configuration options that are not set explicitly hold a default value that
   can depend on the application context. This allows to retrieve the value
   from another slot within the context, or fall back on a global preference
   mechanism, for example.
 
   The operations to declare configuration options and get/map their values are
   modeled as direct replacements for historic global references, only that the
   context is made explicit. This allows easy configuration of tools, without
   relying on the execution order as required for old-style mutable
   references.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
   @{define_ML Config.get: "Proof.context -> 'a Config.T -> 'a"} \\
   @{define_ML Config.map: "'a Config.T -> ('a -> 'a) -> Proof.context -> Proof.context"} \\
   @{define_ML Attrib.setup_config_bool: "binding -> (Context.generic -> bool) ->
   bool Config.T"} \\
   @{define_ML Attrib.setup_config_int: "binding -> (Context.generic -> int) ->
   int Config.T"} \\
   @{define_ML Attrib.setup_config_real: "binding -> (Context.generic -> real) ->
   real Config.T"} \\
   @{define_ML Attrib.setup_config_string: "binding -> (Context.generic -> string) ->
   string Config.T"} \\
   \end{mldecls}
 
   \<^descr> \<^ML>\<open>Config.get\<close>~\<open>ctxt config\<close> gets the value of \<open>config\<close> in the given
   context.
 
   \<^descr> \<^ML>\<open>Config.map\<close>~\<open>config f ctxt\<close> updates the context by updating the value
   of \<open>config\<close>.
 
   \<^descr> \<open>config =\<close>~\<^ML>\<open>Attrib.setup_config_bool\<close>~\<open>name default\<close> creates a named
   configuration option of type \<^ML_type>\<open>bool\<close>, with the given \<open>default\<close>
   depending on the application context. The resulting \<open>config\<close> can be used to
   get/map its value in a given context. There is an implicit update of the
   background theory that registers the option as attribute with some concrete
   syntax.
 
   \<^descr> \<^ML>\<open>Attrib.config_int\<close>, \<^ML>\<open>Attrib.config_real\<close>, and \<^ML>\<open>Attrib.config_string\<close> work like \<^ML>\<open>Attrib.config_bool\<close>, but for types
   \<^ML_type>\<open>int\<close> and \<^ML_type>\<open>string\<close>, respectively.
 \<close>
 
 text %mlex \<open>
   The following example shows how to declare and use a Boolean configuration
   option called \<open>my_flag\<close> with constant default value \<^ML>\<open>false\<close>.
 \<close>
 
 ML \<open>
   val my_flag =
     Attrib.setup_config_bool \<^binding>\<open>my_flag\<close> (K false)
 \<close>
 
 text \<open>
   Now the user can refer to @{attribute my_flag} in declarations, while ML
   tools can retrieve the current value from the context via \<^ML>\<open>Config.get\<close>.
 \<close>
 
 ML_val \<open>\<^assert> (Config.get \<^context> my_flag = false)\<close>
 
 declare [[my_flag = true]]
 
 ML_val \<open>\<^assert> (Config.get \<^context> my_flag = true)\<close>
 
 notepad
 begin
   {
     note [[my_flag = false]]
     ML_val \<open>\<^assert> (Config.get \<^context> my_flag = false)\<close>
   }
   ML_val \<open>\<^assert> (Config.get \<^context> my_flag = true)\<close>
 end
 
 text \<open>
   Here is another example involving ML type \<^ML_type>\<open>real\<close> (floating-point
   numbers).
 \<close>
 
 ML \<open>
   val airspeed_velocity =
     Attrib.setup_config_real \<^binding>\<open>airspeed_velocity\<close> (K 0.0)
 \<close>
 
 declare [[airspeed_velocity = 10]]
 declare [[airspeed_velocity = 9.9]]
 
 
 section \<open>Names \label{sec:names}\<close>
 
 text \<open>
   In principle, a name is just a string, but there are various conventions for
   representing additional structure. For example, ``\<open>Foo.bar.baz\<close>'' is
   considered as a long name consisting of qualifier \<open>Foo.bar\<close> and base name
   \<open>baz\<close>. The individual constituents of a name may have further substructure,
   e.g.\ the string ``\<^verbatim>\<open>\<alpha>\<close>'' encodes as a single symbol (\secref{sec:symbols}).
 
   \<^medskip>
   Subsequently, we shall introduce specific categories of names. Roughly
   speaking these correspond to logical entities as follows:
 
   \<^item> Basic names (\secref{sec:basic-name}): free and bound variables.
 
   \<^item> Indexed names (\secref{sec:indexname}): schematic variables.
 
   \<^item> Long names (\secref{sec:long-name}): constants of any kind (type
   constructors, term constants, other concepts defined in user space). Such
   entities are typically managed via name spaces (\secref{sec:name-space}).
 \<close>
 
 
 subsection \<open>Basic names \label{sec:basic-name}\<close>
 
 text \<open>
   A \<^emph>\<open>basic name\<close> essentially consists of a single Isabelle identifier. There
   are conventions to mark separate classes of basic names, by attaching a
   suffix of underscores: one underscore means \<^emph>\<open>internal name\<close>, two
   underscores means \<^emph>\<open>Skolem name\<close>, three underscores means \<^emph>\<open>internal Skolem
   name\<close>.
 
   For example, the basic name \<open>foo\<close> has the internal version \<open>foo_\<close>, with
   Skolem versions \<open>foo__\<close> and \<open>foo___\<close>, respectively.
 
   These special versions provide copies of the basic name space, apart from
   anything that normally appears in the user text. For example, system
   generated variables in Isar proof contexts are usually marked as internal,
   which prevents mysterious names like \<open>xaa\<close> to appear in human-readable text.
 
   \<^medskip>
   Manipulating binding scopes often requires on-the-fly renamings. A \<^emph>\<open>name
   context\<close> contains a collection of already used names. The \<open>declare\<close>
   operation adds names to the context.
 
   The \<open>invents\<close> operation derives a number of fresh names from a given
   starting point. For example, the first three names derived from \<open>a\<close> are \<open>a\<close>,
   \<open>b\<close>, \<open>c\<close>.
 
   The \<open>variants\<close> operation produces fresh names by incrementing tentative
   names as base-26 numbers (with digits \<open>a..z\<close>) until all clashes are
   resolved. For example, name \<open>foo\<close> results in variants \<open>fooa\<close>, \<open>foob\<close>,
   \<open>fooc\<close>, \dots, \<open>fooaa\<close>, \<open>fooab\<close> etc.; each renaming step picks the next
   unused variant from this sequence.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
   @{define_ML Name.internal: "string -> string"} \\
   @{define_ML Name.skolem: "string -> string"} \\
   \end{mldecls}
   \begin{mldecls}
   @{define_ML_type Name.context} \\
   @{define_ML Name.context: Name.context} \\
   @{define_ML Name.declare: "string -> Name.context -> Name.context"} \\
   @{define_ML Name.invent: "Name.context -> string -> int -> string list"} \\
   @{define_ML Name.variant: "string -> Name.context -> string * Name.context"} \\
   \end{mldecls}
   \begin{mldecls}
   @{define_ML Variable.names_of: "Proof.context -> Name.context"} \\
   \end{mldecls}
 
   \<^descr> \<^ML>\<open>Name.internal\<close>~\<open>name\<close> produces an internal name by adding one
   underscore.
 
   \<^descr> \<^ML>\<open>Name.skolem\<close>~\<open>name\<close> produces a Skolem name by adding two underscores.
 
   \<^descr> Type \<^ML_type>\<open>Name.context\<close> represents the context of already used names;
   the initial value is \<^ML>\<open>Name.context\<close>.
 
   \<^descr> \<^ML>\<open>Name.declare\<close>~\<open>name\<close> enters a used name into the context.
 
   \<^descr> \<^ML>\<open>Name.invent\<close>~\<open>context name n\<close> produces \<open>n\<close> fresh names derived from
   \<open>name\<close>.
 
   \<^descr> \<^ML>\<open>Name.variant\<close>~\<open>name context\<close> produces a fresh variant of \<open>name\<close>; the
   result is declared to the context.
 
   \<^descr> \<^ML>\<open>Variable.names_of\<close>~\<open>ctxt\<close> retrieves the context of declared type and
   term variable names. Projecting a proof context down to a primitive name
   context is occasionally useful when invoking lower-level operations. Regular
   management of ``fresh variables'' is done by suitable operations of
   structure \<^ML_structure>\<open>Variable\<close>, which is also able to provide an
   official status of ``locally fixed variable'' within the logical environment
   (cf.\ \secref{sec:variables}).
 \<close>
 
 text %mlex \<open>
   The following simple examples demonstrate how to produce fresh names from
   the initial \<^ML>\<open>Name.context\<close>.
 \<close>
 
 ML_val \<open>
   val list1 = Name.invent Name.context "a" 5;
   \<^assert> (list1 = ["a", "b", "c", "d", "e"]);
 
   val list2 =
     #1 (fold_map Name.variant ["x", "x", "a", "a", "'a", "'a"] Name.context);
   \<^assert> (list2 = ["x", "xa", "a", "aa", "'a", "'aa"]);
 \<close>
 
 text \<open>
   \<^medskip>
   The same works relatively to the formal context as follows.\<close>
 
 experiment fixes a b c :: 'a
 begin
 
 ML_val \<open>
   val names = Variable.names_of \<^context>;
 
   val list1 = Name.invent names "a" 5;
   \<^assert> (list1 = ["d", "e", "f", "g", "h"]);
 
   val list2 =
     #1 (fold_map Name.variant ["x", "x", "a", "a", "'a", "'a"] names);
   \<^assert> (list2 = ["x", "xa", "aa", "ab", "'aa", "'ab"]);
 \<close>
 
 end
 
 
 subsection \<open>Indexed names \label{sec:indexname}\<close>
 
 text \<open>
   An \<^emph>\<open>indexed name\<close> (or \<open>indexname\<close>) is a pair of a basic name and a natural
   number. This representation allows efficient renaming by incrementing the
   second component only. The canonical way to rename two collections of
   indexnames apart from each other is this: determine the maximum index
   \<open>maxidx\<close> of the first collection, then increment all indexes of the second
   collection by \<open>maxidx + 1\<close>; the maximum index of an empty collection is
   \<open>-1\<close>.
 
   Occasionally, basic names are injected into the same pair type of indexed
   names: then \<open>(x, -1)\<close> is used to encode the basic name \<open>x\<close>.
 
   \<^medskip>
   Isabelle syntax observes the following rules for representing an indexname
   \<open>(x, i)\<close> as a packed string:
 
     \<^item> \<open>?x\<close> if \<open>x\<close> does not end with a digit and \<open>i = 0\<close>,
 
     \<^item> \<open>?xi\<close> if \<open>x\<close> does not end with a digit,
 
     \<^item> \<open>?x.i\<close> otherwise.
 
   Indexnames may acquire large index numbers after several maxidx shifts have
   been applied. Results are usually normalized towards \<open>0\<close> at certain
   checkpoints, notably at the end of a proof. This works by producing variants
   of the corresponding basic name components. For example, the collection
   \<open>?x1, ?x7, ?x42\<close> becomes \<open>?x, ?xa, ?xb\<close>.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
   @{define_ML_type indexname = "string * int"} \\
   \end{mldecls}
 
   \<^descr> Type \<^ML_type>\<open>indexname\<close> represents indexed names. This is an
   abbreviation for \<^ML_type>\<open>string * int\<close>. The second component is usually
   non-negative, except for situations where \<open>(x, -1)\<close> is used to inject basic
   names into this type. Other negative indexes should not be used.
 \<close>
 
 
 subsection \<open>Long names \label{sec:long-name}\<close>
 
 text \<open>
   A \<^emph>\<open>long name\<close> consists of a sequence of non-empty name components. The
   packed representation uses a dot as separator, as in ``\<open>A.b.c\<close>''. The last
   component is called \<^emph>\<open>base name\<close>, the remaining prefix is called
   \<^emph>\<open>qualifier\<close> (which may be empty). The qualifier can be understood as the
   access path to the named entity while passing through some nested
   block-structure, although our free-form long names do not really enforce any
   strict discipline.
 
   For example, an item named ``\<open>A.b.c\<close>'' may be understood as a local entity
   \<open>c\<close>, within a local structure \<open>b\<close>, within a global structure \<open>A\<close>. In
   practice, long names usually represent 1--3 levels of qualification. User ML
   code should not make any assumptions about the particular structure of long
   names!
 
   The empty name is commonly used as an indication of unnamed entities, or
   entities that are not entered into the corresponding name space, whenever
   this makes any sense. The basic operations on long names map empty names
   again to empty names.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
   @{define_ML Long_Name.base_name: "string -> string"} \\
   @{define_ML Long_Name.qualifier: "string -> string"} \\
   @{define_ML Long_Name.append: "string -> string -> string"} \\
   @{define_ML Long_Name.implode: "string list -> string"} \\
   @{define_ML Long_Name.explode: "string -> string list"} \\
   \end{mldecls}
 
   \<^descr> \<^ML>\<open>Long_Name.base_name\<close>~\<open>name\<close> returns the base name of a long name.
 
   \<^descr> \<^ML>\<open>Long_Name.qualifier\<close>~\<open>name\<close> returns the qualifier of a long name.
 
   \<^descr> \<^ML>\<open>Long_Name.append\<close>~\<open>name\<^sub>1 name\<^sub>2\<close> appends two long names.
 
   \<^descr> \<^ML>\<open>Long_Name.implode\<close>~\<open>names\<close> and \<^ML>\<open>Long_Name.explode\<close>~\<open>name\<close> convert
   between the packed string representation and the explicit list form of long
   names.
 \<close>
 
 
 subsection \<open>Name spaces \label{sec:name-space}\<close>
 
 text \<open>
   A \<open>name space\<close> manages a collection of long names, together with a mapping
   between partially qualified external names and fully qualified internal
   names (in both directions). Note that the corresponding \<open>intern\<close> and
   \<open>extern\<close> operations are mostly used for parsing and printing only! The
   \<open>declare\<close> operation augments a name space according to the accesses
   determined by a given binding, and a naming policy from the context.
 
   \<^medskip>
   A \<open>binding\<close> specifies details about the prospective long name of a newly
   introduced formal entity. It consists of a base name, prefixes for
   qualification (separate ones for system infrastructure and user-space
   mechanisms), a slot for the original source position, and some additional
   flags.
 
   \<^medskip>
   A \<open>naming\<close> provides some additional details for producing a long name from a
   binding. Normally, the naming is implicit in the theory or proof context.
   The \<open>full\<close> operation (and its variants for different context types) produces
   a fully qualified internal name to be entered into a name space. The main
   equation of this ``chemical reaction'' when binding new entities in a
   context is as follows:
 
   \<^medskip>
   \begin{tabular}{l}
   \<open>binding + naming \<longrightarrow> long name + name space accesses\<close>
   \end{tabular}
 
   \<^bigskip>
   As a general principle, there is a separate name space for each kind of
   formal entity, e.g.\ fact, logical constant, type constructor, type class.
   It is usually clear from the occurrence in concrete syntax (or from the
   scope) which kind of entity a name refers to. For example, the very same
   name \<open>c\<close> may be used uniformly for a constant, type constructor, and type
   class.
 
   There are common schemes to name derived entities systematically according
   to the name of the main logical entity involved, e.g.\ fact \<open>c.intro\<close> for a
   canonical introduction rule related to constant \<open>c\<close>. This technique of
   mapping names from one space into another requires some care in order to
   avoid conflicts. In particular, theorem names derived from a type
   constructor or type class should get an additional suffix in addition to the
   usual qualification. This leads to the following conventions for derived
   names:
 
   \<^medskip>
   \begin{tabular}{ll}
   logical entity & fact name \\\hline
   constant \<open>c\<close> & \<open>c.intro\<close> \\
   type \<open>c\<close> & \<open>c_type.intro\<close> \\
   class \<open>c\<close> & \<open>c_class.intro\<close> \\
   \end{tabular}
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
   @{define_ML_type binding} \\
   @{define_ML Binding.empty: binding} \\
   @{define_ML Binding.name: "string -> binding"} \\
   @{define_ML Binding.qualify: "bool -> string -> binding -> binding"} \\
   @{define_ML Binding.prefix: "bool -> string -> binding -> binding"} \\
   @{define_ML Binding.concealed: "binding -> binding"} \\
   @{define_ML Binding.print: "binding -> string"} \\
   \end{mldecls}
   \begin{mldecls}
   @{define_ML_type Name_Space.naming} \\
   @{define_ML Name_Space.global_naming: Name_Space.naming} \\
   @{define_ML Name_Space.add_path: "string -> Name_Space.naming -> Name_Space.naming"} \\
   @{define_ML Name_Space.full_name: "Name_Space.naming -> binding -> string"} \\
   \end{mldecls}
   \begin{mldecls}
   @{define_ML_type Name_Space.T} \\
   @{define_ML Name_Space.empty: "string -> Name_Space.T"} \\
   @{define_ML Name_Space.merge: "Name_Space.T * Name_Space.T -> Name_Space.T"} \\
   @{define_ML Name_Space.declare: "Context.generic -> bool ->
   binding -> Name_Space.T -> string * Name_Space.T"} \\
   @{define_ML Name_Space.intern: "Name_Space.T -> string -> string"} \\
   @{define_ML Name_Space.extern: "Proof.context -> Name_Space.T -> string -> string"} \\
   @{define_ML Name_Space.is_concealed: "Name_Space.T -> string -> bool"}
   \end{mldecls}
 
   \<^descr> Type \<^ML_type>\<open>binding\<close> represents the abstract concept of name bindings.
 
   \<^descr> \<^ML>\<open>Binding.empty\<close> is the empty binding.
 
   \<^descr> \<^ML>\<open>Binding.name\<close>~\<open>name\<close> produces a binding with base name \<open>name\<close>. Note
   that this lacks proper source position information; see also the ML
   antiquotation @{ML_antiquotation binding}.
 
   \<^descr> \<^ML>\<open>Binding.qualify\<close>~\<open>mandatory name binding\<close> prefixes qualifier \<open>name\<close>
   to \<open>binding\<close>. The \<open>mandatory\<close> flag tells if this name component always needs
   to be given in name space accesses --- this is mostly \<open>false\<close> in practice.
   Note that this part of qualification is typically used in derived
   specification mechanisms.
 
   \<^descr> \<^ML>\<open>Binding.prefix\<close> is similar to \<^ML>\<open>Binding.qualify\<close>, but affects the
   system prefix. This part of extra qualification is typically used in the
   infrastructure for modular specifications, notably ``local theory targets''
   (see also \chref{ch:local-theory}).
 
   \<^descr> \<^ML>\<open>Binding.concealed\<close>~\<open>binding\<close> indicates that the binding shall refer
   to an entity that serves foundational purposes only. This flag helps to mark
   implementation details of specification mechanism etc. Other tools should
   not depend on the particulars of concealed entities (cf.\ \<^ML>\<open>Name_Space.is_concealed\<close>).
 
   \<^descr> \<^ML>\<open>Binding.print\<close>~\<open>binding\<close> produces a string representation for
   human-readable output, together with some formal markup that might get used
   in GUI front-ends, for example.
 
   \<^descr> Type \<^ML_type>\<open>Name_Space.naming\<close> represents the abstract concept of a
   naming policy.
 
   \<^descr> \<^ML>\<open>Name_Space.global_naming\<close> is the default naming policy: it is global
   and lacks any path prefix. In a regular theory context this is augmented by
   a path prefix consisting of the theory name.
 
   \<^descr> \<^ML>\<open>Name_Space.add_path\<close>~\<open>path naming\<close> augments the naming policy by
   extending its path component.
 
   \<^descr> \<^ML>\<open>Name_Space.full_name\<close>~\<open>naming binding\<close> turns a name binding (usually
   a basic name) into the fully qualified internal name, according to the given
   naming policy.
 
   \<^descr> Type \<^ML_type>\<open>Name_Space.T\<close> represents name spaces.
 
   \<^descr> \<^ML>\<open>Name_Space.empty\<close>~\<open>kind\<close> and \<^ML>\<open>Name_Space.merge\<close>~\<open>(space\<^sub>1,
   space\<^sub>2)\<close> are the canonical operations for maintaining name spaces according
   to theory data management (\secref{sec:context-data}); \<open>kind\<close> is a formal
   comment to characterize the purpose of a name space.
 
   \<^descr> \<^ML>\<open>Name_Space.declare\<close>~\<open>context strict binding space\<close> enters a name
   binding as fully qualified internal name into the name space, using the
   naming of the context.
 
   \<^descr> \<^ML>\<open>Name_Space.intern\<close>~\<open>space name\<close> internalizes a (partially qualified)
   external name.
 
   This operation is mostly for parsing! Note that fully qualified names
   stemming from declarations are produced via \<^ML>\<open>Name_Space.full_name\<close> and
   \<^ML>\<open>Name_Space.declare\<close> (or their derivatives for \<^ML_type>\<open>theory\<close> and
   \<^ML_type>\<open>Proof.context\<close>).
 
   \<^descr> \<^ML>\<open>Name_Space.extern\<close>~\<open>ctxt space name\<close> externalizes a (fully qualified)
   internal name.
 
   This operation is mostly for printing! User code should not rely on the
   precise result too much.
 
   \<^descr> \<^ML>\<open>Name_Space.is_concealed\<close>~\<open>space name\<close> indicates whether \<open>name\<close> refers
   to a strictly private entity that other tools are supposed to ignore!
 \<close>
 
 text %mlantiq \<open>
   \begin{matharray}{rcl}
   @{ML_antiquotation_def "binding"} & : & \<open>ML_antiquotation\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
   @@{ML_antiquotation binding} embedded
   \<close>
 
   \<^descr> \<open>@{binding name}\<close> produces a binding with base name \<open>name\<close> and the source
   position taken from the concrete syntax of this antiquotation. In many
   situations this is more appropriate than the more basic \<^ML>\<open>Binding.name\<close>
   function.
 \<close>
 
 text %mlex \<open>
   The following example yields the source position of some concrete binding
   inlined into the text:
 \<close>
 
 ML_val \<open>Binding.pos_of \<^binding>\<open>here\<close>\<close>
 
 text \<open>
   \<^medskip>
   That position can be also printed in a message as follows:
 \<close>
 
 ML_command
   \<open>writeln
     ("Look here" ^ Position.here (Binding.pos_of \<^binding>\<open>here\<close>))\<close>
 
 text \<open>
   This illustrates a key virtue of formalized bindings as opposed to raw
   specifications of base names: the system can use this additional information
   for feedback given to the user (error messages etc.).
 
   \<^medskip>
   The following example refers to its source position directly, which is
   occasionally useful for experimentation and diagnostic purposes:
 \<close>
 
 ML_command \<open>warning ("Look here" ^ Position.here \<^here>)\<close>
 
 end
diff --git a/src/Doc/Implementation/Proof.thy b/src/Doc/Implementation/Proof.thy
--- a/src/Doc/Implementation/Proof.thy
+++ b/src/Doc/Implementation/Proof.thy
@@ -1,483 +1,483 @@
 (*:maxLineLen=78:*)
 
 theory Proof
 imports Base
 begin
 
 chapter \<open>Structured proofs\<close>
 
 section \<open>Variables \label{sec:variables}\<close>
 
 text \<open>
   Any variable that is not explicitly bound by \<open>\<lambda>\<close>-abstraction is considered
   as ``free''. Logically, free variables act like outermost universal
   quantification at the sequent level: \<open>A\<^sub>1(x), \<dots>, A\<^sub>n(x) \<turnstile> B(x)\<close> means that
   the result holds \<^emph>\<open>for all\<close> values of \<open>x\<close>. Free variables for terms (not
   types) can be fully internalized into the logic: \<open>\<turnstile> B(x)\<close> and \<open>\<turnstile> \<And>x. B(x)\<close>
   are interchangeable, provided that \<open>x\<close> does not occur elsewhere in the
   context. Inspecting \<open>\<turnstile> \<And>x. B(x)\<close> more closely, we see that inside the
   quantifier, \<open>x\<close> is essentially ``arbitrary, but fixed'', while from outside
   it appears as a place-holder for instantiation (thanks to \<open>\<And>\<close> elimination).
 
   The Pure logic represents the idea of variables being either inside or
   outside the current scope by providing separate syntactic categories for
   \<^emph>\<open>fixed variables\<close> (e.g.\ \<open>x\<close>) vs.\ \<^emph>\<open>schematic variables\<close> (e.g.\ \<open>?x\<close>).
   Incidently, a universal result \<open>\<turnstile> \<And>x. B(x)\<close> has the HHF normal form \<open>\<turnstile>
   B(?x)\<close>, which represents its generality without requiring an explicit
   quantifier. The same principle works for type variables: \<open>\<turnstile> B(?\<alpha>)\<close>
   represents the idea of ``\<open>\<turnstile> \<forall>\<alpha>. B(\<alpha>)\<close>'' without demanding a truly
   polymorphic framework.
 
   \<^medskip>
   Additional care is required to treat type variables in a way that
   facilitates type-inference. In principle, term variables depend on type
   variables, which means that type variables would have to be declared first.
   For example, a raw type-theoretic framework would demand the context to be
   constructed in stages as follows: \<open>\<Gamma> = \<alpha>: type, x: \<alpha>, a: A(x\<^sub>\<alpha>)\<close>.
 
   We allow a slightly less formalistic mode of operation: term variables \<open>x\<close>
   are fixed without specifying a type yet (essentially \<^emph>\<open>all\<close> potential
   occurrences of some instance \<open>x\<^sub>\<tau>\<close> are fixed); the first occurrence of \<open>x\<close>
   within a specific term assigns its most general type, which is then
   maintained consistently in the context. The above example becomes \<open>\<Gamma> = x:
   term, \<alpha>: type, A(x\<^sub>\<alpha>)\<close>, where type \<open>\<alpha>\<close> is fixed \<^emph>\<open>after\<close> term \<open>x\<close>, and the
   constraint \<open>x :: \<alpha>\<close> is an implicit consequence of the occurrence of \<open>x\<^sub>\<alpha>\<close> in
   the subsequent proposition.
 
   This twist of dependencies is also accommodated by the reverse operation of
   exporting results from a context: a type variable \<open>\<alpha>\<close> is considered fixed as
   long as it occurs in some fixed term variable of the context. For example,
   exporting \<open>x: term, \<alpha>: type \<turnstile> x\<^sub>\<alpha> \<equiv> x\<^sub>\<alpha>\<close> produces in the first step \<open>x: term
   \<turnstile> x\<^sub>\<alpha> \<equiv> x\<^sub>\<alpha>\<close> for fixed \<open>\<alpha>\<close>, and only in the second step \<open>\<turnstile> ?x\<^sub>?\<^sub>\<alpha> \<equiv> ?x\<^sub>?\<^sub>\<alpha>\<close>
   for schematic \<open>?x\<close> and \<open>?\<alpha>\<close>. The following Isar source text illustrates this
   scenario.
 \<close>
 
 notepad
 begin
   {
     fix x  \<comment> \<open>all potential occurrences of some \<open>x::\<tau>\<close> are fixed\<close>
     {
       have "x::'a \<equiv> x"  \<comment> \<open>implicit type assignment by concrete occurrence\<close>
         by (rule reflexive)
     }
     thm this  \<comment> \<open>result still with fixed type \<open>'a\<close>\<close>
   }
   thm this  \<comment> \<open>fully general result for arbitrary \<open>?x::?'a\<close>\<close>
 end
 
 text \<open>
   The Isabelle/Isar proof context manages the details of term vs.\ type
   variables, with high-level principles for moving the frontier between fixed
   and schematic variables.
 
   The \<open>add_fixes\<close> operation explicitly declares fixed variables; the
   \<open>declare_term\<close> operation absorbs a term into a context by fixing new type
   variables and adding syntactic constraints.
 
   The \<open>export\<close> operation is able to perform the main work of generalizing term
   and type variables as sketched above, assuming that fixing variables and
   terms have been declared properly.
 
   There \<open>import\<close> operation makes a generalized fact a genuine part of the
   context, by inventing fixed variables for the schematic ones. The effect can
   be reversed by using \<open>export\<close> later, potentially with an extended context;
   the result is equivalent to the original modulo renaming of schematic
   variables.
 
   The \<open>focus\<close> operation provides a variant of \<open>import\<close> for nested propositions
   (with explicit quantification): \<open>\<And>x\<^sub>1 \<dots> x\<^sub>n. B(x\<^sub>1, \<dots>, x\<^sub>n)\<close> is decomposed
   by inventing fixed variables \<open>x\<^sub>1, \<dots>, x\<^sub>n\<close> for the body.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
   @{define_ML Variable.add_fixes: "
   string list -> Proof.context -> string list * Proof.context"} \\
   @{define_ML Variable.variant_fixes: "
   string list -> Proof.context -> string list * Proof.context"} \\
   @{define_ML Variable.declare_term: "term -> Proof.context -> Proof.context"} \\
   @{define_ML Variable.declare_constraints: "term -> Proof.context -> Proof.context"} \\
   @{define_ML Variable.export: "Proof.context -> Proof.context -> thm list -> thm list"} \\
   @{define_ML Variable.polymorphic: "Proof.context -> term list -> term list"} \\
   @{define_ML Variable.import: "bool -> thm list -> Proof.context ->
   ((ctyp TVars.table * cterm Vars.table) * thm list)
     * Proof.context"} \\
   @{define_ML Variable.focus: "binding list option -> term -> Proof.context ->
   ((string * (string * typ)) list * term) * Proof.context"} \\
   \end{mldecls}
 
   \<^descr> \<^ML>\<open>Variable.add_fixes\<close>~\<open>xs ctxt\<close> fixes term variables \<open>xs\<close>, returning
   the resulting internal names. By default, the internal representation
   coincides with the external one, which also means that the given variables
   must not be fixed already. There is a different policy within a local proof
   body: the given names are just hints for newly invented Skolem variables.
 
   \<^descr> \<^ML>\<open>Variable.variant_fixes\<close> is similar to \<^ML>\<open>Variable.add_fixes\<close>, but
   always produces fresh variants of the given names.
 
   \<^descr> \<^ML>\<open>Variable.declare_term\<close>~\<open>t ctxt\<close> declares term \<open>t\<close> to belong to the
   context. This automatically fixes new type variables, but not term
   variables. Syntactic constraints for type and term variables are declared
   uniformly, though.
 
   \<^descr> \<^ML>\<open>Variable.declare_constraints\<close>~\<open>t ctxt\<close> declares syntactic constraints
   from term \<open>t\<close>, without making it part of the context yet.
 
   \<^descr> \<^ML>\<open>Variable.export\<close>~\<open>inner outer thms\<close> generalizes fixed type and term
   variables in \<open>thms\<close> according to the difference of the \<open>inner\<close> and \<open>outer\<close>
   context, following the principles sketched above.
 
   \<^descr> \<^ML>\<open>Variable.polymorphic\<close>~\<open>ctxt ts\<close> generalizes type variables in \<open>ts\<close> as
   far as possible, even those occurring in fixed term variables. The default
   policy of type-inference is to fix newly introduced type variables, which is
   essentially reversed with \<^ML>\<open>Variable.polymorphic\<close>: here the given terms
   are detached from the context as far as possible.
 
   \<^descr> \<^ML>\<open>Variable.import\<close>~\<open>open thms ctxt\<close> invents fixed type and term
   variables for the schematic ones occurring in \<open>thms\<close>. The \<open>open\<close> flag
   indicates whether the fixed names should be accessible to the user,
   otherwise newly introduced names are marked as ``internal''
   (\secref{sec:names}).
 
   \<^descr> \<^ML>\<open>Variable.focus\<close>~\<open>bindings B\<close> decomposes the outermost \<open>\<And>\<close> prefix of
   proposition \<open>B\<close>, using the given name bindings.
 \<close>
 
 text %mlex \<open>
   The following example shows how to work with fixed term and type parameters
   and with type-inference.
 \<close>
 
 ML_val \<open>
   (*static compile-time context -- for testing only*)
   val ctxt0 = \<^context>;
 
   (*locally fixed parameters -- no type assignment yet*)
   val ([x, y], ctxt1) = ctxt0 |> Variable.add_fixes ["x", "y"];
 
   (*t1: most general fixed type; t1': most general arbitrary type*)
   val t1 = Syntax.read_term ctxt1 "x";
   val t1' = singleton (Variable.polymorphic ctxt1) t1;
 
   (*term u enforces specific type assignment*)
   val u = Syntax.read_term ctxt1 "(x::nat) \<equiv> y";
 
   (*official declaration of u -- propagates constraints etc.*)
   val ctxt2 = ctxt1 |> Variable.declare_term u;
   val t2 = Syntax.read_term ctxt2 "x";  (*x::nat is enforced*)
 \<close>
 
 text \<open>
   In the above example, the starting context is derived from the toplevel
   theory, which means that fixed variables are internalized literally: \<open>x\<close> is
   mapped again to \<open>x\<close>, and attempting to fix it again in the subsequent
   context is an error. Alternatively, fixed parameters can be renamed
   explicitly as follows:
 \<close>
 
 ML_val \<open>
   val ctxt0 = \<^context>;
   val ([x1, x2, x3], ctxt1) =
     ctxt0 |> Variable.variant_fixes ["x", "x", "x"];
 \<close>
 
 text \<open>
   The following ML code can now work with the invented names of \<open>x1\<close>, \<open>x2\<close>,
   \<open>x3\<close>, without depending on the details on the system policy for introducing
   these variants. Recall that within a proof body the system always invents
   fresh ``Skolem constants'', e.g.\ as follows:
 \<close>
 
 notepad
 begin
   ML_prf %"ML"
    \<open>val ctxt0 = \<^context>;
 
     val ([x1], ctxt1) = ctxt0 |> Variable.add_fixes ["x"];
     val ([x2], ctxt2) = ctxt1 |> Variable.add_fixes ["x"];
     val ([x3], ctxt3) = ctxt2 |> Variable.add_fixes ["x"];
 
     val ([y1, y2], ctxt4) =
       ctxt3 |> Variable.variant_fixes ["y", "y"];\<close>
 end
 
 text \<open>
   In this situation \<^ML>\<open>Variable.add_fixes\<close> and \<^ML>\<open>Variable.variant_fixes\<close>
   are very similar, but identical name proposals given in a row are only
   accepted by the second version.
 \<close>
 
 
 section \<open>Assumptions \label{sec:assumptions}\<close>
 
 text \<open>
   An \<^emph>\<open>assumption\<close> is a proposition that it is postulated in the current
   context. Local conclusions may use assumptions as additional facts, but this
   imposes implicit hypotheses that weaken the overall statement.
 
   Assumptions are restricted to fixed non-schematic statements, i.e.\ all
   generality needs to be expressed by explicit quantifiers. Nevertheless, the
   result will be in HHF normal form with outermost quantifiers stripped. For
   example, by assuming \<open>\<And>x :: \<alpha>. P x\<close> we get \<open>\<And>x :: \<alpha>. P x \<turnstile> P ?x\<close> for
   schematic \<open>?x\<close> of fixed type \<open>\<alpha>\<close>. Local derivations accumulate more and more
   explicit references to hypotheses: \<open>A\<^sub>1, \<dots>, A\<^sub>n \<turnstile> B\<close> where \<open>A\<^sub>1, \<dots>, A\<^sub>n\<close>
   needs to be covered by the assumptions of the current context.
 
   \<^medskip>
   The \<open>add_assms\<close> operation augments the context by local assumptions, which
   are parameterized by an arbitrary \<open>export\<close> rule (see below).
 
   The \<open>export\<close> operation moves facts from a (larger) inner context into a
   (smaller) outer context, by discharging the difference of the assumptions as
   specified by the associated export rules. Note that the discharged portion
   is determined by the difference of contexts, not the facts being exported!
   There is a separate flag to indicate a goal context, where the result is
   meant to refine an enclosing sub-goal of a structured proof state.
 
   \<^medskip>
   The most basic export rule discharges assumptions directly by means of the
   \<open>\<Longrightarrow>\<close> introduction rule:
   \[
   \infer[(\<open>\<Longrightarrow>\<hyphen>intro\<close>)]{\<open>\<Gamma> - A \<turnstile> A \<Longrightarrow> B\<close>}{\<open>\<Gamma> \<turnstile> B\<close>}
   \]
 
   The variant for goal refinements marks the newly introduced premises, which
   causes the canonical Isar goal refinement scheme to enforce unification with
   local premises within the goal:
   \[
   \infer[(\<open>#\<Longrightarrow>\<hyphen>intro\<close>)]{\<open>\<Gamma> - A \<turnstile> #A \<Longrightarrow> B\<close>}{\<open>\<Gamma> \<turnstile> B\<close>}
   \]
 
   \<^medskip>
   Alternative versions of assumptions may perform arbitrary transformations on
   export, as long as the corresponding portion of hypotheses is removed from
   the given facts. For example, a local definition works by fixing \<open>x\<close> and
   assuming \<open>x \<equiv> t\<close>, with the following export rule to reverse the effect:
   \[
   \infer[(\<open>\<equiv>\<hyphen>expand\<close>)]{\<open>\<Gamma> - (x \<equiv> t) \<turnstile> B t\<close>}{\<open>\<Gamma> \<turnstile> B x\<close>}
   \]
   This works, because the assumption \<open>x \<equiv> t\<close> was introduced in a context with
   \<open>x\<close> being fresh, so \<open>x\<close> does not occur in \<open>\<Gamma>\<close> here.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
   @{define_ML_type Assumption.export} \\
   @{define_ML Assumption.assume: "Proof.context -> cterm -> thm"} \\
   @{define_ML Assumption.add_assms:
     "Assumption.export ->
   cterm list -> Proof.context -> thm list * Proof.context"} \\
   @{define_ML Assumption.add_assumes: "
   cterm list -> Proof.context -> thm list * Proof.context"} \\
   @{define_ML Assumption.export: "bool -> Proof.context -> Proof.context -> thm -> thm"} \\
   @{define_ML Assumption.export_term: "Proof.context -> Proof.context -> term -> term"} \\
   \end{mldecls}
 
   \<^descr> Type \<^ML_type>\<open>Assumption.export\<close> represents export rules, as a pair of
   functions \<^ML_type>\<open>bool -> cterm list -> (thm -> thm) * (term -> term)\<close>.
   The \<^ML_type>\<open>bool\<close> argument indicates goal mode, and the \<^ML_type>\<open>cterm list\<close>
   the collection of assumptions to be discharged simultaneously.
 
   \<^descr> \<^ML>\<open>Assumption.assume\<close>~\<open>ctxt A\<close> turns proposition \<open>A\<close> into a primitive
   assumption \<open>A \<turnstile> A'\<close>, where the conclusion \<open>A'\<close> is in HHF normal form.
 
   \<^descr> \<^ML>\<open>Assumption.add_assms\<close>~\<open>r As\<close> augments the context by assumptions \<open>As\<close>
   with export rule \<open>r\<close>. The resulting facts are hypothetical theorems as
   produced by the raw \<^ML>\<open>Assumption.assume\<close>.
 
   \<^descr> \<^ML>\<open>Assumption.add_assumes\<close>~\<open>As\<close> is a special case of
   \<^ML>\<open>Assumption.add_assms\<close> where the export rule performs \<open>\<Longrightarrow>\<hyphen>intro\<close> or
   \<open>#\<Longrightarrow>\<hyphen>intro\<close>, depending on goal mode.
 
   \<^descr> \<^ML>\<open>Assumption.export\<close>~\<open>is_goal inner outer thm\<close> exports result \<open>thm\<close>
   from the \<open>inner\<close> context back into the \<open>outer\<close> one; \<open>is_goal = true\<close> means
   this is a goal context. The result is in HHF normal form. Note that
   \<^ML>\<open>Proof_Context.export\<close> combines \<^ML>\<open>Variable.export\<close> and
   \<^ML>\<open>Assumption.export\<close> in the canonical way.
 
   \<^descr> \<^ML>\<open>Assumption.export_term\<close>~\<open>inner outer t\<close> exports term \<open>t\<close> from the
   \<open>inner\<close> context back into the \<open>outer\<close> one. This is analogous to
   \<^ML>\<open>Assumption.export\<close>, but only takes syntactical aspects of the
   context into account (such as locally specified variables as seen in
   @{command define} or @{command obtain}).
 \<close>
 
 text %mlex \<open>
   The following example demonstrates how rules can be derived by building up a
   context of assumptions first, and exporting some local fact afterwards. We
   refer to \<^theory>\<open>Pure\<close> equality here for testing purposes.
 \<close>
 
 ML_val \<open>
   (*static compile-time context -- for testing only*)
   val ctxt0 = \<^context>;
 
   val ([eq], ctxt1) =
     ctxt0 |> Assumption.add_assumes [\<^cprop>\<open>x \<equiv> y\<close>];
   val eq' = Thm.symmetric eq;
 
   (*back to original context -- discharges assumption*)
   val r = Assumption.export false ctxt1 ctxt0 eq';
 \<close>
 
 text \<open>
   Note that the variables of the resulting rule are not generalized. This
   would have required to fix them properly in the context beforehand, and
   export wrt.\ variables afterwards (cf.\ \<^ML>\<open>Variable.export\<close> or the
   combined \<^ML>\<open>Proof_Context.export\<close>).
 \<close>
 
 
 section \<open>Structured goals and results \label{sec:struct-goals}\<close>
 
 text \<open>
   Local results are established by monotonic reasoning from facts within a
   context. This allows common combinations of theorems, e.g.\ via \<open>\<And>/\<Longrightarrow>\<close>
   elimination, resolution rules, or equational reasoning, see
   \secref{sec:thms}. Unaccounted context manipulations should be avoided,
   notably raw \<open>\<And>/\<Longrightarrow>\<close> introduction or ad-hoc references to free variables or
   assumptions not present in the proof context.
 
   \<^medskip>
   The \<open>SUBPROOF\<close> combinator allows to structure a tactical proof recursively
   by decomposing a selected sub-goal: \<open>(\<And>x. A(x) \<Longrightarrow> B(x)) \<Longrightarrow> \<dots>\<close> is turned into
   \<open>B(x) \<Longrightarrow> \<dots>\<close> after fixing \<open>x\<close> and assuming \<open>A(x)\<close>. This means the tactic needs
   to solve the conclusion, but may use the premise as a local fact, for
   locally fixed variables.
 
   The family of \<open>FOCUS\<close> combinators is similar to \<open>SUBPROOF\<close>, but allows to
   retain schematic variables and pending subgoals in the resulting goal state.
 
   The \<open>prove\<close> operation provides an interface for structured backwards
   reasoning under program control, with some explicit sanity checks of the
   result. The goal context can be augmented by additional fixed variables
   (cf.\ \secref{sec:variables}) and assumptions (cf.\
   \secref{sec:assumptions}), which will be available as local facts during the
   proof and discharged into implications in the result. Type and term
   variables are generalized as usual, according to the context.
 
   The \<open>obtain\<close> operation produces results by eliminating existing facts by
   means of a given tactic. This acts like a dual conclusion: the proof
   demonstrates that the context may be augmented by parameters and
   assumptions, without affecting any conclusions that do not mention these
-  parameters. See also @{cite "isabelle-isar-ref"} for the corresponding Isar
+  parameters. See also \<^cite>\<open>"isabelle-isar-ref"\<close> for the corresponding Isar
   proof command @{command obtain}. Final results, which may not refer to the
   parameters in the conclusion, need to exported explicitly into the original
   context.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
   @{define_ML SUBPROOF: "(Subgoal.focus -> tactic) ->
   Proof.context -> int -> tactic"} \\
   @{define_ML Subgoal.FOCUS: "(Subgoal.focus -> tactic) ->
   Proof.context -> int -> tactic"} \\
   @{define_ML Subgoal.FOCUS_PREMS: "(Subgoal.focus -> tactic) ->
   Proof.context -> int -> tactic"} \\
   @{define_ML Subgoal.FOCUS_PARAMS: "(Subgoal.focus -> tactic) ->
   Proof.context -> int -> tactic"} \\
   @{define_ML Subgoal.focus: "Proof.context -> int -> binding list option ->
   thm -> Subgoal.focus * thm"} \\
   @{define_ML Subgoal.focus_prems: "Proof.context -> int -> binding list option ->
   thm -> Subgoal.focus * thm"} \\
   @{define_ML Subgoal.focus_params: "Proof.context -> int -> binding list option ->
   thm -> Subgoal.focus * thm"} \\
   \end{mldecls}
 
   \begin{mldecls}
   @{define_ML Goal.prove: "Proof.context -> string list -> term list -> term ->
   ({prems: thm list, context: Proof.context} -> tactic) -> thm"} \\
   @{define_ML Goal.prove_common: "Proof.context -> int option ->
   string list -> term list -> term list ->
   ({prems: thm list, context: Proof.context} -> tactic) -> thm list"} \\
   \end{mldecls}
   \begin{mldecls}
   @{define_ML Obtain.result: "(Proof.context -> tactic) -> thm list ->
   Proof.context -> ((string * cterm) list * thm list) * Proof.context"} \\
   \end{mldecls}
 
   \<^descr> \<^ML>\<open>SUBPROOF\<close>~\<open>tac ctxt i\<close> decomposes the structure of the specified
   sub-goal, producing an extended context and a reduced goal, which needs to
   be solved by the given tactic. All schematic parameters of the goal are
   imported into the context as fixed ones, which may not be instantiated in
   the sub-proof.
 
   \<^descr> \<^ML>\<open>Subgoal.FOCUS\<close>, \<^ML>\<open>Subgoal.FOCUS_PREMS\<close>, and \<^ML>\<open>Subgoal.FOCUS_PARAMS\<close> are similar to \<^ML>\<open>SUBPROOF\<close>, but are slightly more
   flexible: only the specified parts of the subgoal are imported into the
   context, and the body tactic may introduce new subgoals and schematic
   variables.
 
   \<^descr> \<^ML>\<open>Subgoal.focus\<close>, \<^ML>\<open>Subgoal.focus_prems\<close>, \<^ML>\<open>Subgoal.focus_params\<close>
   extract the focus information from a goal state in the same way as the
   corresponding tacticals above. This is occasionally useful to experiment
   without writing actual tactics yet.
 
   \<^descr> \<^ML>\<open>Goal.prove\<close>~\<open>ctxt xs As C tac\<close> states goal \<open>C\<close> in the context
   augmented by fixed variables \<open>xs\<close> and assumptions \<open>As\<close>, and applies tactic
   \<open>tac\<close> to solve it. The latter may depend on the local assumptions being
   presented as facts. The result is in HHF normal form.
 
   \<^descr> \<^ML>\<open>Goal.prove_common\<close>~\<open>ctxt fork_pri\<close> is the common form to state and
   prove a simultaneous goal statement, where \<^ML>\<open>Goal.prove\<close> is a convenient
   shorthand that is most frequently used in applications.
 
   The given list of simultaneous conclusions is encoded in the goal state by
   means of Pure conjunction: \<^ML>\<open>Goal.conjunction_tac\<close> will turn this into a
   collection of individual subgoals, but note that the original multi-goal
   state is usually required for advanced induction.
 
   It is possible to provide an optional priority for a forked proof, typically
   \<^ML>\<open>SOME ~1\<close>, while \<^ML>\<open>NONE\<close> means the proof is immediate (sequential)
   as for \<^ML>\<open>Goal.prove\<close>. Note that a forked proof does not exhibit any
   failures in the usual way via exceptions in ML, but accumulates error
   situations under the execution id of the running transaction. Thus the
   system is able to expose error messages ultimately to the end-user, even
   though the subsequent ML code misses them.
 
   \<^descr> \<^ML>\<open>Obtain.result\<close>~\<open>tac thms ctxt\<close> eliminates the given facts using a
   tactic, which results in additional fixed variables and assumptions in the
   context. Final results need to be exported explicitly.
 \<close>
 
 text %mlex \<open>
   The following minimal example illustrates how to access the focus
   information of a structured goal state.
 \<close>
 
 notepad
 begin
   fix A B C :: "'a \<Rightarrow> bool"
 
   have "\<And>x. A x \<Longrightarrow> B x \<Longrightarrow> C x"
     ML_val
      \<open>val {goal, context = goal_ctxt, ...} = @{Isar.goal};
       val (focus as {params, asms, concl, ...}, goal') =
         Subgoal.focus goal_ctxt 1 (SOME [\<^binding>\<open>x\<close>]) goal;
       val [A, B] = #prems focus;
       val [(_, x)] = #params focus;\<close>
     sorry
 end
 
 text \<open>
   \<^medskip>
   The next example demonstrates forward-elimination in a local context, using
   \<^ML>\<open>Obtain.result\<close>.
 \<close>
 
 notepad
 begin
   assume ex: "\<exists>x. B x"
 
   ML_prf %"ML"
    \<open>val ctxt0 = \<^context>;
     val (([(_, x)], [B]), ctxt1) = ctxt0
       |> Obtain.result (fn _ => eresolve_tac ctxt0 @{thms exE} 1) [@{thm ex}];\<close>
   ML_prf %"ML"
    \<open>singleton (Proof_Context.export ctxt1 ctxt0) @{thm refl};\<close>
   ML_prf %"ML"
    \<open>Proof_Context.export ctxt1 ctxt0 [Thm.reflexive x]
       handle ERROR msg => (warning msg; []);\<close>
 end
 
 end
diff --git a/src/Doc/Implementation/Syntax.thy b/src/Doc/Implementation/Syntax.thy
--- a/src/Doc/Implementation/Syntax.thy
+++ b/src/Doc/Implementation/Syntax.thy
@@ -1,259 +1,257 @@
 (*:maxLineLen=78:*)
 
 theory Syntax
 imports Base
 begin
 
 chapter \<open>Concrete syntax and type-checking\<close>
 
 text \<open>
   Pure \<open>\<lambda>\<close>-calculus as introduced in \chref{ch:logic} is an adequate
   foundation for logical languages --- in the tradition of \<^emph>\<open>higher-order
   abstract syntax\<close> --- but end-users require additional means for reading and
   printing of terms and types. This important add-on outside the logical core
   is called \<^emph>\<open>inner syntax\<close> in Isabelle jargon, as opposed to the \<^emph>\<open>outer
-  syntax\<close> of the theory and proof language @{cite "isabelle-isar-ref"}.
+  syntax\<close> of the theory and proof language \<^cite>\<open>"isabelle-isar-ref"\<close>.
 
-  For example, according to @{cite church40} quantifiers are represented as
+  For example, according to \<^cite>\<open>church40\<close> quantifiers are represented as
   higher-order constants \<open>All :: ('a \<Rightarrow> bool) \<Rightarrow> bool\<close> such that \<open>All (\<lambda>x::'a. B
   x)\<close> faithfully represents the idea that is displayed in Isabelle as \<open>\<forall>x::'a.
   B x\<close> via @{keyword "binder"} notation. Moreover, type-inference in the style
-  of Hindley-Milner @{cite hindleymilner} (and extensions) enables users to
+  of Hindley-Milner \<^cite>\<open>hindleymilner\<close> (and extensions) enables users to
   write \<open>\<forall>x. B x\<close> concisely, when the type \<open>'a\<close> is already clear from the
   context.\<^footnote>\<open>Type-inference taken to the extreme can easily confuse users.
   Beginners often stumble over unexpectedly general types inferred by the
   system.\<close>
 
   \<^medskip>
   The main inner syntax operations are \<^emph>\<open>read\<close> for parsing together with
   type-checking, and \<^emph>\<open>pretty\<close> for formatted output. See also
   \secref{sec:read-print}.
 
   Furthermore, the input and output syntax layers are sub-divided into
   separate phases for \<^emph>\<open>concrete syntax\<close> versus \<^emph>\<open>abstract syntax\<close>, see also
   \secref{sec:parse-unparse} and \secref{sec:term-check}, respectively. This
   results in the following decomposition of the main operations:
 
     \<^item> \<open>read = parse; check\<close>
 
     \<^item> \<open>pretty = uncheck; unparse\<close>
 
   For example, some specification package might thus intercept syntax
   processing at a well-defined stage after \<open>parse\<close>, to a augment the resulting
   pre-term before full type-reconstruction is performed by \<open>check\<close>. Note that
   the formal status of bound variables, versus free variables, versus
   constants must not be changed between these phases.
 
   \<^medskip>
   In general, \<open>check\<close> and \<open>uncheck\<close> operate simultaneously on a list of terms.
   This is particular important for type-checking, to reconstruct types for
   several terms of the same context and scope. In contrast, \<open>parse\<close> and
   \<open>unparse\<close> operate separately on single terms.
 
   There are analogous operations to read and print types, with the same
   sub-division into phases.
 \<close>
 
 
 section \<open>Reading and pretty printing \label{sec:read-print}\<close>
 
 text \<open>
   Read and print operations are roughly dual to each other, such that for the
   user \<open>s' = pretty (read s)\<close> looks similar to the original source text \<open>s\<close>,
   but the details depend on many side-conditions. There are also explicit
   options to control the removal of type information in the output. The
   default configuration routinely looses information, so \<open>t' = read (pretty
   t)\<close> might fail, or produce a differently typed term, or a completely
   different term in the face of syntactic overloading.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
   @{define_ML Syntax.read_typs: "Proof.context -> string list -> typ list"} \\
   @{define_ML Syntax.read_terms: "Proof.context -> string list -> term list"} \\
   @{define_ML Syntax.read_props: "Proof.context -> string list -> term list"} \\[0.5ex]
   @{define_ML Syntax.read_typ: "Proof.context -> string -> typ"} \\
   @{define_ML Syntax.read_term: "Proof.context -> string -> term"} \\
   @{define_ML Syntax.read_prop: "Proof.context -> string -> term"} \\[0.5ex]
   @{define_ML Syntax.pretty_typ: "Proof.context -> typ -> Pretty.T"} \\
   @{define_ML Syntax.pretty_term: "Proof.context -> term -> Pretty.T"} \\
   @{define_ML Syntax.string_of_typ: "Proof.context -> typ -> string"} \\
   @{define_ML Syntax.string_of_term: "Proof.context -> term -> string"} \\
   \end{mldecls}
 
   \<^descr> \<^ML>\<open>Syntax.read_typs\<close>~\<open>ctxt strs\<close> parses and checks a simultaneous list
   of source strings as types of the logic.
 
   \<^descr> \<^ML>\<open>Syntax.read_terms\<close>~\<open>ctxt strs\<close> parses and checks a simultaneous list
   of source strings as terms of the logic. Type-reconstruction puts all parsed
   terms into the same scope: types of free variables ultimately need to
   coincide.
 
   If particular type-constraints are required for some of the arguments, the
   read operations needs to be split into its parse and check phases. Then it
   is possible to use \<^ML>\<open>Type.constraint\<close> on the intermediate pre-terms
   (\secref{sec:term-check}).
 
   \<^descr> \<^ML>\<open>Syntax.read_props\<close>~\<open>ctxt strs\<close> parses and checks a simultaneous list
   of source strings as terms of the logic, with an implicit type-constraint
   for each argument to enforce type \<^typ>\<open>prop\<close>; this also affects the inner
   syntax for parsing. The remaining type-reconstruction works as for \<^ML>\<open>Syntax.read_terms\<close>.
 
   \<^descr> \<^ML>\<open>Syntax.read_typ\<close>, \<^ML>\<open>Syntax.read_term\<close>, \<^ML>\<open>Syntax.read_prop\<close> are
   like the simultaneous versions, but operate on a single argument only. This
   convenient shorthand is adequate in situations where a single item in its
   own scope is processed. Do not use \<^ML>\<open>map o Syntax.read_term\<close> where \<^ML>\<open>Syntax.read_terms\<close> is actually intended!
 
   \<^descr> \<^ML>\<open>Syntax.pretty_typ\<close>~\<open>ctxt T\<close> and \<^ML>\<open>Syntax.pretty_term\<close>~\<open>ctxt t\<close>
   uncheck and pretty-print the given type or term, respectively. Although the
   uncheck phase acts on a simultaneous list as well, this is rarely used in
   practice, so only the singleton case is provided as combined pretty
   operation. There is no distinction of term vs.\ proposition.
 
   \<^descr> \<^ML>\<open>Syntax.string_of_typ\<close> and \<^ML>\<open>Syntax.string_of_term\<close> are convenient
   compositions of \<^ML>\<open>Syntax.pretty_typ\<close> and \<^ML>\<open>Syntax.pretty_term\<close> with
   \<^ML>\<open>Pretty.string_of\<close> for output. The result may be concatenated with other
   strings, as long as there is no further formatting and line-breaking
   involved.
 
 
   \<^ML>\<open>Syntax.read_term\<close>, \<^ML>\<open>Syntax.read_prop\<close>, and \<^ML>\<open>Syntax.string_of_term\<close> are the most important operations in practice.
 
   \<^medskip>
   Note that the string values that are passed in and out are annotated by the
-  system, to carry further markup that is relevant for the Prover IDE @{cite
-  "isabelle-jedit"}. User code should neither compose its own input strings,
+  system, to carry further markup that is relevant for the Prover IDE \<^cite>\<open>"isabelle-jedit"\<close>. User code should neither compose its own input strings,
   nor try to analyze the output strings. Conceptually this is an abstract
   datatype, encoded as concrete string for historical reasons.
 
   The standard way to provide the required position markup for input works via
   the outer syntax parser wrapper \<^ML>\<open>Parse.inner_syntax\<close>, which is already
   part of \<^ML>\<open>Parse.typ\<close>, \<^ML>\<open>Parse.term\<close>, \<^ML>\<open>Parse.prop\<close>. So a string
   obtained from one of the latter may be directly passed to the corresponding
   read operation: this yields PIDE markup of the input and precise positions
   for warning and error messages.
 \<close>
 
 
 section \<open>Parsing and unparsing \label{sec:parse-unparse}\<close>
 
 text \<open>
   Parsing and unparsing converts between actual source text and a certain
   \<^emph>\<open>pre-term\<close> format, where all bindings and scopes are already resolved
   faithfully. Thus the names of free variables or constants are determined in
   the sense of the logical context, but type information might be still
   missing. Pre-terms support an explicit language of \<^emph>\<open>type constraints\<close> that
   may be augmented by user code to guide the later \<^emph>\<open>check\<close> phase.
 
   Actual parsing is based on traditional lexical analysis and Earley parsing
   for arbitrary context-free grammars. The user can specify the grammar
   declaratively via mixfix annotations. Moreover, there are \<^emph>\<open>syntax
   translations\<close> that can be augmented by the user, either declaratively via
   @{command translations} or programmatically via @{command
-  parse_translation}, @{command print_translation} @{cite
-  "isabelle-isar-ref"}. The final scope-resolution is performed by the system,
+  parse_translation}, @{command print_translation} \<^cite>\<open>"isabelle-isar-ref"\<close>. The final scope-resolution is performed by the system,
   according to name spaces for types, term variables and constants determined
   by the context.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
   @{define_ML Syntax.parse_typ: "Proof.context -> string -> typ"} \\
   @{define_ML Syntax.parse_term: "Proof.context -> string -> term"} \\
   @{define_ML Syntax.parse_prop: "Proof.context -> string -> term"} \\[0.5ex]
   @{define_ML Syntax.unparse_typ: "Proof.context -> typ -> Pretty.T"} \\
   @{define_ML Syntax.unparse_term: "Proof.context -> term -> Pretty.T"} \\
   \end{mldecls}
 
   \<^descr> \<^ML>\<open>Syntax.parse_typ\<close>~\<open>ctxt str\<close> parses a source string as pre-type that
   is ready to be used with subsequent check operations.
 
   \<^descr> \<^ML>\<open>Syntax.parse_term\<close>~\<open>ctxt str\<close> parses a source string as pre-term that
   is ready to be used with subsequent check operations.
 
   \<^descr> \<^ML>\<open>Syntax.parse_prop\<close>~\<open>ctxt str\<close> parses a source string as pre-term that
   is ready to be used with subsequent check operations. The inner syntax
   category is \<^typ>\<open>prop\<close> and a suitable type-constraint is included to ensure
   that this information is observed in subsequent type reconstruction.
 
   \<^descr> \<^ML>\<open>Syntax.unparse_typ\<close>~\<open>ctxt T\<close> unparses a type after uncheck
   operations, to turn it into a pretty tree.
 
   \<^descr> \<^ML>\<open>Syntax.unparse_term\<close>~\<open>ctxt T\<close> unparses a term after uncheck
   operations, to turn it into a pretty tree. There is no distinction for
   propositions here.
 
 
   These operations always operate on a single item; use the combinator \<^ML>\<open>map\<close> to apply them to a list.
 \<close>
 
 
 section \<open>Checking and unchecking \label{sec:term-check}\<close>
 
 text \<open>
   These operations define the transition from pre-terms and fully-annotated
   terms in the sense of the logical core (\chref{ch:logic}).
 
   The \<^emph>\<open>check\<close> phase is meant to subsume a variety of mechanisms in the manner
   of ``type-inference'' or ``type-reconstruction'' or ``type-improvement'',
   not just type-checking in the narrow sense. The \<^emph>\<open>uncheck\<close> phase is roughly
   dual, it prunes type-information before pretty printing.
 
   A typical add-on for the check/uncheck syntax layer is the @{command
-  abbreviation} mechanism @{cite "isabelle-isar-ref"}. Here the user specifies
+  abbreviation} mechanism \<^cite>\<open>"isabelle-isar-ref"\<close>. Here the user specifies
   syntactic definitions that are managed by the system as polymorphic \<open>let\<close>
   bindings. These are expanded during the \<open>check\<close> phase, and contracted during
   the \<open>uncheck\<close> phase, without affecting the type-assignment of the given
   terms.
 
   \<^medskip>
   The precise meaning of type checking depends on the context --- additional
   check/uncheck modules might be defined in user space.
 
   For example, the @{command class} command defines a context where \<open>check\<close>
   treats certain type instances of overloaded constants according to the
   ``dictionary construction'' of its logical foundation. This involves ``type
   improvement'' (specialization of slightly too general types) and replacement
-  by certain locale parameters. See also @{cite "Haftmann-Wenzel:2009"}.
+  by certain locale parameters. See also \<^cite>\<open>"Haftmann-Wenzel:2009"\<close>.
 \<close>
 
 text %mlref \<open>
   \begin{mldecls}
   @{define_ML Syntax.check_typs: "Proof.context -> typ list -> typ list"} \\
   @{define_ML Syntax.check_terms: "Proof.context -> term list -> term list"} \\
   @{define_ML Syntax.check_props: "Proof.context -> term list -> term list"} \\[0.5ex]
   @{define_ML Syntax.uncheck_typs: "Proof.context -> typ list -> typ list"} \\
   @{define_ML Syntax.uncheck_terms: "Proof.context -> term list -> term list"} \\
   \end{mldecls}
 
   \<^descr> \<^ML>\<open>Syntax.check_typs\<close>~\<open>ctxt Ts\<close> checks a simultaneous list of pre-types
   as types of the logic. Typically, this involves normalization of type
   synonyms.
 
   \<^descr> \<^ML>\<open>Syntax.check_terms\<close>~\<open>ctxt ts\<close> checks a simultaneous list of pre-terms
   as terms of the logic. Typically, this involves type-inference and
   normalization term abbreviations. The types within the given terms are
   treated in the same way as for \<^ML>\<open>Syntax.check_typs\<close>.
 
   Applications sometimes need to check several types and terms together. The
   standard approach uses \<^ML>\<open>Logic.mk_type\<close> to embed the language of types
   into that of terms; all arguments are appended into one list of terms that
   is checked; afterwards the type arguments are recovered with \<^ML>\<open>Logic.dest_type\<close>.
 
   \<^descr> \<^ML>\<open>Syntax.check_props\<close>~\<open>ctxt ts\<close> checks a simultaneous list of pre-terms
   as terms of the logic, such that all terms are constrained by type \<^typ>\<open>prop\<close>. The remaining check operation works as \<^ML>\<open>Syntax.check_terms\<close>
   above.
 
   \<^descr> \<^ML>\<open>Syntax.uncheck_typs\<close>~\<open>ctxt Ts\<close> unchecks a simultaneous list of types
   of the logic, in preparation of pretty printing.
 
   \<^descr> \<^ML>\<open>Syntax.uncheck_terms\<close>~\<open>ctxt ts\<close> unchecks a simultaneous list of terms
   of the logic, in preparation of pretty printing. There is no distinction for
   propositions here.
 
 
   These operations always operate simultaneously on a list; use the combinator
   \<^ML>\<open>singleton\<close> to apply them to a single item.
 \<close>
 
 end
diff --git a/src/Doc/Isar_Ref/Document_Preparation.thy b/src/Doc/Isar_Ref/Document_Preparation.thy
--- a/src/Doc/Isar_Ref/Document_Preparation.thy
+++ b/src/Doc/Isar_Ref/Document_Preparation.thy
@@ -1,736 +1,735 @@
 (*:maxLineLen=78:*)
 
 theory Document_Preparation
   imports Main Base
 begin
 
 chapter \<open>Document preparation \label{ch:document-prep}\<close>
 
 text \<open>
   Isabelle/Isar provides a simple document preparation system based on
   {PDF-\LaTeX}, with support for hyperlinks and bookmarks within that format.
   This allows to produce papers, books, theses etc.\ from Isabelle theory
   sources.
 
   {\LaTeX} output is generated while processing a \<^emph>\<open>session\<close> in batch mode, as
-  explained in the \<^emph>\<open>The Isabelle System Manual\<close> @{cite "isabelle-system"}.
+  explained in the \<^emph>\<open>The Isabelle System Manual\<close> \<^cite>\<open>"isabelle-system"\<close>.
   The main Isabelle tools to get started with document preparation are
   @{tool_ref mkroot} and @{tool_ref build}.
 
-  The classic Isabelle/HOL tutorial @{cite "isabelle-hol-book"} also explains
+  The classic Isabelle/HOL tutorial \<^cite>\<open>"isabelle-hol-book"\<close> also explains
   some aspects of theory presentation.
 \<close>
 
 
 section \<open>Markup commands \label{sec:markup}\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{command_def "chapter"} & : & \<open>any \<rightarrow> any\<close> \\
     @{command_def "section"} & : & \<open>any \<rightarrow> any\<close> \\
     @{command_def "subsection"} & : & \<open>any \<rightarrow> any\<close> \\
     @{command_def "subsubsection"} & : & \<open>any \<rightarrow> any\<close> \\
     @{command_def "paragraph"} & : & \<open>any \<rightarrow> any\<close> \\
     @{command_def "subparagraph"} & : & \<open>any \<rightarrow> any\<close> \\
     @{command_def "text"} & : & \<open>any \<rightarrow> any\<close> \\
     @{command_def "txt"} & : & \<open>any \<rightarrow> any\<close> \\
     @{command_def "text_raw"} & : & \<open>any \<rightarrow> any\<close> \\
   \end{matharray}
 
   Markup commands provide a structured way to insert text into the document
   generated from a theory. Each markup command takes a single @{syntax text}
   argument, which is passed as argument to a corresponding {\LaTeX} macro. The
   default macros provided by \<^file>\<open>~~/lib/texinputs/isabelle.sty\<close> can be
   redefined according to the needs of the underlying document and {\LaTeX}
   styles.
 
   Note that formal comments (\secref{sec:comments}) are similar to markup
   commands, but have a different status within Isabelle/Isar syntax.
 
   \<^rail>\<open>
     (@@{command chapter} | @@{command section} | @@{command subsection} |
       @@{command subsubsection} | @@{command paragraph} | @@{command subparagraph})
       @{syntax text} ';'? |
     (@@{command text} | @@{command txt} | @@{command text_raw}) @{syntax text}
   \<close>
 
     \<^descr> @{command chapter}, @{command section}, @{command subsection} etc.\ mark
     section headings within the theory source. This works in any context, even
     before the initial @{command theory} command. The corresponding {\LaTeX}
     macros are \<^verbatim>\<open>\isamarkupchapter\<close>, \<^verbatim>\<open>\isamarkupsection\<close>,
     \<^verbatim>\<open>\isamarkupsubsection\<close> etc.\
 
     \<^descr> @{command text} and @{command txt} specify paragraphs of plain text.
     This corresponds to a {\LaTeX} environment \<^verbatim>\<open>\begin{isamarkuptext}\<close> \<open>\<dots>\<close>
     \<^verbatim>\<open>\end{isamarkuptext}\<close> etc.
 
     \<^descr> @{command text_raw} is similar to @{command text}, but without any
     surrounding markup environment. This allows to inject arbitrary {\LaTeX}
     source into the generated document.
 
   All text passed to any of the above markup commands may refer to formal
   entities via \<^emph>\<open>document antiquotations\<close>, see also \secref{sec:antiq}. These
   are interpreted in the present theory or proof context.
 
   \<^medskip>
   The proof markup commands closely resemble those for theory specifications,
   but have a different formal status and produce different {\LaTeX} macros.
 \<close>
 
 
 section \<open>Document antiquotations \label{sec:antiq}\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{antiquotation_def "theory"} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def "thm"} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def "lemma"} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def "prop"} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def "term"} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def term_type} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def typeof} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def const} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def abbrev} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def typ} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def type} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def class} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def locale} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def bundle} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def "text"} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def goals} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def subgoals} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def prf} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def full_prf} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def ML_text} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def ML} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def ML_def} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def ML_ref} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def ML_infix} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def ML_infix_def} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def ML_infix_ref} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def ML_type} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def ML_type_def} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def ML_type_ref} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def ML_structure} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def ML_structure_def} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def ML_structure_ref} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def ML_functor} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def ML_functor_def} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def ML_functor_ref} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def emph} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def bold} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def verbatim} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def bash_function} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def system_option} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def session} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def "file"} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def "url"} & : & \<open>antiquotation\<close> \\
     @{antiquotation_def "cite"} & : & \<open>antiquotation\<close> \\
     @{command_def "print_antiquotations"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
   \end{matharray}
 
   The overall content of an Isabelle/Isar theory may alternate between formal
   and informal text. The main body consists of formal specification and proof
   commands, interspersed with markup commands (\secref{sec:markup}) or
   document comments (\secref{sec:comments}). The argument of markup commands
   quotes informal text to be printed in the resulting document, but may again
   refer to formal entities via \<^emph>\<open>document antiquotations\<close>.
 
   For example, embedding \<^verbatim>\<open>@{term [show_types] "f x = a + x"}\<close>
   within a text block makes
   \isa{{\isacharparenleft}f{\isasymColon}{\isacharprime}a\ {\isasymRightarrow}\ {\isacharprime}a{\isacharparenright}\ {\isacharparenleft}x{\isasymColon}{\isacharprime}a{\isacharparenright}\ {\isacharequal}\ {\isacharparenleft}a{\isasymColon}{\isacharprime}a{\isacharparenright}\ {\isacharplus}\ x} appear in the final {\LaTeX} document.
 
   Antiquotations usually spare the author tedious typing of logical entities
   in full detail. Even more importantly, some degree of consistency-checking
   between the main body of formal text and its informal explanation is
   achieved, since terms and types appearing in antiquotations are checked
   within the current theory or proof context.
 
   \<^medskip>
   Antiquotations are in general written as
   \<^verbatim>\<open>@{\<close>\<open>name\<close>~\<^verbatim>\<open>[\<close>\<open>options\<close>\<^verbatim>\<open>]\<close>~\<open>arguments\<close>\<^verbatim>\<open>}\<close>. The short form
   \<^verbatim>\<open>\\<close>\<^verbatim>\<open><^\<close>\<open>name\<close>\<^verbatim>\<open>>\<close>\<open>\<open>argument_content\<close>\<close> (without surrounding \<^verbatim>\<open>@{\<close>\<open>\<dots>\<close>\<^verbatim>\<open>}\<close>)
   works for a single argument that is a cartouche. A cartouche without special
   decoration is equivalent to \<^verbatim>\<open>\<^cartouche>\<close>\<open>\<open>argument_content\<close>\<close>, which is
   equivalent to \<^verbatim>\<open>@{cartouche\<close>~\<open>\<open>argument_content\<close>\<close>\<^verbatim>\<open>}\<close>. The special name
   @{antiquotation_def cartouche} is defined in the context: Isabelle/Pure
   introduces that as an alias to @{antiquotation_ref text} (see below).
   Consequently, \<open>\<open>foo_bar + baz \<le> bazar\<close>\<close> prints literal quasi-formal text
   (unchecked). A control symbol \<^verbatim>\<open>\\<close>\<^verbatim>\<open><^\<close>\<open>name\<close>\<^verbatim>\<open>>\<close> within the body text, but
   without a subsequent cartouche, is equivalent to \<^verbatim>\<open>@{\<close>\<open>name\<close>\<^verbatim>\<open>}\<close>.
 
   \begingroup
   \def\isasymcontrolstart{\isatt{\isacharbackslash\isacharless\isacharcircum}}
   \<^rail>\<open>
     @{syntax_def antiquotation}:
       '@{' antiquotation_body '}' |
       '\<controlstart>' @{syntax_ref name} '>' @{syntax_ref cartouche} |
       @{syntax_ref cartouche}
     ;
     options: '[' (option * ',') ']'
     ;
     option: @{syntax name} | @{syntax name} '=' @{syntax name}
     ;
   \<close>
   \endgroup
 
   Note that the syntax of antiquotations may \<^emph>\<open>not\<close> include source comments
   \<^verbatim>\<open>(*\<close>~\<open>\<dots>\<close>~\<^verbatim>\<open>*)\<close> nor verbatim text \<^verbatim>\<open>{*\<close>~\<open>\<dots>\<close>~\<^verbatim>\<open>*}\<close>.
 
   %% FIXME less monolithic presentation, move to individual sections!?
   \<^rail>\<open>
     @{syntax_def antiquotation_body}:
       (@@{antiquotation text} | @@{antiquotation cartouche} | @@{antiquotation theory_text})
         options @{syntax text} |
       @@{antiquotation theory} options @{syntax embedded} |
       @@{antiquotation thm} options styles @{syntax thms} |
       @@{antiquotation lemma} options @{syntax prop} @'by' @{syntax method} @{syntax method}? |
       @@{antiquotation prop} options styles @{syntax prop} |
       @@{antiquotation term} options styles @{syntax term} |
       @@{antiquotation (HOL) value} options styles @{syntax term} |
       @@{antiquotation term_type} options styles @{syntax term} |
       @@{antiquotation typeof} options styles @{syntax term} |
       @@{antiquotation const} options @{syntax term} |
       @@{antiquotation abbrev} options @{syntax term} |
       @@{antiquotation typ} options @{syntax type} |
       @@{antiquotation type} options @{syntax embedded} |
       @@{antiquotation class} options @{syntax embedded} |
       @@{antiquotation locale} options @{syntax embedded} |
       @@{antiquotation bundle} options @{syntax embedded} |
       (@@{antiquotation command} | @@{antiquotation method} | @@{antiquotation attribute})
         options @{syntax name}
     ;
     @{syntax antiquotation}:
       @@{antiquotation goals} options |
       @@{antiquotation subgoals} options |
       @@{antiquotation prf} options @{syntax thms} |
       @@{antiquotation full_prf} options @{syntax thms} |
       @@{antiquotation ML_text} options @{syntax text} |
       @@{antiquotation ML} options @{syntax text} |
       @@{antiquotation ML_infix} options @{syntax text} |
       @@{antiquotation ML_type} options @{syntax typeargs} @{syntax text} |
       @@{antiquotation ML_structure} options @{syntax text} |
       @@{antiquotation ML_functor} options @{syntax text} |
       @@{antiquotation emph} options @{syntax text} |
       @@{antiquotation bold} options @{syntax text} |
       @@{antiquotation verbatim} options @{syntax text} |
       @@{antiquotation bash_function} options @{syntax embedded} |
       @@{antiquotation system_option} options @{syntax embedded} |
       @@{antiquotation session} options @{syntax embedded} |
       @@{antiquotation path} options @{syntax embedded} |
       @@{antiquotation "file"} options @{syntax name} |
       @@{antiquotation dir} options @{syntax name} |
       @@{antiquotation url} options @{syntax embedded} |
       (@@{antiquotation cite} | @@{antiquotation nocite} |
        @@{antiquotation citet} | @@{antiquotation citep}) @{syntax embedded}
     ;
     styles: '(' (style + ',') ')'
     ;
     style: (@{syntax name} +)
     ;
     @@{command print_antiquotations} ('!'?)
   \<close>
 
   \<^descr> \<open>@{text s}\<close> prints uninterpreted source text \<open>s\<close>, i.e.\ inner syntax. This
   is particularly useful to print portions of text according to the Isabelle
   document style, without demanding well-formedness, e.g.\ small pieces of
   terms that should not be parsed or type-checked yet.
 
   It is also possible to write this in the short form \<open>\<open>s\<close>\<close> without any
   further decoration.
 
   \<^descr> \<open>@{theory_text s}\<close> prints uninterpreted theory source text \<open>s\<close>, i.e.\
   outer syntax with command keywords and other tokens.
 
   \<^descr> \<open>@{theory A}\<close> prints the session-qualified theory name \<open>A\<close>, which is
   guaranteed to refer to a valid ancestor theory in the current context.
 
   \<^descr> \<open>@{thm a\<^sub>1 \<dots> a\<^sub>n}\<close> prints theorems \<open>a\<^sub>1 \<dots> a\<^sub>n\<close>. Full fact expressions are
   allowed here, including attributes (\secref{sec:syn-att}).
 
   \<^descr> \<open>@{prop \<phi>}\<close> prints a well-typed proposition \<open>\<phi>\<close>.
 
   \<^descr> \<open>@{lemma \<phi> by m}\<close> proves a well-typed proposition \<open>\<phi>\<close> by method \<open>m\<close> and
   prints the original \<open>\<phi>\<close>.
 
   \<^descr> \<open>@{term t}\<close> prints a well-typed term \<open>t\<close>.
   
   \<^descr> \<open>@{value t}\<close> evaluates a term \<open>t\<close> and prints its result, see also
   @{command_ref (HOL) value}.
 
   \<^descr> \<open>@{term_type t}\<close> prints a well-typed term \<open>t\<close> annotated with its type.
 
   \<^descr> \<open>@{typeof t}\<close> prints the type of a well-typed term \<open>t\<close>.
 
   \<^descr> \<open>@{const c}\<close> prints a logical or syntactic constant \<open>c\<close>.
   
   \<^descr> \<open>@{abbrev c x\<^sub>1 \<dots> x\<^sub>n}\<close> prints a constant abbreviation \<open>c x\<^sub>1 \<dots> x\<^sub>n \<equiv> rhs\<close>
   as defined in the current context.
 
   \<^descr> \<open>@{typ \<tau>}\<close> prints a well-formed type \<open>\<tau>\<close>.
 
   \<^descr> \<open>@{type \<kappa>}\<close> prints a (logical or syntactic) type constructor \<open>\<kappa>\<close>.
 
   \<^descr> \<open>@{class c}\<close> prints a class \<open>c\<close>.
 
   \<^descr> \<open>@{locale c}\<close> prints a locale \<open>c\<close>.
 
   \<^descr> \<open>@{bundle c}\<close> prints a bundle \<open>c\<close>.
 
   \<^descr> \<open>@{command name}\<close>, \<open>@{method name}\<close>, \<open>@{attribute name}\<close> print checked
   entities of the Isar language.
 
   \<^descr> \<open>@{goals}\<close> prints the current \<^emph>\<open>dynamic\<close> goal state. This is mainly for
   support of tactic-emulation scripts within Isar. Presentation of goal states
   does not conform to the idea of human-readable proof documents!
 
   When explaining proofs in detail it is usually better to spell out the
   reasoning via proper Isar proof commands, instead of peeking at the internal
   machine configuration.
   
   \<^descr> \<open>@{subgoals}\<close> is similar to \<open>@{goals}\<close>, but does not print the main goal.
   
   \<^descr> \<open>@{prf a\<^sub>1 \<dots> a\<^sub>n}\<close> prints the (compact) proof terms corresponding to the
   theorems \<open>a\<^sub>1 \<dots> a\<^sub>n\<close>. Note that this requires proof terms to be switched on
   for the current logic session.
   
   \<^descr> \<open>@{full_prf a\<^sub>1 \<dots> a\<^sub>n}\<close> is like \<open>@{prf a\<^sub>1 \<dots> a\<^sub>n}\<close>, but prints the full
   proof terms, i.e.\ also displays information omitted in the compact proof
   term, which is denoted by ``\<open>_\<close>'' placeholders there.
 
   \<^descr> \<open>@{ML_text s}\<close> prints ML text verbatim: only the token language is
   checked.
 
   \<^descr> \<open>@{ML s}\<close>, \<open>@{ML_infix s}\<close>, \<open>@{ML_type s}\<close>, \<open>@{ML_structure s}\<close>, and
   \<open>@{ML_functor s}\<close> check text \<open>s\<close> as ML value, infix operator, type,
   exception, structure, and functor respectively. The source is printed
   verbatim. The variants \<open>@{ML_def s}\<close> and \<open>@{ML_ref s}\<close> etc. maintain the
   document index: ``def'' means to make a bold entry, ``ref'' means to make a
   regular entry.
 
   There are two forms for type constructors, with or without separate type
   arguments: this impacts only the index entry. For example, \<open>@{ML_type_ref
   \<open>'a list\<close>}\<close> makes an entry literally for ``\<open>'a list\<close>'' (sorted under the
   letter ``a''), but \<open>@{ML_type_ref 'a \<open>list\<close>}\<close> makes an entry for the
   constructor name ``\<open>list\<close>''.
 
   \<^descr> \<open>@{emph s}\<close> prints document source recursively, with {\LaTeX} markup
   \<^verbatim>\<open>\emph{\<close>\<open>\<dots>\<close>\<^verbatim>\<open>}\<close>.
 
   \<^descr> \<open>@{bold s}\<close> prints document source recursively, with {\LaTeX} markup
   \<^verbatim>\<open>\textbf{\<close>\<open>\<dots>\<close>\<^verbatim>\<open>}\<close>.
 
   \<^descr> \<open>@{verbatim s}\<close> prints uninterpreted source text literally as ASCII
   characters, using some type-writer font style.
 
   \<^descr> \<open>@{bash_function name}\<close> prints the given GNU bash function verbatim. The
-  name is checked wrt.\ the Isabelle system environment @{cite
-  "isabelle-system"}.
+  name is checked wrt.\ the Isabelle system environment \<^cite>\<open>"isabelle-system"\<close>.
 
   \<^descr> \<open>@{system_option name}\<close> prints the given system option verbatim. The name
   is checked wrt.\ cumulative \<^verbatim>\<open>etc/options\<close> of all Isabelle components,
   notably \<^file>\<open>~~/etc/options\<close>.
 
   \<^descr> \<open>@{session name}\<close> prints given session name verbatim. The name is checked
   wrt.\ the dependencies of the current session.
 
   \<^descr> \<open>@{path name}\<close> prints the file-system path name verbatim.
 
   \<^descr> \<open>@{file name}\<close> is like \<open>@{path name}\<close>, but ensures that \<open>name\<close> refers to a
   plain file.
 
   \<^descr> \<open>@{dir name}\<close> is like \<open>@{path name}\<close>, but ensures that \<open>name\<close> refers to a
   directory.
 
   \<^descr> \<open>@{url name}\<close> produces markup for the given URL, which results in an
   active hyperlink within the text.
 
   \<^descr> \<open>@{cite arg}\<close> produces the Bib{\TeX} citation macro \<^verbatim>\<open>\cite[...]{...}\<close>
   with its optional and mandatory argument. The analogous \<^verbatim>\<open>\nocite\<close>, and the
   \<^verbatim>\<open>\citet\<close> and \<^verbatim>\<open>\citep\<close> variants from the \<^verbatim>\<open>natbib\<close>
   package\<^footnote>\<open>\<^url>\<open>https://ctan.org/pkg/natbib\<close>\<close> are supported as well.
 
   The argument syntax is uniform for all variants and is usually presented in
   control-symbol-cartouche form: \<open>\<^cite>\<open>arg\<close>\<close>. The formal syntax of the
   nested argument language is defined as follows: \<^rail>\<open>arg: (embedded
   @'in')? (name + 'and') \<newline> (@'using' name)?\<close>
 
   Here the embedded text is free-form {\LaTeX}, which becomes the optional
   argument of the \<^verbatim>\<open>\cite\<close> macro. The named items are Bib{\TeX} database
   entries and become the mandatory argument (separated by comma). The optional
   part ``\<^theory_text>\<open>using name\<close>'' specifies an alternative {\LaTeX} macro name.
 
   The validity of Bib{\TeX} database entries is only partially checked in
   Isabelle/PIDE, when the corresponding \<^verbatim>\<open>.bib\<close> files are open. Ultimately,
   the \<^verbatim>\<open>bibtex\<close> program will complain about bad input in final document
   preparation.
 
   \<^descr> @{command "print_antiquotations"} prints all document antiquotations that
   are defined in the current context; the ``\<open>!\<close>'' option indicates extra
   verbosity.
 \<close>
 
 
 subsection \<open>Styled antiquotations\<close>
 
 text \<open>
   The antiquotations \<open>thm\<close>, \<open>prop\<close> and \<open>term\<close> admit an extra \<^emph>\<open>style\<close>
   specification to modify the printed result. A style is specified by a name
   with a possibly empty number of arguments; multiple styles can be sequenced
   with commas. The following standard styles are available:
 
   \<^descr> \<open>lhs\<close> extracts the first argument of any application form with at least
   two arguments --- typically meta-level or object-level equality, or any
   other binary relation.
   
   \<^descr> \<open>rhs\<close> is like \<open>lhs\<close>, but extracts the second argument.
   
   \<^descr> \<open>concl\<close> extracts the conclusion \<open>C\<close> from a rule in Horn-clause normal form
   \<open>A\<^sub>1 \<Longrightarrow> \<dots> A\<^sub>n \<Longrightarrow> C\<close>.
   
   \<^descr> \<open>prem\<close> \<open>n\<close> extract premise number \<open>n\<close> from from a rule in Horn-clause
   normal form \<open>A\<^sub>1 \<Longrightarrow> \<dots> A\<^sub>n \<Longrightarrow> C\<close>.
 \<close>
 
 
 subsection \<open>General options\<close>
 
 text \<open>
   The following options are available to tune the printed output of
   antiquotations. Note that many of these coincide with system and
   configuration options of the same names.
 
     \<^descr> @{antiquotation_option_def show_types}~\<open>= bool\<close> and
     @{antiquotation_option_def show_sorts}~\<open>= bool\<close> control printing of
     explicit type and sort constraints.
 
     \<^descr> @{antiquotation_option_def show_structs}~\<open>= bool\<close> controls printing of
     implicit structures.
 
     \<^descr> @{antiquotation_option_def show_abbrevs}~\<open>= bool\<close> controls folding of
     abbreviations.
 
     \<^descr> @{antiquotation_option_def names_long}~\<open>= bool\<close> forces names of types
     and constants etc.\ to be printed in their fully qualified internal form.
 
     \<^descr> @{antiquotation_option_def names_short}~\<open>= bool\<close> forces names of types
     and constants etc.\ to be printed unqualified. Note that internalizing the
     output again in the current context may well yield a different result.
 
     \<^descr> @{antiquotation_option_def names_unique}~\<open>= bool\<close> determines whether the
     printed version of qualified names should be made sufficiently long to
     avoid overlap with names declared further back. Set to \<open>false\<close> for more
     concise output.
 
     \<^descr> @{antiquotation_option_def eta_contract}~\<open>= bool\<close> prints terms in
     \<open>\<eta>\<close>-contracted form.
 
     \<^descr> @{antiquotation_option_def display}~\<open>= bool\<close> indicates if the text is to
     be output as multi-line ``display material'', rather than a small piece of
     text without line breaks (which is the default).
 
     In this mode the embedded entities are printed in the same style as the
     main theory text.
 
     \<^descr> @{antiquotation_option_def break}~\<open>= bool\<close> controls line breaks in
     non-display material.
 
     \<^descr> @{antiquotation_option_def cartouche}~\<open>= bool\<close> indicates if the output
     should be delimited as cartouche.
 
     \<^descr> @{antiquotation_option_def quotes}~\<open>= bool\<close> indicates if the output
     should be delimited via double quotes (option @{antiquotation_option
     cartouche} takes precedence). Note that the Isabelle {\LaTeX} styles may
     suppress quotes on their own account.
 
     \<^descr> @{antiquotation_option_def mode}~\<open>= name\<close> adds \<open>name\<close> to the print mode
     to be used for presentation. Note that the standard setup for {\LaTeX}
     output is already present by default, with mode ``\<open>latex\<close>''.
 
     \<^descr> @{antiquotation_option_def margin}~\<open>= nat\<close> and
     @{antiquotation_option_def indent}~\<open>= nat\<close> change the margin or
     indentation for pretty printing of display material.
 
     \<^descr> @{antiquotation_option_def goals_limit}~\<open>= nat\<close> determines the maximum
     number of subgoals to be printed (for goal-based antiquotation).
 
     \<^descr> @{antiquotation_option_def source}~\<open>= bool\<close> prints the original source
     text of the antiquotation arguments, rather than its internal
     representation. Note that formal checking of @{antiquotation "thm"},
     @{antiquotation "term"}, etc. is still enabled; use the @{antiquotation
     "text"} antiquotation for unchecked output.
 
     Regular \<open>term\<close> and \<open>typ\<close> antiquotations with \<open>source = false\<close> involve a
     full round-trip from the original source to an internalized logical entity
     back to a source form, according to the syntax of the current context.
     Thus the printed output is not under direct control of the author, it may
     even fluctuate a bit as the underlying theory is changed later on.
 
     In contrast, @{antiquotation_option source}~\<open>= true\<close> admits direct
     printing of the given source text, with the desirable well-formedness
     check in the background, but without modification of the printed text.
 
     Cartouche delimiters of the argument are stripped for antiquotations that
     are internally categorized as ``embedded''.
 
     \<^descr> @{antiquotation_option_def source_cartouche} is like
     @{antiquotation_option source}, but cartouche delimiters are always
     preserved in the output.
 
   For Boolean flags, ``\<open>name = true\<close>'' may be abbreviated as ``\<open>name\<close>''. All
   of the above flags are disabled by default, unless changed specifically for
   a logic session in the corresponding \<^verbatim>\<open>ROOT\<close> file.
 \<close>
 
 
 section \<open>Markdown-like text structure\<close>
 
 text \<open>
   The markup commands @{command_ref text}, @{command_ref txt}, @{command_ref
   text_raw} (\secref{sec:markup}) consist of plain text. Its internal
   structure consists of paragraphs and (nested) lists, using special Isabelle
   symbols and some rules for indentation and blank lines. This quasi-visual
   format resembles \<^emph>\<open>Markdown\<close>\<^footnote>\<open>\<^url>\<open>http://commonmark.org\<close>\<close>, but the full
   complexity of that notation is avoided.
 
   This is a summary of the main principles of minimal Markdown in Isabelle:
 
     \<^item> List items start with the following markers
       \<^descr>[itemize:] \<^verbatim>\<open>\<^item>\<close>
       \<^descr>[enumerate:] \<^verbatim>\<open>\<^enum>\<close>
       \<^descr>[description:] \<^verbatim>\<open>\<^descr>\<close>
 
     \<^item> Adjacent list items with same indentation and same marker are grouped
     into a single list.
 
     \<^item> Singleton blank lines separate paragraphs.
 
     \<^item> Multiple blank lines escape from the current list hierarchy.
 
   Notable differences to official Markdown:
 
     \<^item> Indentation of list items needs to match exactly.
 
     \<^item> Indentation is unlimited (official Markdown interprets four spaces as
     block quote).
 
     \<^item> List items always consist of paragraphs --- there is no notion of
     ``tight'' list.
 
     \<^item> Section headings are expressed via Isar document markup commands
     (\secref{sec:markup}).
 
     \<^item> URLs, font styles, other special content is expressed via antiquotations
     (\secref{sec:antiq}), usually with proper nesting of sub-languages via
     text cartouches.
 \<close>
 
 
 section \<open>Document markers and command tags \label{sec:document-markers}\<close>
 
 text \<open>
   \emph{Document markers} are formal comments of the form \<open>\<^marker>\<open>marker_body\<close>\<close>
   (using the control symbol \<^verbatim>\<open>\<^marker>\<close>) and may occur anywhere within the
   outer syntax of a command: the inner syntax of a marker body resembles that
   for attributes (\secref{sec:syn-att}). In contrast, \emph{Command tags} may
   only occur after a command keyword and are treated as special markers as
   explained below.
 
   \<^rail>\<open>
     @{syntax_def marker}: '\<^marker>' @{syntax cartouche}
     ;
     @{syntax_def marker_body}: (@{syntax name} @{syntax args} * ',')
     ;
     @{syntax_def tags}: tag*
     ;
     tag: '%' (@{syntax short_ident} | @{syntax string})
   \<close>
 
   Document markers are stripped from the document output, but surrounding
   white-space is preserved: e.g.\ a marker at the end of a line does not
   affect the subsequent line break. Markers operate within the semantic
   presentation context of a command, and may modify it to change the overall
   appearance of a command span (e.g.\ by adding tags).
 
   Each document marker has its own syntax defined in the theory context; the
   following markers are predefined in Isabelle/Pure:
 
   \<^rail>\<open>
     (@@{document_marker_def title} |
      @@{document_marker_def creator} |
      @@{document_marker_def contributor} |
      @@{document_marker_def date} |
      @@{document_marker_def license} |
      @@{document_marker_def description}) @{syntax embedded}
     ;
     @@{document_marker_def tag} (scope?) @{syntax name}
     ;
     scope: '(' ('proof' | 'command') ')'
   \<close>
 
     \<^descr> \<open>\<^marker>\<open>title arg\<close>\<close>, \<open>\<^marker>\<open>creator arg\<close>\<close>, \<open>\<^marker>\<open>contributor arg\<close>\<close>, \<open>\<^marker>\<open>date arg\<close>\<close>,
     \<open>\<^marker>\<open>license arg\<close>\<close>, and \<open>\<^marker>\<open>description arg\<close>\<close> produce markup in the PIDE
     document, without any immediate effect on typesetting. This vocabulary is
     taken from the Dublin Core Metadata
     Initiative\<^footnote>\<open>\<^url>\<open>https://www.dublincore.org/specifications/dublin-core/dcmi-terms\<close>\<close>.
     The argument is an uninterpreted string, except for @{document_marker
     description}, which consists of words that are subject to spell-checking.
 
     \<^descr> \<open>\<^marker>\<open>tag name\<close>\<close> updates the list of command tags in the presentation
     context: later declarations take precedence, so \<open>\<^marker>\<open>tag a, tag b, tag c\<close>\<close>
     produces a reversed list. The default tags are given by the original
     \<^theory_text>\<open>keywords\<close> declaration of a command, and the system option
     @{system_option_ref document_tags}.
 
     The optional \<open>scope\<close> tells how far the tagging is applied to subsequent
     proof structure: ``\<^theory_text>\<open>("proof")\<close>'' means it applies to the following proof
     text, and ``\<^theory_text>\<open>(command)\<close>'' means it only applies to the current command.
     The default within a proof body is ``\<^theory_text>\<open>("proof")\<close>'', but for toplevel goal
     statements it is ``\<^theory_text>\<open>(command)\<close>''. Thus a \<open>tag\<close> marker for \<^theory_text>\<open>theorem\<close>,
     \<^theory_text>\<open>lemma\<close> etc. does \emph{not} affect its proof by default.
 
     An old-style command tag \<^verbatim>\<open>%\<close>\<open>name\<close> is treated like a document marker
     \<open>\<^marker>\<open>tag (proof) name\<close>\<close>: the list of command tags precedes the list of
     document markers. The head of the resulting tags in the presentation
     context is turned into {\LaTeX} environments to modify the type-setting.
     The following tags are pre-declared for certain classes of commands, and
     serve as default markup for certain kinds of commands:
 
     \<^medskip>
     \begin{tabular}{ll}
       \<open>document\<close> & document markup commands \\
       \<open>theory\<close> & theory begin/end \\
       \<open>proof\<close> & all proof commands \\
       \<open>ML\<close> & all commands involving ML code \\
     \end{tabular}
     \<^medskip>
 
-  The Isabelle document preparation system @{cite "isabelle-system"} allows
+  The Isabelle document preparation system \<^cite>\<open>"isabelle-system"\<close> allows
   tagged command regions to be presented specifically, e.g.\ to fold proof
   texts, or drop parts of the text completely.
 
   For example ``\<^theory_text>\<open>by auto\<close>~\<open>\<^marker>\<open>tag invisible\<close>\<close>'' causes that piece of proof to
   be treated as \<open>invisible\<close> instead of \<open>proof\<close> (the default), which may be
   shown or hidden depending on the document setup. In contrast, ``\<^theory_text>\<open>by
   auto\<close>~\<open>\<^marker>\<open>tag visible\<close>\<close>'' forces this text to be shown invariably.
 
   Explicit tag specifications within a proof apply to all subsequent commands
   of the same level of nesting. For example, ``\<^theory_text>\<open>proof\<close>~\<open>\<^marker>\<open>tag invisible\<close>
   \<dots>\<close>~\<^theory_text>\<open>qed\<close>'' forces the whole sub-proof to be typeset as \<open>visible\<close> (unless
   some of its parts are tagged differently).
 
   \<^medskip>
   Command tags merely produce certain markup environments for type-setting.
   The meaning of these is determined by {\LaTeX} macros, as defined in
   \<^file>\<open>~~/lib/texinputs/isabelle.sty\<close> or by the document author. The Isabelle
   document preparation tools also provide some high-level options to specify
   the meaning of arbitrary tags to ``keep'', ``drop'', or ``fold'' the
   corresponding parts of the text. Logic sessions may also specify ``document
   versions'', where given tags are interpreted in some particular way. Again
-  see @{cite "isabelle-system"} for further details.
+  see \<^cite>\<open>"isabelle-system"\<close> for further details.
 \<close>
 
 
 section \<open>Railroad diagrams\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{antiquotation_def "rail"} & : & \<open>antiquotation\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     'rail' @{syntax text}
   \<close>
 
   The @{antiquotation rail} antiquotation allows to include syntax diagrams
   into Isabelle documents. {\LaTeX} requires the style file
   \<^file>\<open>~~/lib/texinputs/railsetup.sty\<close>, which can be used via
   \<^verbatim>\<open>\usepackage{railsetup}\<close> in \<^verbatim>\<open>root.tex\<close>, for example.
 
   The rail specification language is quoted here as Isabelle @{syntax string}
   or text @{syntax "cartouche"}; it has its own grammar given below.
 
   \begingroup
   \def\isasymnewline{\isatt{\isacharbackslash\isacharless newline\isachargreater}}
   \<^rail>\<open>
   rule? + ';'
   ;
   rule: ((identifier | @{syntax antiquotation}) ':')? body
   ;
   body: concatenation + '|'
   ;
   concatenation: ((atom '?'?) +) (('*' | '+') atom?)?
   ;
   atom: '(' body? ')' | identifier |
     '@'? (string | @{syntax antiquotation}) |
     '\<newline>'
   \<close>
   \endgroup
 
   The lexical syntax of \<open>identifier\<close> coincides with that of @{syntax
   short_ident} in regular Isabelle syntax, but \<open>string\<close> uses single quotes
   instead of double quotes of the standard @{syntax string} category.
 
   Each \<open>rule\<close> defines a formal language (with optional name), using a notation
   that is similar to EBNF or regular expressions with recursion. The meaning
   and visual appearance of these rail language elements is illustrated by the
   following representative examples.
 
   \<^item> Empty \<^verbatim>\<open>()\<close>
 
   \<^rail>\<open>()\<close>
 
   \<^item> Nonterminal \<^verbatim>\<open>A\<close>
 
   \<^rail>\<open>A\<close>
 
   \<^item> Nonterminal via Isabelle antiquotation \<^verbatim>\<open>@{syntax method}\<close>
 
   \<^rail>\<open>@{syntax method}\<close>
 
   \<^item> Terminal \<^verbatim>\<open>'xyz'\<close>
 
   \<^rail>\<open>'xyz'\<close>
 
   \<^item> Terminal in keyword style \<^verbatim>\<open>@'xyz'\<close>
 
   \<^rail>\<open>@'xyz'\<close>
 
   \<^item> Terminal via Isabelle antiquotation \<^verbatim>\<open>@@{method rule}\<close>
 
   \<^rail>\<open>@@{method rule}\<close>
 
   \<^item> Concatenation \<^verbatim>\<open>A B C\<close>
 
   \<^rail>\<open>A B C\<close>
 
   \<^item> Newline inside concatenation \<^verbatim>\<open>A B C \<newline> D E F\<close>
 
   \<^rail>\<open>A B C \<newline> D E F\<close>
 
   \<^item> Variants \<^verbatim>\<open>A | B | C\<close>
 
   \<^rail>\<open>A | B | C\<close>
 
   \<^item> Option \<^verbatim>\<open>A ?\<close>
 
   \<^rail>\<open>A ?\<close>
 
   \<^item> Repetition \<^verbatim>\<open>A *\<close>
 
   \<^rail>\<open>A *\<close>
 
   \<^item> Repetition with separator \<^verbatim>\<open>A * sep\<close>
 
   \<^rail>\<open>A * sep\<close>
 
   \<^item> Strict repetition \<^verbatim>\<open>A +\<close>
 
   \<^rail>\<open>A +\<close>
 
   \<^item> Strict repetition with separator \<^verbatim>\<open>A + sep\<close>
 
   \<^rail>\<open>A + sep\<close>
 \<close>
 
 end
diff --git a/src/Doc/Isar_Ref/First_Order_Logic.thy b/src/Doc/Isar_Ref/First_Order_Logic.thy
--- a/src/Doc/Isar_Ref/First_Order_Logic.thy
+++ b/src/Doc/Isar_Ref/First_Order_Logic.thy
@@ -1,498 +1,498 @@
 (*:maxLineLen=78:*)
 
 section \<open>Example: First-Order Logic\<close>
 
 theory %visible First_Order_Logic
 imports Base  (* FIXME Pure!? *)
 begin
 
 text \<open>
   In order to commence a new object-logic within Isabelle/Pure we introduce
   abstract syntactic categories \<open>i\<close> for individuals and \<open>o\<close> for
   object-propositions. The latter is embedded into the language of Pure
   propositions by means of a separate judgment.
 \<close>
 
 typedecl i
 typedecl o
 
 judgment Trueprop :: "o \<Rightarrow> prop"    ("_" 5)
 
 text \<open>
   Note that the object-logic judgment is implicit in the syntax: writing
   \<^prop>\<open>A\<close> produces \<^term>\<open>Trueprop A\<close> internally. From the Pure
   perspective this means ``\<^prop>\<open>A\<close> is derivable in the object-logic''.
 \<close>
 
 
 subsection \<open>Equational reasoning \label{sec:framework-ex-equal}\<close>
 
 text \<open>
   Equality is axiomatized as a binary predicate on individuals, with
   reflexivity as introduction, and substitution as elimination principle. Note
   that the latter is particularly convenient in a framework like Isabelle,
   because syntactic congruences are implicitly produced by unification of
   \<open>B x\<close> against expressions containing occurrences of \<open>x\<close>.
 \<close>
 
 axiomatization equal :: "i \<Rightarrow> i \<Rightarrow> o"  (infix "=" 50)
   where refl [intro]: "x = x"
     and subst [elim]: "x = y \<Longrightarrow> B x \<Longrightarrow> B y"
 
 text \<open>
   Substitution is very powerful, but also hard to control in full generality.
   We derive some common symmetry~/ transitivity schemes of \<^term>\<open>equal\<close> as
   particular consequences.
 \<close>
 
 theorem sym [sym]:
   assumes "x = y"
   shows "y = x"
 proof -
   have "x = x" ..
   with \<open>x = y\<close> show "y = x" ..
 qed
 
 theorem forw_subst [trans]:
   assumes "y = x" and "B x"
   shows "B y"
 proof -
   from \<open>y = x\<close> have "x = y" ..
   from this and \<open>B x\<close> show "B y" ..
 qed
 
 theorem back_subst [trans]:
   assumes "B x" and "x = y"
   shows "B y"
 proof -
   from \<open>x = y\<close> and \<open>B x\<close>
   show "B y" ..
 qed
 
 theorem trans [trans]:
   assumes "x = y" and "y = z"
   shows "x = z"
 proof -
   from \<open>y = z\<close> and \<open>x = y\<close>
   show "x = z" ..
 qed
 
 
 subsection \<open>Basic group theory\<close>
 
 text \<open>
   As an example for equational reasoning we consider some bits of group
   theory. The subsequent locale definition postulates group operations and
   axioms; we also derive some consequences of this specification.
 \<close>
 
 locale group =
   fixes prod :: "i \<Rightarrow> i \<Rightarrow> i"  (infix "\<circ>" 70)
     and inv :: "i \<Rightarrow> i"  ("(_\<inverse>)" [1000] 999)
     and unit :: i  ("1")
   assumes assoc: "(x \<circ> y) \<circ> z = x \<circ> (y \<circ> z)"
     and left_unit:  "1 \<circ> x = x"
     and left_inv: "x\<inverse> \<circ> x = 1"
 begin
 
 theorem right_inv: "x \<circ> x\<inverse> = 1"
 proof -
   have "x \<circ> x\<inverse> = 1 \<circ> (x \<circ> x\<inverse>)" by (rule left_unit [symmetric])
   also have "\<dots> = (1 \<circ> x) \<circ> x\<inverse>" by (rule assoc [symmetric])
   also have "1 = (x\<inverse>)\<inverse> \<circ> x\<inverse>" by (rule left_inv [symmetric])
   also have "\<dots> \<circ> x = (x\<inverse>)\<inverse> \<circ> (x\<inverse> \<circ> x)" by (rule assoc)
   also have "x\<inverse> \<circ> x = 1" by (rule left_inv)
   also have "((x\<inverse>)\<inverse> \<circ> \<dots>) \<circ> x\<inverse> = (x\<inverse>)\<inverse> \<circ> (1 \<circ> x\<inverse>)" by (rule assoc)
   also have "1 \<circ> x\<inverse> = x\<inverse>" by (rule left_unit)
   also have "(x\<inverse>)\<inverse> \<circ> \<dots> = 1" by (rule left_inv)
   finally show "x \<circ> x\<inverse> = 1" .
 qed
 
 theorem right_unit: "x \<circ> 1 = x"
 proof -
   have "1 = x\<inverse> \<circ> x" by (rule left_inv [symmetric])
   also have "x \<circ> \<dots> = (x \<circ> x\<inverse>) \<circ> x" by (rule assoc [symmetric])
   also have "x \<circ> x\<inverse> = 1" by (rule right_inv)
   also have "\<dots> \<circ> x = x" by (rule left_unit)
   finally show "x \<circ> 1 = x" .
 qed
 
 text \<open>
   Reasoning from basic axioms is often tedious. Our proofs work by producing
   various instances of the given rules (potentially the symmetric form) using
   the pattern ``\<^theory_text>\<open>have eq by (rule r)\<close>'' and composing the chain of results
   via \<^theory_text>\<open>also\<close>/\<^theory_text>\<open>finally\<close>. These steps may involve any of the transitivity
   rules declared in \secref{sec:framework-ex-equal}, namely @{thm trans} in
   combining the first two results in @{thm right_inv} and in the final steps
   of both proofs, @{thm forw_subst} in the first combination of @{thm
   right_unit}, and @{thm back_subst} in all other calculational steps.
 
   Occasional substitutions in calculations are adequate, but should not be
   over-emphasized. The other extreme is to compose a chain by plain
   transitivity only, with replacements occurring always in topmost position.
   For example:
 \<close>
 
 (*<*)
 theorem "\<And>A. PROP A \<Longrightarrow> PROP A"
 proof -
   assume [symmetric, defn]: "\<And>x y. (x \<equiv> y) \<equiv> Trueprop (x = y)"
   fix x
 (*>*)
   have "x \<circ> 1 = x \<circ> (x\<inverse> \<circ> x)" unfolding left_inv ..
   also have "\<dots> = (x \<circ> x\<inverse>) \<circ> x" unfolding assoc ..
   also have "\<dots> = 1 \<circ> x" unfolding right_inv ..
   also have "\<dots> = x" unfolding left_unit ..
   finally have "x \<circ> 1 = x" .
 (*<*)
 qed
 (*>*)
 
 text \<open>
   Here we have re-used the built-in mechanism for unfolding definitions in
   order to normalize each equational problem. A more realistic object-logic
   would include proper setup for the Simplifier (\secref{sec:simplifier}), the
   main automated tool for equational reasoning in Isabelle. Then ``\<^theory_text>\<open>unfolding
   left_inv ..\<close>'' would become ``\<^theory_text>\<open>by (simp only: left_inv)\<close>'' etc.
 \<close>
 
 end
 
 
 subsection \<open>Propositional logic \label{sec:framework-ex-prop}\<close>
 
 text \<open>
   We axiomatize basic connectives of propositional logic: implication,
   disjunction, and conjunction. The associated rules are modeled after
-  Gentzen's system of Natural Deduction @{cite "Gentzen:1935"}.
+  Gentzen's system of Natural Deduction \<^cite>\<open>"Gentzen:1935"\<close>.
 \<close>
 
 axiomatization imp :: "o \<Rightarrow> o \<Rightarrow> o"  (infixr "\<longrightarrow>" 25)
   where impI [intro]: "(A \<Longrightarrow> B) \<Longrightarrow> A \<longrightarrow> B"
     and impD [dest]: "(A \<longrightarrow> B) \<Longrightarrow> A \<Longrightarrow> B"
 
 axiomatization disj :: "o \<Rightarrow> o \<Rightarrow> o"  (infixr "\<or>" 30)
   where disjI\<^sub>1 [intro]: "A \<Longrightarrow> A \<or> B"
     and disjI\<^sub>2 [intro]: "B \<Longrightarrow> A \<or> B"
     and disjE [elim]: "A \<or> B \<Longrightarrow> (A \<Longrightarrow> C) \<Longrightarrow> (B \<Longrightarrow> C) \<Longrightarrow> C"
 
 axiomatization conj :: "o \<Rightarrow> o \<Rightarrow> o"  (infixr "\<and>" 35)
   where conjI [intro]: "A \<Longrightarrow> B \<Longrightarrow> A \<and> B"
     and conjD\<^sub>1: "A \<and> B \<Longrightarrow> A"
     and conjD\<^sub>2: "A \<and> B \<Longrightarrow> B"
 
 text \<open>
   The conjunctive destructions have the disadvantage that decomposing \<^prop>\<open>A \<and> B\<close> involves an immediate decision which component should be projected.
   The more convenient simultaneous elimination \<^prop>\<open>A \<and> B \<Longrightarrow> (A \<Longrightarrow> B \<Longrightarrow> C) \<Longrightarrow>
   C\<close> can be derived as follows:
 \<close>
 
 theorem conjE [elim]:
   assumes "A \<and> B"
   obtains A and B
 proof
   from \<open>A \<and> B\<close> show A by (rule conjD\<^sub>1)
   from \<open>A \<and> B\<close> show B by (rule conjD\<^sub>2)
 qed
 
 text \<open>
   Here is an example of swapping conjuncts with a single intermediate
   elimination step:
 \<close>
 
 (*<*)
 lemma "\<And>A. PROP A \<Longrightarrow> PROP A"
 proof -
   fix A B
 (*>*)
   assume "A \<and> B"
   then obtain B and A ..
   then have "B \<and> A" ..
 (*<*)
 qed
 (*>*)
 
 text \<open>
   Note that the analogous elimination rule for disjunction ``\<^theory_text>\<open>assumes "A \<or> B"
   obtains A \<BBAR> B\<close>'' coincides with the original axiomatization of @{thm
   disjE}.
 
   \<^medskip>
   We continue propositional logic by introducing absurdity with its
   characteristic elimination. Plain truth may then be defined as a proposition
   that is trivially true.
 \<close>
 
 axiomatization false :: o  ("\<bottom>")
   where falseE [elim]: "\<bottom> \<Longrightarrow> A"
 
 definition true :: o  ("\<top>")
   where "\<top> \<equiv> \<bottom> \<longrightarrow> \<bottom>"
 
 theorem trueI [intro]: \<top>
   unfolding true_def ..
 
 text \<open>
   \<^medskip>
   Now negation represents an implication towards absurdity:
 \<close>
 
 definition not :: "o \<Rightarrow> o"  ("\<not> _" [40] 40)
   where "\<not> A \<equiv> A \<longrightarrow> \<bottom>"
 
 theorem notI [intro]:
   assumes "A \<Longrightarrow> \<bottom>"
   shows "\<not> A"
 unfolding not_def
 proof
   assume A
   then show \<bottom> by (rule \<open>A \<Longrightarrow> \<bottom>\<close>)
 qed
 
 theorem notE [elim]:
   assumes "\<not> A" and A
   shows B
 proof -
   from \<open>\<not> A\<close> have "A \<longrightarrow> \<bottom>" unfolding not_def .
   from \<open>A \<longrightarrow> \<bottom>\<close> and \<open>A\<close> have \<bottom> ..
   then show B ..
 qed
 
 
 subsection \<open>Classical logic\<close>
 
 text \<open>
   Subsequently we state the principle of classical contradiction as a local
   assumption. Thus we refrain from forcing the object-logic into the classical
   perspective. Within that context, we may derive well-known consequences of
   the classical principle.
 \<close>
 
 locale classical =
   assumes classical: "(\<not> C \<Longrightarrow> C) \<Longrightarrow> C"
 begin
 
 theorem double_negation:
   assumes "\<not> \<not> C"
   shows C
 proof (rule classical)
   assume "\<not> C"
   with \<open>\<not> \<not> C\<close> show C ..
 qed
 
 theorem tertium_non_datur: "C \<or> \<not> C"
 proof (rule double_negation)
   show "\<not> \<not> (C \<or> \<not> C)"
   proof
     assume "\<not> (C \<or> \<not> C)"
     have "\<not> C"
     proof
       assume C then have "C \<or> \<not> C" ..
       with \<open>\<not> (C \<or> \<not> C)\<close> show \<bottom> ..
     qed
     then have "C \<or> \<not> C" ..
     with \<open>\<not> (C \<or> \<not> C)\<close> show \<bottom> ..
   qed
 qed
 
 text \<open>
   These examples illustrate both classical reasoning and non-trivial
   propositional proofs in general. All three rules characterize classical
   logic independently, but the original rule is already the most convenient to
   use, because it leaves the conclusion unchanged. Note that \<^prop>\<open>(\<not> C \<Longrightarrow> C)
   \<Longrightarrow> C\<close> fits again into our format for eliminations, despite the additional
   twist that the context refers to the main conclusion. So we may write @{thm
   classical} as the Isar statement ``\<^theory_text>\<open>obtains \<not> thesis\<close>''. This also explains
   nicely how classical reasoning really works: whatever the main \<open>thesis\<close>
   might be, we may always assume its negation!
 \<close>
 
 end
 
 
 subsection \<open>Quantifiers \label{sec:framework-ex-quant}\<close>
 
 text \<open>
   Representing quantifiers is easy, thanks to the higher-order nature of the
   underlying framework. According to the well-known technique introduced by
-  Church @{cite "church40"}, quantifiers are operators on predicates, which
+  Church \<^cite>\<open>"church40"\<close>, quantifiers are operators on predicates, which
   are syntactically represented as \<open>\<lambda>\<close>-terms of type \<^typ>\<open>i \<Rightarrow> o\<close>. Binder
   notation turns \<open>All (\<lambda>x. B x)\<close> into \<open>\<forall>x. B x\<close> etc.
 \<close>
 
 axiomatization All :: "(i \<Rightarrow> o) \<Rightarrow> o"  (binder "\<forall>" 10)
   where allI [intro]: "(\<And>x. B x) \<Longrightarrow> \<forall>x. B x"
     and allD [dest]: "(\<forall>x. B x) \<Longrightarrow> B a"
 
 axiomatization Ex :: "(i \<Rightarrow> o) \<Rightarrow> o"  (binder "\<exists>" 10)
   where exI [intro]: "B a \<Longrightarrow> (\<exists>x. B x)"
     and exE [elim]: "(\<exists>x. B x) \<Longrightarrow> (\<And>x. B x \<Longrightarrow> C) \<Longrightarrow> C"
 
 text \<open>
   The statement of @{thm exE} corresponds to ``\<^theory_text>\<open>assumes "\<exists>x. B x" obtains x
   where "B x"\<close>'' in Isar. In the subsequent example we illustrate quantifier
   reasoning involving all four rules:
 \<close>
 
 theorem
   assumes "\<exists>x. \<forall>y. R x y"
   shows "\<forall>y. \<exists>x. R x y"
 proof    \<comment> \<open>\<open>\<forall>\<close> introduction\<close>
   obtain x where "\<forall>y. R x y" using \<open>\<exists>x. \<forall>y. R x y\<close> ..    \<comment> \<open>\<open>\<exists>\<close> elimination\<close>
   fix y have "R x y" using \<open>\<forall>y. R x y\<close> ..    \<comment> \<open>\<open>\<forall>\<close> destruction\<close>
   then show "\<exists>x. R x y" ..    \<comment> \<open>\<open>\<exists>\<close> introduction\<close>
 qed
 
 
 subsection \<open>Canonical reasoning patterns\<close>
 
 text \<open>
   The main rules of first-order predicate logic from
   \secref{sec:framework-ex-prop} and \secref{sec:framework-ex-quant} can now
   be summarized as follows, using the native Isar statement format of
   \secref{sec:framework-stmt}.
 
   \<^medskip>
   \begin{tabular}{l}
   \<^theory_text>\<open>impI: assumes "A \<Longrightarrow> B" shows "A \<longrightarrow> B"\<close> \\
   \<^theory_text>\<open>impD: assumes "A \<longrightarrow> B" and A shows B\<close> \\[1ex]
 
   \<^theory_text>\<open>disjI\<^sub>1: assumes A shows "A \<or> B"\<close> \\
   \<^theory_text>\<open>disjI\<^sub>2: assumes B shows "A \<or> B"\<close> \\
   \<^theory_text>\<open>disjE: assumes "A \<or> B" obtains A \<BBAR> B\<close> \\[1ex]
 
   \<^theory_text>\<open>conjI: assumes A and B shows A \<and> B\<close> \\
   \<^theory_text>\<open>conjE: assumes "A \<and> B" obtains A and B\<close> \\[1ex]
 
   \<^theory_text>\<open>falseE: assumes \<bottom> shows A\<close> \\
   \<^theory_text>\<open>trueI: shows \<top>\<close> \\[1ex]
 
   \<^theory_text>\<open>notI: assumes "A \<Longrightarrow> \<bottom>" shows "\<not> A"\<close> \\
   \<^theory_text>\<open>notE: assumes "\<not> A" and A shows B\<close> \\[1ex]
 
   \<^theory_text>\<open>allI: assumes "\<And>x. B x" shows "\<forall>x. B x"\<close> \\
   \<^theory_text>\<open>allE: assumes "\<forall>x. B x" shows "B a"\<close> \\[1ex]
 
   \<^theory_text>\<open>exI: assumes "B a" shows "\<exists>x. B x"\<close> \\
   \<^theory_text>\<open>exE: assumes "\<exists>x. B x" obtains a where "B a"\<close>
   \end{tabular}
   \<^medskip>
 
   This essentially provides a declarative reading of Pure rules as Isar
   reasoning patterns: the rule statements tells how a canonical proof outline
   shall look like. Since the above rules have already been declared as
   @{attribute (Pure) intro}, @{attribute (Pure) elim}, @{attribute (Pure)
   dest} --- each according to its particular shape --- we can immediately
   write Isar proof texts as follows:
 \<close>
 
 (*<*)
 theorem "\<And>A. PROP A \<Longrightarrow> PROP A"
 proof -
 (*>*)
 
   text_raw \<open>\begin{minipage}[t]{0.4\textwidth}\<close>(*<*)next(*>*)
 
   have "A \<longrightarrow> B"
   proof
     assume A
     show B \<proof>
   qed
 
   text_raw \<open>\end{minipage}\qquad\begin{minipage}[t]{0.4\textwidth}\<close>(*<*)next(*>*)
 
   have "A \<longrightarrow> B" and A \<proof>
   then have B ..
 
   text_raw \<open>\end{minipage}\\[3ex]\begin{minipage}[t]{0.4\textwidth}\<close>(*<*)next(*>*)
 
   have A \<proof>
   then have "A \<or> B" ..
 
   have B \<proof>
   then have "A \<or> B" ..
 
   text_raw \<open>\end{minipage}\qquad\begin{minipage}[t]{0.4\textwidth}\<close>(*<*)next(*>*)
 
   have "A \<or> B" \<proof>
   then have C
   proof
     assume A
     then show C \<proof>
   next
     assume B
     then show C \<proof>
   qed
 
   text_raw \<open>\end{minipage}\\[3ex]\begin{minipage}[t]{0.4\textwidth}\<close>(*<*)next(*>*)
 
   have A and B \<proof>
   then have "A \<and> B" ..
 
   text_raw \<open>\end{minipage}\qquad\begin{minipage}[t]{0.4\textwidth}\<close>(*<*)next(*>*)
 
   have "A \<and> B" \<proof>
   then obtain A and B ..
 
   text_raw \<open>\end{minipage}\\[3ex]\begin{minipage}[t]{0.4\textwidth}\<close>(*<*)next(*>*)
 
   have "\<bottom>" \<proof>
   then have A ..
 
   text_raw \<open>\end{minipage}\qquad\begin{minipage}[t]{0.4\textwidth}\<close>(*<*)next(*>*)
 
   have "\<top>" ..
 
   text_raw \<open>\end{minipage}\\[3ex]\begin{minipage}[t]{0.4\textwidth}\<close>(*<*)next(*>*)
 
   have "\<not> A"
   proof
     assume A
     then show "\<bottom>" \<proof>
   qed
 
   text_raw \<open>\end{minipage}\qquad\begin{minipage}[t]{0.4\textwidth}\<close>(*<*)next(*>*)
 
   have "\<not> A" and A \<proof>
   then have B ..
 
   text_raw \<open>\end{minipage}\\[3ex]\begin{minipage}[t]{0.4\textwidth}\<close>(*<*)next(*>*)
 
   have "\<forall>x. B x"
   proof
     fix x
     show "B x" \<proof>
   qed
 
   text_raw \<open>\end{minipage}\qquad\begin{minipage}[t]{0.4\textwidth}\<close>(*<*)next(*>*)
 
   have "\<forall>x. B x" \<proof>
   then have "B a" ..
 
   text_raw \<open>\end{minipage}\\[3ex]\begin{minipage}[t]{0.4\textwidth}\<close>(*<*)next(*>*)
 
   have "\<exists>x. B x"
   proof
     show "B a" \<proof>
   qed
 
   text_raw \<open>\end{minipage}\qquad\begin{minipage}[t]{0.4\textwidth}\<close>(*<*)next(*>*)
 
   have "\<exists>x. B x" \<proof>
   then obtain a where "B a" ..
 
   text_raw \<open>\end{minipage}\<close>
 
 (*<*)
 qed
 (*>*)
 
 text \<open>
   \<^bigskip>
   Of course, these proofs are merely examples. As sketched in
   \secref{sec:framework-subproof}, there is a fair amount of flexibility in
   expressing Pure deductions in Isar. Here the user is asked to express
   himself adequately, aiming at proof texts of literary quality.
 \<close>
 
 end %visible
diff --git a/src/Doc/Isar_Ref/Framework.thy b/src/Doc/Isar_Ref/Framework.thy
--- a/src/Doc/Isar_Ref/Framework.thy
+++ b/src/Doc/Isar_Ref/Framework.thy
@@ -1,1032 +1,1026 @@
 (*:maxLineLen=78:*)
 
 theory Framework
   imports Main Base
 begin
 
 chapter \<open>The Isabelle/Isar Framework \label{ch:isar-framework}\<close>
 
 text \<open>
-  Isabelle/Isar @{cite "Wenzel:1999:TPHOL" and "Wenzel-PhD" and
+  Isabelle/Isar \<^cite>\<open>"Wenzel:1999:TPHOL" and "Wenzel-PhD" and
   "Nipkow-TYPES02" and "Wiedijk:1999:Mizar" and "Wenzel-Paulson:2006" and
-  "Wenzel:2006:Festschrift"} is a generic framework for developing formal
+  "Wenzel:2006:Festschrift"\<close> is a generic framework for developing formal
   mathematical documents with full proof checking. Definitions, statements and
   proofs are organized as theories. A collection of theories sources may be
   presented as a printed document; see also \chref{ch:document-prep}.
 
   The main concern of Isar is the design of a human-readable structured proof
   language, which is called the ``primary proof format'' in Isar terminology.
   Such a primary proof language is somewhere in the middle between the
   extremes of primitive proof objects and actual natural language.
 
   Thus Isar challenges the traditional way of recording informal proofs in
   mathematical prose, as well as the common tendency to see fully formal
   proofs directly as objects of some logical calculus (e.g.\ \<open>\<lambda>\<close>-terms in a
   version of type theory). Technically, Isar is an interpreter of a simple
   block-structured language for describing the data flow of local facts and
   goals, interspersed with occasional invocations of proof methods. Everything
   is reduced to logical inferences internally, but these steps are somewhat
   marginal compared to the overall bookkeeping of the interpretation process.
   Thanks to careful design of the syntax and semantics of Isar language
   elements, a formal record of Isar commands may later appear as an
   intelligible text to the human reader.
 
   The Isar proof language has emerged from careful analysis of some inherent
-  virtues of the logical framework Isabelle/Pure @{cite "paulson-found" and
-  "paulson700"}, notably composition of higher-order natural deduction rules,
-  which is a generalization of Gentzen's original calculus @{cite
-  "Gentzen:1935"}. The approach of generic inference systems in Pure is
+  virtues of the logical framework Isabelle/Pure \<^cite>\<open>"paulson-found" and
+  "paulson700"\<close>, notably composition of higher-order natural deduction rules,
+  which is a generalization of Gentzen's original calculus \<^cite>\<open>"Gentzen:1935"\<close>. The approach of generic inference systems in Pure is
   continued by Isar towards actual proof texts. See also
   \figref{fig:natural-deduction}
 
   \begin{figure}[htb]
 
   \begin{center}
   \begin{minipage}[t]{0.9\textwidth}
 
   \textbf{Inferences:}
   \begin{center}
   \begin{tabular}{l@ {\qquad}l}
   \infer{\<open>B\<close>}{\<open>A \<longrightarrow> B\<close> & \<open>A\<close>} &
   \infer{\<open>A \<longrightarrow> B\<close>}{\infer*{\<open>B\<close>}{\<open>[A]\<close>}} \\
   \end{tabular}
   \end{center}
 
   \textbf{Isabelle/Pure:}
   \begin{center}
   \begin{tabular}{l@ {\qquad}l}
   \<open>(A \<longrightarrow> B) \<Longrightarrow> A \<Longrightarrow> B\<close> &
   \<open>(A \<Longrightarrow> B) \<Longrightarrow> A \<longrightarrow> B\<close>
   \end{tabular}
   \end{center}
 
   \textbf{Isabelle/Isar:}
   \begin{center}
   \begin{minipage}[t]{0.4\textwidth}
   @{theory_text [display, indent = 2]
     \<open>have "A \<longrightarrow> B" \<proof>
 also have A \<proof>
 finally have B .\<close>}
   \end{minipage}
   \begin{minipage}[t]{0.4\textwidth}
   @{theory_text [display, indent = 2]
     \<open>have "A \<longrightarrow> B"
 proof
   assume A
   then show B \<proof>
 qed\<close>}
   \end{minipage}
   \end{center}
 
   \end{minipage}
   \end{center}
 
   \caption{Natural Deduction via inferences according to Gentzen, rules in
   Isabelle/Pure, and proofs in Isabelle/Isar}\label{fig:natural-deduction}
 
   \end{figure}
 
   \<^medskip>
   Concrete applications require another intermediate layer: an object-logic.
-  Isabelle/HOL @{cite "isa-tutorial"} (simply-typed set-theory) is most
+  Isabelle/HOL \<^cite>\<open>"isa-tutorial"\<close> (simply-typed set-theory) is most
   commonly used; elementary examples are given in the directories
   \<^dir>\<open>~~/src/Pure/Examples\<close> and \<^dir>\<open>~~/src/HOL/Examples\<close>. Some examples
   demonstrate how to start a fresh object-logic from Isabelle/Pure, and use
   Isar proofs from the very start, despite the lack of advanced proof tools at
   such an early stage (e.g.\ see
-  \<^file>\<open>~~/src/Pure/Examples/Higher_Order_Logic.thy\<close>). Isabelle/FOL @{cite
-  "isabelle-logics"} and Isabelle/ZF @{cite "isabelle-ZF"} also work, but are
+  \<^file>\<open>~~/src/Pure/Examples/Higher_Order_Logic.thy\<close>). Isabelle/FOL \<^cite>\<open>"isabelle-logics"\<close> and Isabelle/ZF \<^cite>\<open>"isabelle-ZF"\<close> also work, but are
   much less developed.
 
   In order to illustrate natural deduction in Isar, we shall subsequently
   refer to the background theory and library of Isabelle/HOL. This includes
   common notions of predicate logic, naive set-theory etc.\ using fairly
   standard mathematical notation. From the perspective of generic natural
   deduction there is nothing special about the logical connectives of HOL
   (\<open>\<and>\<close>, \<open>\<or>\<close>, \<open>\<forall>\<close>, \<open>\<exists>\<close>, etc.), only the resulting reasoning principles are
   relevant to the user. There are similar rules available for set-theory
   operators (\<open>\<inter>\<close>, \<open>\<union>\<close>, \<open>\<Inter>\<close>, \<open>\<Union>\<close>, etc.), or any other theory developed in the
   library (lattice theory, topology etc.).
 
   Subsequently we briefly review fragments of Isar proof texts corresponding
   directly to such general deduction schemes. The examples shall refer to
   set-theory, to minimize the danger of understanding connectives of predicate
   logic as something special.
 
   \<^medskip>
   The following deduction performs \<open>\<inter>\<close>-introduction, working forwards from
   assumptions towards the conclusion. We give both the Isar text, and depict
   the primitive rule involved, as determined by unification of fact and goal
   statements against rules that are declared in the library context.
 \<close>
 
 text_raw \<open>\medskip\begin{minipage}{0.6\textwidth}\<close>
 
 (*<*)
 notepad
 begin
     fix x :: 'a and A B
 (*>*)
     assume "x \<in> A" and "x \<in> B"
     then have "x \<in> A \<inter> B" ..
 (*<*)
 end
 (*>*)
 
 text_raw \<open>\end{minipage}\begin{minipage}{0.4\textwidth}\<close>
 
 text \<open>
   \infer{\<open>x \<in> A \<inter> B\<close>}{\<open>x \<in> A\<close> & \<open>x \<in> B\<close>}
 \<close>
 
 text_raw \<open>\end{minipage}\<close>
 
 text \<open>
   \<^medskip>
   Note that \<^theory_text>\<open>assume\<close> augments the proof context, \<^theory_text>\<open>then\<close> indicates that the
   current fact shall be used in the next step, and \<^theory_text>\<open>have\<close> states an
   intermediate goal. The two dots ``\<^theory_text>\<open>..\<close>'' refer to a complete proof of this
   claim, using the indicated facts and a canonical rule from the context. We
   could have been more explicit here by spelling out the final proof step via
   the \<^theory_text>\<open>by\<close> command:
 \<close>
 
 (*<*)
 notepad
 begin
     fix x :: 'a and A B
 (*>*)
     assume "x \<in> A" and "x \<in> B"
     then have "x \<in> A \<inter> B" by (rule IntI)
 (*<*)
 end
 (*>*)
 
 text \<open>
   The format of the \<open>\<inter>\<close>-introduction rule represents the most basic inference,
   which proceeds from given premises to a conclusion, without any nested proof
   context involved.
 
   The next example performs backwards introduction of \<open>\<Inter>\<A>\<close>, the intersection
   of all sets within a given set. This requires a nested proof of set
   membership within a local context, where \<open>A\<close> is an arbitrary-but-fixed
   member of the collection:
 \<close>
 
 text_raw \<open>\medskip\begin{minipage}{0.6\textwidth}\<close>
 
 (*<*)
 notepad
 begin
     fix x :: 'a and \<A>
 (*>*)
     have "x \<in> \<Inter>\<A>"
     proof
       fix A
       assume "A \<in> \<A>"
       show "x \<in> A" \<proof>
     qed
 (*<*)
 end
 (*>*)
 
 text_raw \<open>\end{minipage}\begin{minipage}{0.4\textwidth}\<close>
 
 text \<open>
   \infer{\<open>x \<in> \<Inter>\<A>\<close>}{\infer*{\<open>x \<in> A\<close>}{\<open>[A][A \<in> \<A>]\<close>}}
 \<close>
 
 text_raw \<open>\end{minipage}\<close>
 
 text \<open>
   \<^medskip>
   This Isar reasoning pattern again refers to the primitive rule depicted
   above. The system determines it in the ``\<^theory_text>\<open>proof\<close>'' step, which could have
   been spelled out more explicitly as ``\<^theory_text>\<open>proof (rule InterI)\<close>''. Note that
   the rule involves both a local parameter \<open>A\<close> and an assumption \<open>A \<in> \<A>\<close> in
   the nested reasoning. Such compound rules typically demands a genuine
   subproof in Isar, working backwards rather than forwards as seen before. In
   the proof body we encounter the \<^theory_text>\<open>fix\<close>-\<^theory_text>\<open>assume\<close>-\<^theory_text>\<open>show\<close> outline of nested
   subproofs that is typical for Isar. The final \<^theory_text>\<open>show\<close> is like \<^theory_text>\<open>have\<close>
   followed by an additional refinement of the enclosing claim, using the rule
   derived from the proof body.
 
   \<^medskip>
   The next example involves \<open>\<Union>\<A>\<close>, which can be characterized as the set of
   all \<open>x\<close> such that \<open>\<exists>A. x \<in> A \<and> A \<in> \<A>\<close>. The elimination rule for \<open>x \<in> \<Union>\<A>\<close>
   does not mention \<open>\<exists>\<close> and \<open>\<and>\<close> at all, but admits to obtain directly a local
   \<open>A\<close> such that \<open>x \<in> A\<close> and \<open>A \<in> \<A>\<close> hold. This corresponds to the following
   Isar proof and inference rule, respectively:
 \<close>
 
 text_raw \<open>\medskip\begin{minipage}{0.6\textwidth}\<close>
 
 (*<*)
 notepad
 begin
     fix x :: 'a and \<A> C
 (*>*)
     assume "x \<in> \<Union>\<A>"
     then have C
     proof
       fix A
       assume "x \<in> A" and "A \<in> \<A>"
       show C \<proof>
     qed
 (*<*)
 end
 (*>*)
 
 text_raw \<open>\end{minipage}\begin{minipage}{0.4\textwidth}\<close>
 
 text \<open>
   \infer{\<open>C\<close>}{\<open>x \<in> \<Union>\<A>\<close> & \infer*{\<open>C\<close>~}{\<open>[A][x \<in> A, A \<in> \<A>]\<close>}}
 \<close>
 
 text_raw \<open>\end{minipage}\<close>
 
 text \<open>
   \<^medskip>
   Although the Isar proof follows the natural deduction rule closely, the text
   reads not as natural as anticipated. There is a double occurrence of an
   arbitrary conclusion \<open>C\<close>, which represents the final result, but is
   irrelevant for now. This issue arises for any elimination rule involving
   local parameters. Isar provides the derived language element \<^theory_text>\<open>obtain\<close>,
   which is able to perform the same elimination proof more conveniently:
 \<close>
 
 (*<*)
 notepad
 begin
     fix x :: 'a and \<A>
 (*>*)
     assume "x \<in> \<Union>\<A>"
     then obtain A where "x \<in> A" and "A \<in> \<A>" ..
 (*<*)
 end
 (*>*)
 
 text \<open>
   Here we avoid to mention the final conclusion \<open>C\<close> and return to plain
   forward reasoning. The rule involved in the ``\<^theory_text>\<open>..\<close>'' proof is the same as
   before.
 \<close>
 
 
 section \<open>The Pure framework \label{sec:framework-pure}\<close>
 
 text \<open>
-  The Pure logic @{cite "paulson-found" and "paulson700"} is an intuitionistic
-  fragment of higher-order logic @{cite "church40"}. In type-theoretic
+  The Pure logic \<^cite>\<open>"paulson-found" and "paulson700"\<close> is an intuitionistic
+  fragment of higher-order logic \<^cite>\<open>"church40"\<close>. In type-theoretic
   parlance, there are three levels of \<open>\<lambda>\<close>-calculus with corresponding arrows
   \<open>\<Rightarrow>\<close>/\<open>\<And>\<close>/\<open>\<Longrightarrow>\<close>:
 
   \<^medskip>
   \begin{tabular}{ll}
   \<open>\<alpha> \<Rightarrow> \<beta>\<close> & syntactic function space (terms depending on terms) \\
   \<open>\<And>x. B(x)\<close> & universal quantification (proofs depending on terms) \\
   \<open>A \<Longrightarrow> B\<close> & implication (proofs depending on proofs) \\
   \end{tabular}
   \<^medskip>
 
   Here only the types of syntactic terms, and the propositions of proof terms
   have been shown. The \<open>\<lambda>\<close>-structure of proofs can be recorded as an optional
-  feature of the Pure inference kernel @{cite "Berghofer-Nipkow:2000:TPHOL"},
+  feature of the Pure inference kernel \<^cite>\<open>"Berghofer-Nipkow:2000:TPHOL"\<close>,
   but the formal system can never depend on them due to \<^emph>\<open>proof irrelevance\<close>.
 
   On top of this most primitive layer of proofs, Pure implements a generic
-  calculus for nested natural deduction rules, similar to @{cite
-  "Schroeder-Heister:1984"}. Here object-logic inferences are internalized as
+  calculus for nested natural deduction rules, similar to \<^cite>\<open>"Schroeder-Heister:1984"\<close>. Here object-logic inferences are internalized as
   formulae over \<open>\<And>\<close> and \<open>\<Longrightarrow>\<close>. Combining such rule statements may involve
-  higher-order unification @{cite "paulson-natural"}.
+  higher-order unification \<^cite>\<open>"paulson-natural"\<close>.
 \<close>
 
 
 subsection \<open>Primitive inferences\<close>
 
 text \<open>
   Term syntax provides explicit notation for abstraction \<open>\<lambda>x :: \<alpha>. b(x)\<close> and
   application \<open>b a\<close>, while types are usually implicit thanks to
   type-inference; terms of type \<open>prop\<close> are called propositions. Logical
   statements are composed via \<open>\<And>x :: \<alpha>. B(x)\<close> and \<open>A \<Longrightarrow> B\<close>. Primitive reasoning
   operates on judgments of the form \<open>\<Gamma> \<turnstile> \<phi>\<close>, with standard introduction and
   elimination rules for \<open>\<And>\<close> and \<open>\<Longrightarrow>\<close> that refer to fixed parameters \<open>x\<^sub>1, \<dots>,
   x\<^sub>m\<close> and hypotheses \<open>A\<^sub>1, \<dots>, A\<^sub>n\<close> from the context \<open>\<Gamma>\<close>; the corresponding
   proof terms are left implicit. The subsequent inference rules define \<open>\<Gamma> \<turnstile> \<phi>\<close>
   inductively, relative to a collection of axioms from the implicit background
   theory:
 
   \[
   \infer{\<open>\<turnstile> A\<close>}{\<open>A\<close> \mbox{~is axiom}}
   \qquad
   \infer{\<open>A \<turnstile> A\<close>}{}
   \]
 
   \[
   \infer{\<open>\<Gamma> \<turnstile> \<And>x. B(x)\<close>}{\<open>\<Gamma> \<turnstile> B(x)\<close> & \<open>x \<notin> \<Gamma>\<close>}
   \qquad
   \infer{\<open>\<Gamma> \<turnstile> B(a)\<close>}{\<open>\<Gamma> \<turnstile> \<And>x. B(x)\<close>}
   \]
 
   \[
   \infer{\<open>\<Gamma> - A \<turnstile> A \<Longrightarrow> B\<close>}{\<open>\<Gamma> \<turnstile> B\<close>}
   \qquad
   \infer{\<open>\<Gamma>\<^sub>1 \<union> \<Gamma>\<^sub>2 \<turnstile> B\<close>}{\<open>\<Gamma>\<^sub>1 \<turnstile> A \<Longrightarrow> B\<close> & \<open>\<Gamma>\<^sub>2 \<turnstile> A\<close>}
   \]
 
   Furthermore, Pure provides a built-in equality \<open>\<equiv> :: \<alpha> \<Rightarrow> \<alpha> \<Rightarrow> prop\<close> with
   axioms for reflexivity, substitution, extensionality, and \<open>\<alpha>\<beta>\<eta>\<close>-conversion
   on \<open>\<lambda>\<close>-terms.
 
   \<^medskip>
 
   An object-logic introduces another layer on top of Pure, e.g.\ with types
   \<open>i\<close> for individuals and \<open>o\<close> for propositions, term constants \<open>Trueprop :: o
   \<Rightarrow> prop\<close> as (implicit) derivability judgment and connectives like \<open>\<and> :: o \<Rightarrow> o
   \<Rightarrow> o\<close> or \<open>\<forall> :: (i \<Rightarrow> o) \<Rightarrow> o\<close>, and axioms for object-level rules such as
   \<open>conjI: A \<Longrightarrow> B \<Longrightarrow> A \<and> B\<close> or \<open>allI: (\<And>x. B x) \<Longrightarrow> \<forall>x. B x\<close>. Derived object rules
   are represented as theorems of Pure. After the initial object-logic setup,
   further axiomatizations are usually avoided: definitional principles are
   used instead (e.g.\ \<^theory_text>\<open>definition\<close>, \<^theory_text>\<open>inductive\<close>, \<^theory_text>\<open>fun\<close>, \<^theory_text>\<open>function\<close>).
 \<close>
 
 
 subsection \<open>Reasoning with rules \label{sec:framework-resolution}\<close>
 
 text \<open>
   Primitive inferences mostly serve foundational purposes. The main reasoning
   mechanisms of Pure operate on nested natural deduction rules expressed as
   formulae, using \<open>\<And>\<close> to bind local parameters and \<open>\<Longrightarrow>\<close> to express entailment.
   Multiple parameters and premises are represented by repeating these
   connectives in a right-associative manner.
 
   Thanks to the Pure theorem \<^prop>\<open>(A \<Longrightarrow> (\<And>x. B x)) \<equiv> (\<And>x. A \<Longrightarrow> B x)\<close> the
   connectives \<open>\<And>\<close> and \<open>\<Longrightarrow>\<close> commute. So we may assume w.l.o.g.\ that rule
   statements always observe the normal form where quantifiers are pulled in
   front of implications at each level of nesting. This means that any Pure
-  proposition may be presented as a \<^emph>\<open>Hereditary Harrop Formula\<close> @{cite
-  "Miller:1991"} which is of the form \<open>\<And>x\<^sub>1 \<dots> x\<^sub>m. H\<^sub>1 \<Longrightarrow> \<dots> H\<^sub>n \<Longrightarrow> A\<close> for \<open>m, n
+  proposition may be presented as a \<^emph>\<open>Hereditary Harrop Formula\<close> \<^cite>\<open>"Miller:1991"\<close> which is of the form \<open>\<And>x\<^sub>1 \<dots> x\<^sub>m. H\<^sub>1 \<Longrightarrow> \<dots> H\<^sub>n \<Longrightarrow> A\<close> for \<open>m, n
   \<ge> 0\<close>, and \<open>A\<close> atomic, and \<open>H\<^sub>1, \<dots>, H\<^sub>n\<close> being recursively of the same
   format. Following the convention that outermost quantifiers are implicit,
   Horn clauses \<open>A\<^sub>1 \<Longrightarrow> \<dots> A\<^sub>n \<Longrightarrow> A\<close> are a special case of this.
 
   For example, the \<open>\<inter>\<close>-introduction rule encountered before is represented as
   a Pure theorem as follows:
   \[
   \<open>IntI:\<close>~\<^prop>\<open>x \<in> A \<Longrightarrow> x \<in> B \<Longrightarrow> x \<in> A \<inter> B\<close>
   \]
 
   This is a plain Horn clause, since no further nesting on the left is
   involved. The general \<open>\<Inter>\<close>-introduction corresponds to a Hereditary Harrop
   Formula with one additional level of nesting:
   \[
   \<open>InterI:\<close>~\<^prop>\<open>(\<And>A. A \<in> \<A> \<Longrightarrow> x \<in> A) \<Longrightarrow> x \<in> \<Inter>\<A>\<close>
   \]
 
   \<^medskip>
   Goals are also represented as rules: \<open>A\<^sub>1 \<Longrightarrow> \<dots> A\<^sub>n \<Longrightarrow> C\<close> states that the
   subgoals \<open>A\<^sub>1, \<dots>, A\<^sub>n\<close> entail the result \<open>C\<close>; for \<open>n = 0\<close> the goal is
   finished. To allow \<open>C\<close> being a rule statement itself, there is an internal
   protective marker \<open># :: prop \<Rightarrow> prop\<close>, which is defined as identity and
   hidden from the user. We initialize and finish goal states as follows:
 
   \[
   \begin{array}{c@ {\qquad}c}
   \infer[(@{inference_def init})]{\<open>C \<Longrightarrow> #C\<close>}{} &
   \infer[(@{inference_def finish})]{\<open>C\<close>}{\<open>#C\<close>}
   \end{array}
   \]
 
   Goal states are refined in intermediate proof steps until a finished form is
   achieved. Here the two main reasoning principles are @{inference
   resolution}, for back-chaining a rule against a subgoal (replacing it by
   zero or more subgoals), and @{inference assumption}, for solving a subgoal
   (finding a short-circuit with local assumptions). Below \<open>\<^vec>x\<close> stands
   for \<open>x\<^sub>1, \<dots>, x\<^sub>n\<close> (for \<open>n \<ge> 0\<close>).
 
   \[
   \infer[(@{inference_def resolution})]
   {\<open>(\<And>\<^vec>x. \<^vec>H \<^vec>x \<Longrightarrow> \<^vec>A (\<^vec>a \<^vec>x))\<vartheta> \<Longrightarrow> C\<vartheta>\<close>}
   {\begin{tabular}{rl}
     \<open>rule:\<close> &
     \<open>\<^vec>A \<^vec>a \<Longrightarrow> B \<^vec>a\<close> \\
     \<open>goal:\<close> &
     \<open>(\<And>\<^vec>x. \<^vec>H \<^vec>x \<Longrightarrow> B' \<^vec>x) \<Longrightarrow> C\<close> \\
     \<open>goal unifier:\<close> &
     \<open>(\<lambda>\<^vec>x. B (\<^vec>a \<^vec>x))\<vartheta> = B'\<vartheta>\<close> \\
    \end{tabular}}
   \]
 
   \<^medskip>
 
   \[
   \infer[(@{inference_def assumption})]{\<open>C\<vartheta>\<close>}
   {\begin{tabular}{rl}
     \<open>goal:\<close> &
     \<open>(\<And>\<^vec>x. \<^vec>H \<^vec>x \<Longrightarrow> A \<^vec>x) \<Longrightarrow> C\<close> \\
     \<open>assm unifier:\<close> & \<open>A\<vartheta> = H\<^sub>i\<vartheta>\<close>~~\mbox{for some~\<open>H\<^sub>i\<close>} \\
    \end{tabular}}
   \]
 
   The following trace illustrates goal-oriented reasoning in
   Isabelle/Pure:
 
   {\footnotesize
   \<^medskip>
   \begin{tabular}{r@ {\quad}l}
   \<open>(A \<and> B \<Longrightarrow> B \<and> A) \<Longrightarrow> #(A \<and> B \<Longrightarrow> B \<and> A)\<close> & \<open>(init)\<close> \\
   \<open>(A \<and> B \<Longrightarrow> B) \<Longrightarrow> (A \<and> B \<Longrightarrow> A) \<Longrightarrow> #\<dots>\<close> & \<open>(resolution B \<Longrightarrow> A \<Longrightarrow> B \<and> A)\<close> \\
   \<open>(A \<and> B \<Longrightarrow> A \<and> B) \<Longrightarrow> (A \<and> B \<Longrightarrow> A) \<Longrightarrow> #\<dots>\<close> & \<open>(resolution A \<and> B \<Longrightarrow> B)\<close> \\
   \<open>(A \<and> B \<Longrightarrow> A) \<Longrightarrow> #\<dots>\<close> & \<open>(assumption)\<close> \\
   \<open>(A \<and> B \<Longrightarrow> A \<and> B) \<Longrightarrow> #\<dots>\<close> & \<open>(resolution A \<and> B \<Longrightarrow> A)\<close> \\
   \<open>#\<dots>\<close> & \<open>(assumption)\<close> \\
   \<open>A \<and> B \<Longrightarrow> B \<and> A\<close> & \<open>(finish)\<close> \\
   \end{tabular}
   \<^medskip>
   }
 
   Compositions of @{inference assumption} after @{inference resolution} occurs
   quite often, typically in elimination steps. Traditional Isabelle tactics
   accommodate this by a combined @{inference_def elim_resolution} principle.
   In contrast, Isar uses a combined refinement rule as follows:\footnote{For
   simplicity and clarity, the presentation ignores \<^emph>\<open>weak premises\<close> as
   introduced via \<^theory_text>\<open>presume\<close> or \<^theory_text>\<open>show \<dots> when\<close>.}
 
   {\small
   \[
   \infer[(@{inference refinement})]
   {\<open>C\<vartheta>\<close>}
   {\begin{tabular}{rl}
     \<open>subgoal:\<close> &
     \<open>(\<And>\<^vec>x. \<^vec>H \<^vec>x \<Longrightarrow> B' \<^vec>x) \<Longrightarrow> C\<close> \\
     \<open>subproof:\<close> &
     \<open>\<^vec>G \<^vec>a \<Longrightarrow> B \<^vec>a\<close> \quad for schematic \<open>\<^vec>a\<close> \\
     \<open>concl unifier:\<close> &
     \<open>(\<lambda>\<^vec>x. B (\<^vec>a \<^vec>x))\<vartheta> = B'\<vartheta>\<close> \\
     \<open>assm unifiers:\<close> &
     \<open>(\<lambda>\<^vec>x. G\<^sub>j (\<^vec>a \<^vec>x))\<vartheta> = H\<^sub>i\<vartheta>\<close> \quad for each \<open>G\<^sub>j\<close> some \<open>H\<^sub>i\<close> \\
    \end{tabular}}
   \]}
 
   Here the \<open>subproof\<close> rule stems from the main \<^theory_text>\<open>fix\<close>-\<^theory_text>\<open>assume\<close>-\<^theory_text>\<open>show\<close>
   outline of Isar (cf.\ \secref{sec:framework-subproof}): each assumption
   indicated in the text results in a marked premise \<open>G\<close> above. Consequently,
   \<^theory_text>\<open>fix\<close>-\<^theory_text>\<open>assume\<close>-\<^theory_text>\<open>show\<close> enables to fit the result of a subproof quite
   robustly into a pending subgoal, while maintaining a good measure of
   flexibility: the subproof only needs to fit modulo unification, and its
   assumptions may be a proper subset of the subgoal premises (see
   \secref{sec:framework-subproof}).
 \<close>
 
 
 section \<open>The Isar proof language \label{sec:framework-isar}\<close>
 
 text \<open>
   Structured proofs are presented as high-level expressions for composing
   entities of Pure (propositions, facts, and goals). The Isar proof language
   allows to organize reasoning within the underlying rule calculus of Pure,
   but Isar is not another logical calculus. Isar merely imposes certain
   structure and policies on Pure inferences. The main grammar of the Isar
   proof language is given in \figref{fig:isar-syntax}.
 
   \begin{figure}[htb]
   \begin{center}
   \begin{tabular}{rcl}
     \<open>main\<close> & \<open>=\<close> & \<^theory_text>\<open>notepad begin "statement\<^sup>*" end\<close> \\
     & \<open>|\<close> & \<^theory_text>\<open>theorem name: props if name: props for vars\<close> \\
     & \<open>|\<close> & \<^theory_text>\<open>theorem name:\<close> \\
     & & \quad\<^theory_text>\<open>fixes vars\<close> \\
     & & \quad\<^theory_text>\<open>assumes name: props\<close> \\
     & & \quad\<^theory_text>\<open>shows name: props "proof"\<close> \\
     & \<open>|\<close> & \<^theory_text>\<open>theorem name:\<close> \\
     & & \quad\<^theory_text>\<open>fixes vars\<close> \\
     & & \quad\<^theory_text>\<open>assumes name: props\<close> \\
     & & \quad\<^theory_text>\<open>obtains (name) clause "\<^bold>|" \<dots> "proof"\<close> \\
     \<open>proof\<close> & \<open>=\<close> & \<^theory_text>\<open>"refinement\<^sup>* proper_proof"\<close> \\
     \<open>refinement\<close> & \<open>=\<close> &  \<^theory_text>\<open>apply method\<close> \\
     & \<open>|\<close> & \<^theory_text>\<open>supply name = thms\<close> \\
     & \<open>|\<close> & \<^theory_text>\<open>subgoal premises name for vars "proof"\<close> \\
     & \<open>|\<close> & \<^theory_text>\<open>using thms\<close> \\
     & \<open>|\<close> & \<^theory_text>\<open>unfolding thms\<close> \\
     \<open>proper_proof\<close> & \<open>=\<close> & \<^theory_text>\<open>proof "method\<^sup>?" "statement\<^sup>*" qed "method\<^sup>?"\<close> \\
     & \<open>|\<close> & \<^theory_text>\<open>by method method\<close>~~~\<open>|\<close>~~~\<^theory_text>\<open>..\<close>~~~\<open>|\<close>~~~\<^theory_text>\<open>.\<close>~~~\<open>|\<close>~~~\<^theory_text>\<open>sorry\<close>~~~\<open>|\<close>~~~\<^theory_text>\<open>done\<close> \\
     \<open>statement\<close> & \<open>=\<close> & \<^theory_text>\<open>{ "statement\<^sup>*" }\<close>~~~\<open>|\<close>~~~\<^theory_text>\<open>next\<close> \\
     & \<open>|\<close> & \<^theory_text>\<open>note name = thms\<close> \\
     & \<open>|\<close> & \<^theory_text>\<open>let "term" = "term"\<close> \\
     & \<open>|\<close> & \<^theory_text>\<open>write name  (mixfix)\<close> \\
     & \<open>|\<close> & \<^theory_text>\<open>fix vars\<close> \\
     & \<open>|\<close> & \<^theory_text>\<open>assume name: props if props for vars\<close> \\
     & \<open>|\<close> & \<^theory_text>\<open>presume name: props if props for vars\<close> \\
     & \<open>|\<close> & \<^theory_text>\<open>define clause\<close> \\
     & \<open>|\<close> & \<^theory_text>\<open>case name: "case"\<close> \\
     & \<open>|\<close> & \<^theory_text>\<open>then"\<^sup>?" goal\<close> \\
     & \<open>|\<close> & \<^theory_text>\<open>from thms goal\<close> \\
     & \<open>|\<close> & \<^theory_text>\<open>with thms goal\<close> \\
     & \<open>|\<close> & \<^theory_text>\<open>also\<close>~~~\<open>|\<close>~~~\<^theory_text>\<open>finally goal\<close> \\
     & \<open>|\<close> & \<^theory_text>\<open>moreover\<close>~~~\<open>|\<close>~~~\<^theory_text>\<open>ultimately goal\<close> \\
     \<open>goal\<close> & \<open>=\<close> & \<^theory_text>\<open>have name: props if name: props for vars "proof"\<close> \\
     & \<open>|\<close> & \<^theory_text>\<open>show name: props if name: props for vars "proof"\<close> \\
     & \<open>|\<close> & \<^theory_text>\<open>show name: props when name: props for vars "proof"\<close> \\
     & \<open>|\<close> & \<^theory_text>\<open>consider (name) clause "\<^bold>|" \<dots> "proof"\<close> \\
     & \<open>|\<close> & \<^theory_text>\<open>obtain (name) clause "proof"\<close> \\
     \<open>clause\<close> & \<open>=\<close> & \<^theory_text>\<open>vars where name: props if props for vars\<close> \\
   \end{tabular}
   \end{center}
   \caption{Main grammar of the Isar proof language}\label{fig:isar-syntax}
   \end{figure}
 
   The construction of the Isar proof language proceeds in a bottom-up fashion,
   as an exercise in purity and minimalism. The grammar in
   \appref{ap:main-grammar} describes the primitive parts of the core language
   (category \<open>proof\<close>), which is embedded into the main outer theory syntax via
   elements that require a proof (e.g.\ \<^theory_text>\<open>theorem\<close>, \<^theory_text>\<open>lemma\<close>, \<^theory_text>\<open>function\<close>,
   \<^theory_text>\<open>termination\<close>).
 
   The syntax for terms and propositions is inherited from Pure (and the
   object-logic). A \<open>pattern\<close> is a \<open>term\<close> with schematic variables, to be bound
   by higher-order matching. Simultaneous propositions or facts may be
   separated by the \<^theory_text>\<open>and\<close> keyword.
 
   \<^medskip>
   Facts may be referenced by name or proposition. For example, the result of
   ``\<^theory_text>\<open>have a: A \<proof>\<close>'' becomes accessible both via the name \<open>a\<close> and the
   literal proposition \<open>\<open>A\<close>\<close>. Moreover, fact expressions may involve attributes
   that modify either the theorem or the background context. For example, the
   expression ``\<open>a [OF b]\<close>'' refers to the composition of two facts according
   to the @{inference resolution} inference of
   \secref{sec:framework-resolution}, while ``\<open>a [intro]\<close>'' declares a fact as
   introduction rule in the context.
 
   The special fact called ``@{fact this}'' always refers to the last result,
   as produced by \<^theory_text>\<open>note\<close>, \<^theory_text>\<open>assume\<close>, \<^theory_text>\<open>have\<close>, or \<^theory_text>\<open>show\<close>. Since \<^theory_text>\<open>note\<close> occurs
   frequently together with \<^theory_text>\<open>then\<close>, there are some abbreviations:
 
   \<^medskip>
   \begin{tabular}{rcl}
     \<^theory_text>\<open>from a\<close> & \<open>\<equiv>\<close> & \<^theory_text>\<open>note a then\<close> \\
     \<^theory_text>\<open>with a\<close> & \<open>\<equiv>\<close> & \<^theory_text>\<open>from a and this\<close> \\
   \end{tabular}
   \<^medskip>
 
   The \<open>method\<close> category is essentially a parameter of the Isar language and
   may be populated later. The command \<^theory_text>\<open>method_setup\<close> allows to define proof
   methods semantically in Isabelle/ML. The Eisbach language allows to define
   proof methods symbolically, as recursive expressions over existing methods
-  @{cite "Matichuk-et-al:2014"}; see also \<^dir>\<open>~~/src/HOL/Eisbach\<close>.
+  \<^cite>\<open>"Matichuk-et-al:2014"\<close>; see also \<^dir>\<open>~~/src/HOL/Eisbach\<close>.
 
   Methods use the facts indicated by \<^theory_text>\<open>then\<close> or \<^theory_text>\<open>using\<close>, and then operate on
   the goal state. Some basic methods are predefined in Pure: ``@{method "-"}''
   leaves the goal unchanged, ``@{method this}'' applies the facts as rules to
   the goal, ``@{method (Pure) "rule"}'' applies the facts to another rule and
   the result to the goal (both ``@{method this}'' and ``@{method (Pure)
   rule}'' refer to @{inference resolution} of
   \secref{sec:framework-resolution}). The secondary arguments to ``@{method
   (Pure) rule}'' may be specified explicitly as in ``\<open>(rule a)\<close>'', or picked
   from the context. In the latter case, the system first tries rules declared
   as @{attribute (Pure) elim} or @{attribute (Pure) dest}, followed by those
   declared as @{attribute (Pure) intro}.
 
   The default method for \<^theory_text>\<open>proof\<close> is ``@{method standard}'' (which subsumes
   @{method rule} with arguments picked from the context), for \<^theory_text>\<open>qed\<close> it is
   ``@{method "succeed"}''. Further abbreviations for terminal proof steps are
   ``\<^theory_text>\<open>by method\<^sub>1 method\<^sub>2\<close>'' for ``\<^theory_text>\<open>proof method\<^sub>1 qed method\<^sub>2\<close>'', and
   ``\<^theory_text>\<open>..\<close>'' for ``\<^theory_text>\<open>by standard\<close>, and ``\<^theory_text>\<open>.\<close>'' for ``\<^theory_text>\<open>by this\<close>''. The command
   ``\<^theory_text>\<open>unfolding facts\<close>'' operates directly on the goal by applying equalities.
 
   \<^medskip>
   Block structure can be indicated explicitly by ``\<^theory_text>\<open>{ \<dots> }\<close>'', although the
   body of a subproof ``\<^theory_text>\<open>proof \<dots> qed\<close>'' already provides implicit nesting. In
   both situations, \<^theory_text>\<open>next\<close> jumps into the next section of a block, i.e.\ it
   acts like closing an implicit block scope and opening another one. There is
   no direct connection to subgoals here!
 
   The commands \<^theory_text>\<open>fix\<close> and \<^theory_text>\<open>assume\<close> build up a local context (see
   \secref{sec:framework-context}), while \<^theory_text>\<open>show\<close> refines a pending subgoal by
   the rule resulting from a nested subproof (see
   \secref{sec:framework-subproof}). Further derived concepts will support
   calculational reasoning (see \secref{sec:framework-calc}).
 \<close>
 
 
 subsection \<open>Context elements \label{sec:framework-context}\<close>
 
 text \<open>
   In judgments \<open>\<Gamma> \<turnstile> \<phi>\<close> of the primitive framework, \<open>\<Gamma>\<close> essentially acts like a
   proof context. Isar elaborates this idea towards a more advanced concept,
   with additional information for type-inference, term abbreviations, local
   facts, hypotheses etc.
 
   The element \<^theory_text>\<open>fix x :: \<alpha>\<close> declares a local parameter, i.e.\ an
   arbitrary-but-fixed entity of a given type; in results exported from the
   context, \<open>x\<close> may become anything. The \<^theory_text>\<open>assume \<guillemotleft>inference\<guillemotright>\<close> element provides
   a general interface to hypotheses: \<^theory_text>\<open>assume \<guillemotleft>inference\<guillemotright> A\<close> produces \<open>A \<turnstile> A\<close>
   locally, while the included inference tells how to discharge \<open>A\<close> from
   results \<open>A \<turnstile> B\<close> later on. There is no surface syntax for \<open>\<guillemotleft>inference\<guillemotright>\<close>,
   i.e.\ it may only occur internally when derived commands are defined in ML.
 
   The default inference for \<^theory_text>\<open>assume\<close> is @{inference export} as given below.
   The derived element \<^theory_text>\<open>define x where "x \<equiv> a"\<close> is defined as \<^theory_text>\<open>fix x assume
   \<guillemotleft>expand\<guillemotright> x \<equiv> a\<close>, with the subsequent inference @{inference expand}.
 
   \[
   \infer[(@{inference_def export})]{\<open>\<strut>\<Gamma> - A \<turnstile> A \<Longrightarrow> B\<close>}{\<open>\<strut>\<Gamma> \<turnstile> B\<close>}
   \qquad
   \infer[(@{inference_def expand})]{\<open>\<strut>\<Gamma> - (x \<equiv> a) \<turnstile> B a\<close>}{\<open>\<strut>\<Gamma> \<turnstile> B x\<close>}
   \]
 
   \<^medskip>
-  The most interesting derived context element in Isar is \<^theory_text>\<open>obtain\<close> @{cite
-  \<open>\S5.3\<close> "Wenzel-PhD"}, which supports generalized elimination steps in a
+  The most interesting derived context element in Isar is \<^theory_text>\<open>obtain\<close> \<^cite>\<open>\<open>\S5.3\<close> in "Wenzel-PhD"\<close>, which supports generalized elimination steps in a
   purely forward manner. The \<^theory_text>\<open>obtain\<close> command takes a specification of
   parameters \<open>\<^vec>x\<close> and assumptions \<open>\<^vec>A\<close> to be added to the context,
   together with a proof of a case rule stating that this extension is
   conservative (i.e.\ may be removed from closed results later on):
 
   \<^medskip>
   \begin{tabular}{l}
   \<^theory_text>\<open>\<langle>facts\<rangle> obtain "\<^vec>x" where "\<^vec>A" "\<^vec>x" \<proof> \<equiv>\<close> \\[0.5ex]
   \quad \<^theory_text>\<open>have "case": "\<And>thesis. (\<And>\<^vec>x. \<^vec>A \<^vec>x \<Longrightarrow> thesis) \<Longrightarrow> thesis"\<close> \\
   \quad \<^theory_text>\<open>proof -\<close> \\
   \qquad \<^theory_text>\<open>fix thesis\<close> \\
   \qquad \<^theory_text>\<open>assume [intro]: "\<And>\<^vec>x. \<^vec>A \<^vec>x \<Longrightarrow> thesis"\<close> \\
   \qquad \<^theory_text>\<open>show thesis using \<langle>facts\<rangle> \<proof>\<close> \\
   \quad \<^theory_text>\<open>qed\<close> \\
   \quad \<^theory_text>\<open>fix "\<^vec>x" assume \<guillemotleft>elimination "case"\<guillemotright> "\<^vec>A \<^vec>x"\<close> \\
   \end{tabular}
   \<^medskip>
 
   \[
   \infer[(@{inference elimination})]{\<open>\<Gamma> \<turnstile> B\<close>}{
     \begin{tabular}{rl}
     \<open>case:\<close> &
     \<open>\<Gamma> \<turnstile> \<And>thesis. (\<And>\<^vec>x. \<^vec>A \<^vec>x \<Longrightarrow> thesis) \<Longrightarrow> thesis\<close> \\[0.2ex]
     \<open>result:\<close> &
     \<open>\<Gamma> \<union> \<^vec>A \<^vec>y \<turnstile> B\<close> \\[0.2ex]
     \end{tabular}}
   \]
 
   Here the name ``\<open>thesis\<close>'' is a specific convention for an
   arbitrary-but-fixed proposition; in the primitive natural deduction rules
   shown before we have occasionally used \<open>C\<close>. The whole statement of
   ``\<^theory_text>\<open>obtain x where A x\<close>'' can be read as a claim that \<open>A x\<close> may be assumed
   for some arbitrary-but-fixed \<open>x\<close>. Also note that ``\<^theory_text>\<open>obtain A and B\<close>''
   without parameters is similar to ``\<^theory_text>\<open>have A and B\<close>'', but the latter
   involves multiple subgoals that need to be proven separately.
 
   \<^medskip>
   The subsequent Isar proof texts explain all context elements introduced
   above using the formal proof language itself. After finishing a local proof
   within a block, the exported result is indicated via \<^theory_text>\<open>note\<close>.
 \<close>
 
 (*<*)
 theorem True
 proof
 (*>*)
   text_raw \<open>\begin{minipage}[t]{0.45\textwidth}\<close>
   {
     fix x
     have "B x" \<proof>
   }
   note \<open>\<And>x. B x\<close>
   text_raw \<open>\end{minipage}\quad\begin{minipage}[t]{0.45\textwidth}\<close>(*<*)next(*>*)
   {
     assume A
     have B \<proof>
   }
   note \<open>A \<Longrightarrow> B\<close>
   text_raw \<open>\end{minipage}\\[3ex]\begin{minipage}[t]{0.45\textwidth}\<close>(*<*)next(*>*)
   {
     define x where "x \<equiv> a"
     have "B x" \<proof>
   }
   note \<open>B a\<close>
   text_raw \<open>\end{minipage}\quad\begin{minipage}[t]{0.45\textwidth}\<close>(*<*)next(*>*)
   {
     obtain x where "A x" \<proof>
     have B \<proof>
   }
   note \<open>B\<close>
   text_raw \<open>\end{minipage}\<close>
 (*<*)
 qed
 (*>*)
 
 text \<open>
   \<^bigskip>
   This explains the meaning of Isar context elements without, without goal
   states getting in the way.
 \<close>
 
 
 subsection \<open>Structured statements \label{sec:framework-stmt}\<close>
 
 text \<open>
   The syntax of top-level theorem statements is defined as follows:
 
   \<^medskip>
   \begin{tabular}{rcl}
   \<open>statement\<close> & \<open>\<equiv>\<close> & \<^theory_text>\<open>name: props and \<dots>\<close> \\
   & \<open>|\<close> & \<open>context\<^sup>* conclusion\<close> \\[0.5ex]
 
   \<open>context\<close> & \<open>\<equiv>\<close> & \<^theory_text>\<open>fixes vars and \<dots>\<close> \\
   & \<open>|\<close> & \<^theory_text>\<open>assumes name: props and \<dots>\<close> \\
 
   \<open>conclusion\<close> & \<open>\<equiv>\<close> & \<^theory_text>\<open>shows name: props and \<dots>\<close> \\
   & \<open>|\<close> & \<^theory_text>\<open>obtains vars and \<dots> where name: props and \<dots>\<close> \\
   & & \quad \<open>\<BBAR> \<dots>\<close> \\
   \end{tabular}
 
   \<^medskip>
   A simple statement consists of named propositions. The full form admits
   local context elements followed by the actual conclusions, such as ``\<^theory_text>\<open>fixes
   x assumes A x shows B x\<close>''. The final result emerges as a Pure rule after
   discharging the context: \<^prop>\<open>\<And>x. A x \<Longrightarrow> B x\<close>.
 
   The \<^theory_text>\<open>obtains\<close> variant is another abbreviation defined below; unlike
   \<^theory_text>\<open>obtain\<close> (cf.\ \secref{sec:framework-context}) there may be several
   ``cases'' separated by ``\<open>\<BBAR>\<close>'', each consisting of several parameters
   (\<open>vars\<close>) and several premises (\<open>props\<close>). This specifies multi-branch
   elimination rules.
 
   \<^medskip>
   \begin{tabular}{l}
   \<^theory_text>\<open>obtains "\<^vec>x" where "\<^vec>A" "\<^vec>x"  "\<BBAR>"  \<dots>  \<equiv>\<close> \\[0.5ex]
   \quad \<^theory_text>\<open>fixes thesis\<close> \\
   \quad \<^theory_text>\<open>assumes [intro]: "\<And>\<^vec>x. \<^vec>A \<^vec>x \<Longrightarrow> thesis"  and  \<dots>\<close> \\
   \quad \<^theory_text>\<open>shows thesis\<close> \\
   \end{tabular}
   \<^medskip>
 
   Presenting structured statements in such an ``open'' format usually
   simplifies the subsequent proof, because the outer structure of the problem
   is already laid out directly. E.g.\ consider the following canonical
   patterns for \<^theory_text>\<open>shows\<close> and \<^theory_text>\<open>obtains\<close>, respectively:
 \<close>
 
 text_raw \<open>\begin{minipage}{0.5\textwidth}\<close>
 
   theorem
     fixes x and y
     assumes "A x" and "B y"
     shows "C x y"
   proof -
     from \<open>A x\<close> and \<open>B y\<close>
     show "C x y" \<proof>
   qed
 
 text_raw \<open>\end{minipage}\begin{minipage}{0.5\textwidth}\<close>
 
   theorem
     obtains x and y
     where "A x" and "B y"
   proof -
     have "A a" and "B b" \<proof>
     then show thesis ..
   qed
 
 text_raw \<open>\end{minipage}\<close>
 
 text \<open>
   \<^medskip>
   Here local facts \<open>\<open>A x\<close>\<close> and \<open>\<open>B y\<close>\<close> are referenced immediately; there is no
   need to decompose the logical rule structure again. In the second proof the
   final ``\<^theory_text>\<open>then show thesis ..\<close>'' involves the local rule case \<open>\<And>x y. A x \<Longrightarrow> B
   y \<Longrightarrow> thesis\<close> for the particular instance of terms \<open>a\<close> and \<open>b\<close> produced in the
   body.
 \<close>
 
 
 subsection \<open>Structured proof refinement \label{sec:framework-subproof}\<close>
 
 text \<open>
   By breaking up the grammar for the Isar proof language, we may understand a
   proof text as a linear sequence of individual proof commands. These are
   interpreted as transitions of the Isar virtual machine (Isar/VM), which
   operates on a block-structured configuration in single steps. This allows
   users to write proof texts in an incremental manner, and inspect
   intermediate configurations for debugging.
 
   The basic idea is analogous to evaluating algebraic expressions on a stack
   machine: \<open>(a + b) \<cdot> c\<close> then corresponds to a sequence of single transitions
   for each symbol \<open>(, a, +, b, ), \<cdot>, c\<close>. In Isar the algebraic values are
   facts or goals, and the operations are inferences.
 
   \<^medskip>
   The Isar/VM state maintains a stack of nodes, each node contains the local
   proof context, the linguistic mode, and a pending goal (optional). The mode
   determines the type of transition that may be performed next, it essentially
   alternates between forward and backward reasoning, with an intermediate
   stage for chained facts (see \figref{fig:isar-vm}).
 
   \begin{figure}[htb]
   \begin{center}
   \includegraphics[width=0.8\textwidth]{isar-vm}
   \end{center}
   \caption{Isar/VM modes}\label{fig:isar-vm}
   \end{figure}
 
   For example, in \<open>state\<close> mode Isar acts like a mathematical scratch-pad,
   accepting declarations like \<^theory_text>\<open>fix\<close>, \<^theory_text>\<open>assume\<close>, and claims like \<^theory_text>\<open>have\<close>,
   \<^theory_text>\<open>show\<close>. A goal statement changes the mode to \<open>prove\<close>, which means that we
   may now refine the problem via \<^theory_text>\<open>unfolding\<close> or \<^theory_text>\<open>proof\<close>. Then we are again
   in \<open>state\<close> mode of a proof body, which may issue \<^theory_text>\<open>show\<close> statements to solve
   pending subgoals. A concluding \<^theory_text>\<open>qed\<close> will return to the original \<open>state\<close>
   mode one level upwards. The subsequent Isar/VM trace indicates block
   structure, linguistic mode, goal state, and inferences:
 \<close>
 
 text_raw \<open>\begingroup\footnotesize\<close>
 (*<*)notepad begin
 (*>*)
   text_raw \<open>\begin{minipage}[t]{0.18\textwidth}\<close>
   have "A \<longrightarrow> B"
   proof
     assume A
     show B
       \<proof>
   qed
   text_raw \<open>\end{minipage}\quad
 \begin{minipage}[t]{0.06\textwidth}
 \<open>begin\<close> \\
 \\
 \\
 \<open>begin\<close> \\
 \<open>end\<close> \\
 \<open>end\<close> \\
 \end{minipage}
 \begin{minipage}[t]{0.08\textwidth}
 \<open>prove\<close> \\
 \<open>state\<close> \\
 \<open>state\<close> \\
 \<open>prove\<close> \\
 \<open>state\<close> \\
 \<open>state\<close> \\
 \end{minipage}\begin{minipage}[t]{0.35\textwidth}
 \<open>(A \<longrightarrow> B) \<Longrightarrow> #(A \<longrightarrow> B)\<close> \\
 \<open>(A \<Longrightarrow> B) \<Longrightarrow> #(A \<longrightarrow> B)\<close> \\
 \\
 \\
 \<open>#(A \<longrightarrow> B)\<close> \\
 \<open>A \<longrightarrow> B\<close> \\
 \end{minipage}\begin{minipage}[t]{0.4\textwidth}
 \<open>(init)\<close> \\
 \<open>(resolution impI)\<close> \\
 \\
 \\
 \<open>(refinement #A \<Longrightarrow> B)\<close> \\
 \<open>(finish)\<close> \\
 \end{minipage}\<close>
 (*<*)
 end
 (*>*)
 text_raw \<open>\endgroup\<close>
 
 text \<open>
   Here the @{inference refinement} inference from
   \secref{sec:framework-resolution} mediates composition of Isar subproofs
   nicely. Observe that this principle incorporates some degree of freedom in
   proof composition. In particular, the proof body allows parameters and
   assumptions to be re-ordered, or commuted according to Hereditary Harrop
   Form. Moreover, context elements that are not used in a subproof may be
   omitted altogether. For example:
 \<close>
 
 text_raw \<open>\begin{minipage}{0.5\textwidth}\<close>
 
 (*<*)
 notepad
 begin
 (*>*)
   have "\<And>x y. A x \<Longrightarrow> B y \<Longrightarrow> C x y"
   proof -
     fix x and y
     assume "A x" and "B y"
     show "C x y" \<proof>
   qed
 
 text_raw \<open>\end{minipage}\begin{minipage}{0.5\textwidth}\<close>
 
 (*<*)
 next
 (*>*)
   have "\<And>x y. A x \<Longrightarrow> B y \<Longrightarrow> C x y"
   proof -
     fix x assume "A x"
     fix y assume "B y"
     show "C x y" \<proof>
   qed
 
 text_raw \<open>\end{minipage}\\[3ex]\begin{minipage}{0.5\textwidth}\<close>
 
 (*<*)
 next
 (*>*)
   have "\<And>x y. A x \<Longrightarrow> B y \<Longrightarrow> C x y"
   proof -
     fix y assume "B y"
     fix x assume "A x"
     show "C x y" \<proof>
   qed
 
 text_raw \<open>\end{minipage}\begin{minipage}{0.5\textwidth}\<close>
 (*<*)
 next
 (*>*)
   have "\<And>x y. A x \<Longrightarrow> B y \<Longrightarrow> C x y"
   proof -
     fix y assume "B y"
     fix x
     show "C x y" \<proof>
   qed
 (*<*)
 end
 (*>*)
 
 text_raw \<open>\end{minipage}\<close>
 
 text \<open>
   \<^medskip>
   Such fine-tuning of Isar text is practically important to improve
   readability. Contexts elements are rearranged according to the natural flow
   of reasoning in the body, while still observing the overall scoping rules.
 
   \<^medskip>
   This illustrates the basic idea of structured proof processing in Isar. The
   main mechanisms are based on natural deduction rule composition within the
   Pure framework. In particular, there are no direct operations on goal states
   within the proof body. Moreover, there is no hidden automated reasoning
   involved, just plain unification.
 \<close>
 
 
 subsection \<open>Calculational reasoning \label{sec:framework-calc}\<close>
 
 text \<open>
   The existing Isar infrastructure is sufficiently flexible to support
   calculational reasoning (chains of transitivity steps) as derived concept.
   The generic proof elements introduced below depend on rules declared as
   @{attribute trans} in the context. It is left to the object-logic to provide
   a suitable rule collection for mixed relations of \<open>=\<close>, \<open><\<close>, \<open>\<le>\<close>, \<open>\<subset>\<close>, \<open>\<subseteq>\<close>
   etc. Due to the flexibility of rule composition
   (\secref{sec:framework-resolution}), substitution of equals by equals is
   covered as well, even substitution of inequalities involving monotonicity
-  conditions; see also @{cite \<open>\S6\<close> "Wenzel-PhD"} and @{cite
-  "Bauer-Wenzel:2001"}.
+  conditions; see also \<^cite>\<open>\<open>\S6\<close> in "Wenzel-PhD"\<close> and \<^cite>\<open>"Bauer-Wenzel:2001"\<close>.
 
   The generic calculational mechanism is based on the observation that rules
   such as \<open>trans:\<close>~\<^prop>\<open>x = y \<Longrightarrow> y = z \<Longrightarrow> x = z\<close> proceed from the premises
   towards the conclusion in a deterministic fashion. Thus we may reason in
   forward mode, feeding intermediate results into rules selected from the
   context. The course of reasoning is organized by maintaining a secondary
   fact called ``@{fact calculation}'', apart from the primary ``@{fact this}''
   already provided by the Isar primitives. In the definitions below,
   @{attribute OF} refers to @{inference resolution}
   (\secref{sec:framework-resolution}) with multiple rule arguments, and
   \<open>trans\<close> represents to a suitable rule from the context:
 
   \begin{matharray}{rcl}
     \<^theory_text>\<open>also"\<^sub>0"\<close> & \equiv & \<^theory_text>\<open>note calculation = this\<close> \\
     \<^theory_text>\<open>also"\<^sub>n\<^sub>+\<^sub>1"\<close> & \equiv & \<^theory_text>\<open>note calculation = trans [OF calculation this]\<close> \\[0.5ex]
     \<^theory_text>\<open>finally\<close> & \equiv & \<^theory_text>\<open>also from calculation\<close> \\
   \end{matharray}
 
   The start of a calculation is determined implicitly in the text: here
   \<^theory_text>\<open>also\<close> sets @{fact calculation} to the current result; any subsequent
   occurrence will update @{fact calculation} by combination with the next
   result and a transitivity rule. The calculational sequence is concluded via
   \<^theory_text>\<open>finally\<close>, where the final result is exposed for use in a concluding claim.
 
   Here is a canonical proof pattern, using \<^theory_text>\<open>have\<close> to establish the
   intermediate results:
 \<close>
 
 (*<*)
 notepad
 begin
   fix a b c d :: 'a
 (*>*)
   have "a = b" \<proof>
   also have "\<dots> = c" \<proof>
   also have "\<dots> = d" \<proof>
   finally have "a = d" .
 (*<*)
 end
 (*>*)
 
 text \<open>
   The term ``\<open>\<dots>\<close>'' (literal ellipsis) is a special abbreviation provided by
   the Isabelle/Isar term syntax: it statically refers to the right-hand side
   argument of the previous statement given in the text. Thus it happens to
   coincide with relevant sub-expressions in the calculational chain, but the
   exact correspondence is dependent on the transitivity rules being involved.
 
   \<^medskip>
   Symmetry rules such as \<^prop>\<open>x = y \<Longrightarrow> y = x\<close> are like transitivities with
   only one premise. Isar maintains a separate rule collection declared via the
   @{attribute sym} attribute, to be used in fact expressions ``\<open>a
   [symmetric]\<close>'', or single-step proofs ``\<^theory_text>\<open>assume "x = y" then have "y = x"
   ..\<close>''.
 \<close>
 
 end
diff --git a/src/Doc/Isar_Ref/Generic.thy b/src/Doc/Isar_Ref/Generic.thy
--- a/src/Doc/Isar_Ref/Generic.thy
+++ b/src/Doc/Isar_Ref/Generic.thy
@@ -1,1827 +1,1826 @@
 (*:maxLineLen=78:*)
 
 theory Generic
 imports Main Base
 begin
 
 chapter \<open>Generic tools and packages \label{ch:gen-tools}\<close>
 
 section \<open>Configuration options \label{sec:config}\<close>
 
 text \<open>
   Isabelle/Pure maintains a record of named configuration options within the
   theory or proof context, with values of type \<^ML_type>\<open>bool\<close>, \<^ML_type>\<open>int\<close>, \<^ML_type>\<open>real\<close>, or \<^ML_type>\<open>string\<close>. Tools may declare options in
   ML, and then refer to these values (relative to the context). Thus global
   reference variables are easily avoided. The user may change the value of a
   configuration option by means of an associated attribute of the same name.
   This form of context declaration works particularly well with commands such
   as @{command "declare"} or @{command "using"} like this:
 \<close>
 
 (*<*)experiment begin(*>*)
 declare [[show_main_goal = false]]
 
 notepad
 begin
   note [[show_main_goal = true]]
 end
 (*<*)end(*>*)
 
 text \<open>
   \begin{matharray}{rcll}
     @{command_def "print_options"} & : & \<open>context \<rightarrow>\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     @@{command print_options} ('!'?)
     ;
     @{syntax name} ('=' ('true' | 'false' | @{syntax int} | @{syntax float} | @{syntax name}))?
   \<close>
 
   \<^descr> @{command "print_options"} prints the available configuration options,
   with names, types, and current values; the ``\<open>!\<close>'' option indicates extra
   verbosity.
   
   \<^descr> \<open>name = value\<close> as an attribute expression modifies the named option, with
   the syntax of the value depending on the option's type. For \<^ML_type>\<open>bool\<close>
   the default value is \<open>true\<close>. Any attempt to change a global option in a
   local context is ignored.
 \<close>
 
 
 section \<open>Basic proof tools\<close>
 
 subsection \<open>Miscellaneous methods and attributes \label{sec:misc-meth-att}\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{method_def unfold} & : & \<open>method\<close> \\
     @{method_def fold} & : & \<open>method\<close> \\
     @{method_def insert} & : & \<open>method\<close> \\[0.5ex]
     @{method_def erule}\<open>\<^sup>*\<close> & : & \<open>method\<close> \\
     @{method_def drule}\<open>\<^sup>*\<close> & : & \<open>method\<close> \\
     @{method_def frule}\<open>\<^sup>*\<close> & : & \<open>method\<close> \\
     @{method_def intro} & : & \<open>method\<close> \\
     @{method_def elim} & : & \<open>method\<close> \\
     @{method_def fail} & : & \<open>method\<close> \\
     @{method_def succeed} & : & \<open>method\<close> \\
     @{method_def sleep} & : & \<open>method\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     (@@{method fold} | @@{method unfold} | @@{method insert}) @{syntax thms}
     ;
     (@@{method erule} | @@{method drule} | @@{method frule})
       ('(' @{syntax nat} ')')? @{syntax thms}
     ;
     (@@{method intro} | @@{method elim}) @{syntax thms}?
     ;
     @@{method sleep} @{syntax real}
   \<close>
 
   \<^descr> @{method unfold}~\<open>a\<^sub>1 \<dots> a\<^sub>n\<close> and @{method fold}~\<open>a\<^sub>1 \<dots> a\<^sub>n\<close> expand (or
   fold back) the given definitions throughout all goals; any chained facts
   provided are inserted into the goal and subject to rewriting as well.
 
   Unfolding works in two stages: first, the given equations are used directly
   for rewriting; second, the equations are passed through the attribute
   @{attribute_ref abs_def} before rewriting --- to ensure that definitions are
   fully expanded, regardless of the actual parameters that are provided.
 
   \<^descr> @{method insert}~\<open>a\<^sub>1 \<dots> a\<^sub>n\<close> inserts theorems as facts into all goals of
   the proof state. Note that current facts indicated for forward chaining are
   ignored.
 
   \<^descr> @{method erule}~\<open>a\<^sub>1 \<dots> a\<^sub>n\<close>, @{method drule}~\<open>a\<^sub>1 \<dots> a\<^sub>n\<close>, and @{method
   frule}~\<open>a\<^sub>1 \<dots> a\<^sub>n\<close> are similar to the basic @{method rule} method (see
   \secref{sec:pure-meth-att}), but apply rules by elim-resolution,
-  destruct-resolution, and forward-resolution, respectively @{cite
-  "isabelle-implementation"}. The optional natural number argument (default 0)
+  destruct-resolution, and forward-resolution, respectively \<^cite>\<open>"isabelle-implementation"\<close>. The optional natural number argument (default 0)
   specifies additional assumption steps to be performed here.
 
   Note that these methods are improper ones, mainly serving for
   experimentation and tactic script emulation. Different modes of basic rule
   application are usually expressed in Isar at the proof language level,
   rather than via implicit proof state manipulations. For example, a proper
   single-step elimination would be done using the plain @{method rule} method,
   with forward chaining of current facts.
 
   \<^descr> @{method intro} and @{method elim} repeatedly refine some goal by intro-
   or elim-resolution, after having inserted any chained facts. Exactly the
   rules given as arguments are taken into account; this allows fine-tuned
   decomposition of a proof problem, in contrast to common automated tools.
 
   \<^descr> @{method fail} yields an empty result sequence; it is the identity of the
   ``\<open>|\<close>'' method combinator (cf.\ \secref{sec:proof-meth}).
 
   \<^descr> @{method succeed} yields a single (unchanged) result; it is the identity
   of the ``\<open>,\<close>'' method combinator (cf.\ \secref{sec:proof-meth}).
 
   \<^descr> @{method sleep}~\<open>s\<close> succeeds after a real-time delay of \<open>s\<close> seconds. This
   is occasionally useful for demonstration and testing purposes.
 
 
   \begin{matharray}{rcl}
     @{attribute_def tagged} & : & \<open>attribute\<close> \\
     @{attribute_def untagged} & : & \<open>attribute\<close> \\[0.5ex]
     @{attribute_def THEN} & : & \<open>attribute\<close> \\
     @{attribute_def unfolded} & : & \<open>attribute\<close> \\
     @{attribute_def folded} & : & \<open>attribute\<close> \\
     @{attribute_def abs_def} & : & \<open>attribute\<close> \\[0.5ex]
     @{attribute_def rotated} & : & \<open>attribute\<close> \\
     @{attribute_def (Pure) elim_format} & : & \<open>attribute\<close> \\
     @{attribute_def no_vars}\<open>\<^sup>*\<close> & : & \<open>attribute\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     @@{attribute tagged} @{syntax name} @{syntax name}
     ;
     @@{attribute untagged} @{syntax name}
     ;
     @@{attribute THEN} ('[' @{syntax nat} ']')? @{syntax thm}
     ;
     (@@{attribute unfolded} | @@{attribute folded}) @{syntax thms}
     ;
     @@{attribute rotated} @{syntax int}?
   \<close>
 
   \<^descr> @{attribute tagged}~\<open>name value\<close> and @{attribute untagged}~\<open>name\<close> add and
   remove \<^emph>\<open>tags\<close> of some theorem. Tags may be any list of string pairs that
   serve as formal comment. The first string is considered the tag name, the
   second its value. Note that @{attribute untagged} removes any tags of the
   same name.
 
   \<^descr> @{attribute THEN}~\<open>a\<close> composes rules by resolution; it resolves with the
   first premise of \<open>a\<close> (an alternative position may be also specified). See
-  also \<^ML_infix>\<open>RS\<close> in @{cite "isabelle-implementation"}.
+  also \<^ML_infix>\<open>RS\<close> in \<^cite>\<open>"isabelle-implementation"\<close>.
   
   \<^descr> @{attribute unfolded}~\<open>a\<^sub>1 \<dots> a\<^sub>n\<close> and @{attribute folded}~\<open>a\<^sub>1 \<dots> a\<^sub>n\<close>
   expand and fold back again the given definitions throughout a rule.
 
   \<^descr> @{attribute abs_def} turns an equation of the form \<^prop>\<open>f x y \<equiv> t\<close>
   into \<^prop>\<open>f \<equiv> \<lambda>x y. t\<close>, which ensures that @{method simp} steps always
   expand it. This also works for object-logic equality.
 
   \<^descr> @{attribute rotated}~\<open>n\<close> rotate the premises of a theorem by \<open>n\<close> (default
   1).
 
   \<^descr> @{attribute (Pure) elim_format} turns a destruction rule into elimination
   rule format, by resolving with the rule \<^prop>\<open>PROP A \<Longrightarrow> (PROP A \<Longrightarrow> PROP B) \<Longrightarrow>
   PROP B\<close>.
   
   Note that the Classical Reasoner (\secref{sec:classical}) provides its own
   version of this operation.
 
   \<^descr> @{attribute no_vars} replaces schematic variables by free ones; this is
   mainly for tuning output of pretty printed theorems.
 \<close>
 
 
 subsection \<open>Low-level equational reasoning\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{method_def subst} & : & \<open>method\<close> \\
     @{method_def hypsubst} & : & \<open>method\<close> \\
     @{method_def split} & : & \<open>method\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     @@{method subst} ('(' 'asm' ')')? \<newline> ('(' (@{syntax nat}+) ')')? @{syntax thm}
     ;
     @@{method split} @{syntax thms}
   \<close>
 
   These methods provide low-level facilities for equational reasoning that are
   intended for specialized applications only. Normally, single step
   calculations would be performed in a structured text (see also
   \secref{sec:calculation}), while the Simplifier methods provide the
   canonical way for automated normalization (see \secref{sec:simplifier}).
 
   \<^descr> @{method subst}~\<open>eq\<close> performs a single substitution step using rule \<open>eq\<close>,
   which may be either a meta or object equality.
 
   \<^descr> @{method subst}~\<open>(asm) eq\<close> substitutes in an assumption.
 
   \<^descr> @{method subst}~\<open>(i \<dots> j) eq\<close> performs several substitutions in the
   conclusion. The numbers \<open>i\<close> to \<open>j\<close> indicate the positions to substitute at.
   Positions are ordered from the top of the term tree moving down from left to
   right. For example, in \<open>(a + b) + (c + d)\<close> there are three positions where
   commutativity of \<open>+\<close> is applicable: 1 refers to \<open>a + b\<close>, 2 to the whole
   term, and 3 to \<open>c + d\<close>.
 
   If the positions in the list \<open>(i \<dots> j)\<close> are non-overlapping (e.g.\ \<open>(2 3)\<close> in
   \<open>(a + b) + (c + d)\<close>) you may assume all substitutions are performed
   simultaneously. Otherwise the behaviour of \<open>subst\<close> is not specified.
 
   \<^descr> @{method subst}~\<open>(asm) (i \<dots> j) eq\<close> performs the substitutions in the
   assumptions. The positions refer to the assumptions in order from left to
   right. For example, given in a goal of the form \<open>P (a + b) \<Longrightarrow> P (c + d) \<Longrightarrow> \<dots>\<close>,
   position 1 of commutativity of \<open>+\<close> is the subterm \<open>a + b\<close> and position 2 is
   the subterm \<open>c + d\<close>.
 
   \<^descr> @{method hypsubst} performs substitution using some assumption; this only
   works for equations of the form \<open>x = t\<close> where \<open>x\<close> is a free or bound
   variable.
 
   \<^descr> @{method split}~\<open>a\<^sub>1 \<dots> a\<^sub>n\<close> performs single-step case splitting using the
   given rules. Splitting is performed in the conclusion or some assumption of
   the subgoal, depending of the structure of the rule.
   
   Note that the @{method simp} method already involves repeated application of
   split rules as declared in the current context, using @{attribute split},
   for example.
 \<close>
 
 
 section \<open>The Simplifier \label{sec:simplifier}\<close>
 
 text \<open>
   The Simplifier performs conditional and unconditional rewriting and uses
   contextual information: rule declarations in the background theory or local
   proof context are taken into account, as well as chained facts and subgoal
   premises (``local assumptions''). There are several general hooks that allow
   to modify the simplification strategy, or incorporate other proof tools that
   solve sub-problems, produce rewrite rules on demand etc.
 
   The rewriting strategy is always strictly bottom up, except for congruence
   rules, which are applied while descending into a term. Conditions in
   conditional rewrite rules are solved recursively before the rewrite rule is
   applied.
 
   The default Simplifier setup of major object logics (HOL, HOLCF, FOL, ZF)
   makes the Simplifier ready for immediate use, without engaging into the
   internal structures. Thus it serves as general-purpose proof tool with the
   main focus on equational reasoning, and a bit more than that.
 \<close>
 
 
 subsection \<open>Simplification methods \label{sec:simp-meth}\<close>
 
 text \<open>
   \begin{tabular}{rcll}
     @{method_def simp} & : & \<open>method\<close> \\
     @{method_def simp_all} & : & \<open>method\<close> \\
     \<open>Pure.\<close>@{method_def (Pure) simp} & : & \<open>method\<close> \\
     \<open>Pure.\<close>@{method_def (Pure) simp_all} & : & \<open>method\<close> \\
     @{attribute_def simp_depth_limit} & : & \<open>attribute\<close> & default \<open>100\<close> \\
   \end{tabular}
   \<^medskip>
 
   \<^rail>\<open>
     (@@{method simp} | @@{method simp_all}) opt? (@{syntax simpmod} * )
     ;
 
     opt: '(' ('no_asm' | 'no_asm_simp' | 'no_asm_use' | 'asm_lr' ) ')'
     ;
     @{syntax_def simpmod}: ('add' | 'del' | 'flip' | 'only' |
       'split' (() | '!' | 'del') | 'cong' (() | 'add' | 'del'))
     ':' @{syntax thms}
   \<close>
 
   \<^descr> @{method simp} invokes the Simplifier on the first subgoal, after
   inserting chained facts as additional goal premises; further rule
   declarations may be included via \<open>(simp add: facts)\<close>. The proof method fails
   if the subgoal remains unchanged after simplification.
 
   Note that the original goal premises and chained facts are subject to
   simplification themselves, while declarations via \<open>add\<close>/\<open>del\<close> merely follow
   the policies of the object-logic to extract rewrite rules from theorems,
   without further simplification. This may lead to slightly different behavior
   in either case, which might be required precisely like that in some boundary
   situations to perform the intended simplification step!
 
   \<^medskip>
 Modifier \<open>flip\<close> deletes the following theorems from the simpset and adds
 their symmetric version (i.e.\ lhs and rhs exchanged). No warning is shown
 if the original theorem was not present.
 
   \<^medskip>
   The \<open>only\<close> modifier first removes all other rewrite rules, looper tactics
   (including split rules), congruence rules, and then behaves like \<open>add\<close>.
   Implicit solvers remain, which means that trivial rules like reflexivity or
   introduction of \<open>True\<close> are available to solve the simplified subgoals, but
   also non-trivial tools like linear arithmetic in HOL. The latter may lead to
   some surprise of the meaning of ``only'' in Isabelle/HOL compared to
   English!
 
   \<^medskip>
   The \<open>split\<close> modifiers add or delete rules for the Splitter (see also
   \secref{sec:simp-strategies} on the looper). This works only if the
   Simplifier method has been properly setup to include the Splitter (all major
   object logics such HOL, HOLCF, FOL, ZF do this already).
   The \<open>!\<close> option causes the split rules to be used aggressively:
   after each application of a split rule in the conclusion, the \<open>safe\<close>
   tactic of the classical reasoner (see \secref{sec:classical:partial})
   is applied to the new goal. The net effect is that the goal is split into
   the different cases. This option can speed up simplification of goals
   with many nested conditional or case expressions significantly.
 
   There is also a separate @{method_ref split} method available for
   single-step case splitting. The effect of repeatedly applying \<open>(split thms)\<close>
   can be imitated by ``\<open>(simp only: split: thms)\<close>''.
 
   \<^medskip>
   The \<open>cong\<close> modifiers add or delete Simplifier congruence rules (see also
   \secref{sec:simp-rules}); the default is to add.
 
   \<^descr> @{method simp_all} is similar to @{method simp}, but acts on all goals,
   working backwards from the last to the first one as usual in Isabelle.\<^footnote>\<open>The
   order is irrelevant for goals without schematic variables, so simplification
   might actually be performed in parallel here.\<close>
 
   Chained facts are inserted into all subgoals, before the simplification
   process starts. Further rule declarations are the same as for @{method
   simp}.
 
   The proof method fails if all subgoals remain unchanged after
   simplification.
 
   \<^descr> @{attribute simp_depth_limit} limits the number of recursive invocations
   of the Simplifier during conditional rewriting.
 
 
   By default the Simplifier methods above take local assumptions fully into
   account, using equational assumptions in the subsequent normalization
   process, or simplifying assumptions themselves. Further options allow to
   fine-tune the behavior of the Simplifier in this respect, corresponding to a
   variety of ML tactics as follows.\<^footnote>\<open>Unlike the corresponding Isar proof
   methods, the ML tactics do not insist in changing the goal state.\<close>
 
   \begin{center}
   \small
   \begin{tabular}{|l|l|p{0.3\textwidth}|}
   \hline
   Isar method & ML tactic & behavior \\\hline
 
   \<open>(simp (no_asm))\<close> & \<^ML>\<open>simp_tac\<close> & assumptions are ignored completely
   \\\hline
 
   \<open>(simp (no_asm_simp))\<close> & \<^ML>\<open>asm_simp_tac\<close> & assumptions are used in the
   simplification of the conclusion but are not themselves simplified \\\hline
 
   \<open>(simp (no_asm_use))\<close> & \<^ML>\<open>full_simp_tac\<close> & assumptions are simplified but
   are not used in the simplification of each other or the conclusion \\\hline
 
   \<open>(simp)\<close> & \<^ML>\<open>asm_full_simp_tac\<close> & assumptions are used in the
   simplification of the conclusion and to simplify other assumptions \\\hline
 
   \<open>(simp (asm_lr))\<close> & \<^ML>\<open>asm_lr_simp_tac\<close> & compatibility mode: an
   assumption is only used for simplifying assumptions which are to the right
   of it \\\hline
 
   \end{tabular}
   \end{center}
 
   \<^medskip>
   In Isabelle/Pure, proof methods @{method (Pure) simp} and @{method (Pure)
   simp_all} only know about meta-equality \<open>\<equiv>\<close>. Any new object-logic needs to
   re-define these methods via \<^ML>\<open>Simplifier.method_setup\<close> in ML:
   Isabelle/FOL or Isabelle/HOL may serve as blue-prints.
 \<close>
 
 
 subsubsection \<open>Examples\<close>
 
 text \<open>
   We consider basic algebraic simplifications in Isabelle/HOL. The rather
   trivial goal \<^prop>\<open>0 + (x + 0) = x + 0 + 0\<close> looks like a good candidate
   to be solved by a single call of @{method simp}:
 \<close>
 
 lemma "0 + (x + 0) = x + 0 + 0" apply simp? oops
 
 text \<open>
   The above attempt \<^emph>\<open>fails\<close>, because \<^term>\<open>0\<close> and \<^term>\<open>(+)\<close> in the
   HOL library are declared as generic type class operations, without stating
   any algebraic laws yet. More specific types are required to get access to
   certain standard simplifications of the theory context, e.g.\ like this:\<close>
 
 lemma fixes x :: nat shows "0 + (x + 0) = x + 0 + 0" by simp
 lemma fixes x :: int shows "0 + (x + 0) = x + 0 + 0" by simp
 lemma fixes x :: "'a :: monoid_add" shows "0 + (x + 0) = x + 0 + 0" by simp
 
 text \<open>
   \<^medskip>
   In many cases, assumptions of a subgoal are also needed in the
   simplification process. For example:
 \<close>
 
 lemma fixes x :: nat shows "x = 0 \<Longrightarrow> x + x = 0" by simp
 lemma fixes x :: nat assumes "x = 0" shows "x + x = 0" apply simp oops
 lemma fixes x :: nat assumes "x = 0" shows "x + x = 0" using assms by simp
 
 text \<open>
   As seen above, local assumptions that shall contribute to simplification
   need to be part of the subgoal already, or indicated explicitly for use by
   the subsequent method invocation. Both too little or too much information
   can make simplification fail, for different reasons.
 
   In the next example the malicious assumption \<^prop>\<open>\<And>x::nat. f x = g (f (g
   x))\<close> does not contribute to solve the problem, but makes the default
   @{method simp} method loop: the rewrite rule \<open>f ?x \<equiv> g (f (g ?x))\<close> extracted
   from the assumption does not terminate. The Simplifier notices certain
   simple forms of nontermination, but not this one. The problem can be solved
   nonetheless, by ignoring assumptions via special options as explained
   before:
 \<close>
 
 lemma "(\<And>x::nat. f x = g (f (g x))) \<Longrightarrow> f 0 = f 0 + 0"
   by (simp (no_asm))
 
 text \<open>
   The latter form is typical for long unstructured proof scripts, where the
   control over the goal content is limited. In structured proofs it is usually
   better to avoid pushing too many facts into the goal state in the first
   place. Assumptions in the Isar proof context do not intrude the reasoning if
   not used explicitly. This is illustrated for a toplevel statement and a
   local proof body as follows:
 \<close>
 
 lemma
   assumes "\<And>x::nat. f x = g (f (g x))"
   shows "f 0 = f 0 + 0" by simp
 
 notepad
 begin
   assume "\<And>x::nat. f x = g (f (g x))"
   have "f 0 = f 0 + 0" by simp
 end
 
 text \<open>
   \<^medskip>
   Because assumptions may simplify each other, there can be very subtle cases
   of nontermination. For example, the regular @{method simp} method applied to
   \<^prop>\<open>P (f x) \<Longrightarrow> y = x \<Longrightarrow> f x = f y \<Longrightarrow> Q\<close> gives rise to the infinite
   reduction sequence
   \[
   \<open>P (f x)\<close> \stackrel{\<open>f x \<equiv> f y\<close>}{\longmapsto}
   \<open>P (f y)\<close> \stackrel{\<open>y \<equiv> x\<close>}{\longmapsto}
   \<open>P (f x)\<close> \stackrel{\<open>f x \<equiv> f y\<close>}{\longmapsto} \cdots
   \]
   whereas applying the same to \<^prop>\<open>y = x \<Longrightarrow> f x = f y \<Longrightarrow> P (f x) \<Longrightarrow> Q\<close>
   terminates (without solving the goal):
 \<close>
 
 lemma "y = x \<Longrightarrow> f x = f y \<Longrightarrow> P (f x) \<Longrightarrow> Q"
   apply simp
   oops
 
 text \<open>
   See also \secref{sec:simp-trace} for options to enable Simplifier trace
   mode, which often helps to diagnose problems with rewrite systems.
 \<close>
 
 
 subsection \<open>Declaring rules \label{sec:simp-rules}\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{attribute_def simp} & : & \<open>attribute\<close> \\
     @{attribute_def split} & : & \<open>attribute\<close> \\
     @{attribute_def cong} & : & \<open>attribute\<close> \\
     @{command_def "print_simpset"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     (@@{attribute simp} | @@{attribute cong}) (() | 'add' | 'del') |
     @@{attribute split} (() | '!' | 'del')
     ;
     @@{command print_simpset} ('!'?)
   \<close>
 
   \<^descr> @{attribute simp} declares rewrite rules, by adding or deleting them from
   the simpset within the theory or proof context. Rewrite rules are theorems
   expressing some form of equality, for example:
 
   \<open>Suc ?m + ?n = ?m + Suc ?n\<close> \\
   \<open>?P \<and> ?P \<longleftrightarrow> ?P\<close> \\
   \<open>?A \<union> ?B \<equiv> {x. x \<in> ?A \<or> x \<in> ?B}\<close>
 
   \<^medskip>
   Conditional rewrites such as \<open>?m < ?n \<Longrightarrow> ?m div ?n = 0\<close> are also permitted;
   the conditions can be arbitrary formulas.
 
   \<^medskip>
   Internally, all rewrite rules are translated into Pure equalities, theorems
   with conclusion \<open>lhs \<equiv> rhs\<close>. The simpset contains a function for extracting
   equalities from arbitrary theorems, which is usually installed when the
   object-logic is configured initially. For example, \<open>\<not> ?x \<in> {}\<close> could be
   turned into \<open>?x \<in> {} \<equiv> False\<close>. Theorems that are declared as @{attribute
   simp} and local assumptions within a goal are treated uniformly in this
   respect.
 
   The Simplifier accepts the following formats for the \<open>lhs\<close> term:
 
     \<^enum> First-order patterns, considering the sublanguage of application of
     constant operators to variable operands, without \<open>\<lambda>\<close>-abstractions or
     functional variables. For example:
 
     \<open>(?x + ?y) + ?z \<equiv> ?x + (?y + ?z)\<close> \\
     \<open>f (f ?x ?y) ?z \<equiv> f ?x (f ?y ?z)\<close>
 
-    \<^enum> Higher-order patterns in the sense of @{cite "nipkow-patterns"}. These
+    \<^enum> Higher-order patterns in the sense of \<^cite>\<open>"nipkow-patterns"\<close>. These
     are terms in \<open>\<beta>\<close>-normal form (this will always be the case unless you have
     done something strange) where each occurrence of an unknown is of the form
     \<open>?F x\<^sub>1 \<dots> x\<^sub>n\<close>, where the \<open>x\<^sub>i\<close> are distinct bound variables.
 
     For example, \<open>(\<forall>x. ?P x \<and> ?Q x) \<equiv> (\<forall>x. ?P x) \<and> (\<forall>x. ?Q x)\<close> or its
     symmetric form, since the \<open>rhs\<close> is also a higher-order pattern.
 
     \<^enum> Physical first-order patterns over raw \<open>\<lambda>\<close>-term structure without
     \<open>\<alpha>\<beta>\<eta>\<close>-equality; abstractions and bound variables are treated like
     quasi-constant term material.
 
     For example, the rule \<open>?f ?x \<in> range ?f = True\<close> rewrites the term \<open>g a \<in>
     range g\<close> to \<open>True\<close>, but will fail to match \<open>g (h b) \<in> range (\<lambda>x. g (h
     x))\<close>. However, offending subterms (in our case \<open>?f ?x\<close>, which is not a
     pattern) can be replaced by adding new variables and conditions like this:
     \<open>?y = ?f ?x \<Longrightarrow> ?y \<in> range ?f = True\<close> is acceptable as a conditional rewrite
     rule of the second category since conditions can be arbitrary terms.
 
   \<^descr> @{attribute split} declares case split rules.
 
   \<^descr> @{attribute cong} declares congruence rules to the Simplifier context.
 
   Congruence rules are equalities of the form @{text [display]
   "\<dots> \<Longrightarrow> f ?x\<^sub>1 \<dots> ?x\<^sub>n = f ?y\<^sub>1 \<dots> ?y\<^sub>n"}
 
   This controls the simplification of the arguments of \<open>f\<close>. For example, some
   arguments can be simplified under additional assumptions:
   @{text [display]
     "?P\<^sub>1 \<longleftrightarrow> ?Q\<^sub>1 \<Longrightarrow>
     (?Q\<^sub>1 \<Longrightarrow> ?P\<^sub>2 \<longleftrightarrow> ?Q\<^sub>2) \<Longrightarrow>
     (?P\<^sub>1 \<longrightarrow> ?P\<^sub>2) \<longleftrightarrow> (?Q\<^sub>1 \<longrightarrow> ?Q\<^sub>2)"}
 
   Given this rule, the Simplifier assumes \<open>?Q\<^sub>1\<close> and extracts rewrite rules
   from it when simplifying \<open>?P\<^sub>2\<close>. Such local assumptions are effective for
   rewriting formulae such as \<open>x = 0 \<longrightarrow> y + x = y\<close>.
 
   %FIXME
   %The local assumptions are also provided as theorems to the solver;
   %see \secref{sec:simp-solver} below.
 
   \<^medskip>
   The following congruence rule for bounded quantifiers also supplies
   contextual information --- about the bound variable: @{text [display]
   "(?A = ?B) \<Longrightarrow>
     (\<And>x. x \<in> ?B \<Longrightarrow> ?P x \<longleftrightarrow> ?Q x) \<Longrightarrow>
     (\<forall>x \<in> ?A. ?P x) \<longleftrightarrow> (\<forall>x \<in> ?B. ?Q x)"}
 
   \<^medskip>
   This congruence rule for conditional expressions can supply contextual
   information for simplifying the arms: @{text [display]
   "?p = ?q \<Longrightarrow>
     (?q \<Longrightarrow> ?a = ?c) \<Longrightarrow>
     (\<not> ?q \<Longrightarrow> ?b = ?d) \<Longrightarrow>
     (if ?p then ?a else ?b) = (if ?q then ?c else ?d)"}
 
   A congruence rule can also \<^emph>\<open>prevent\<close> simplification of some arguments. Here
   is an alternative congruence rule for conditional expressions that conforms
   to non-strict functional evaluation: @{text [display]
   "?p = ?q \<Longrightarrow>
     (if ?p then ?a else ?b) = (if ?q then ?a else ?b)"}
 
   Only the first argument is simplified; the others remain unchanged. This can
   make simplification much faster, but may require an extra case split over
   the condition \<open>?q\<close> to prove the goal.
 
   \<^descr> @{command "print_simpset"} prints the collection of rules declared to the
   Simplifier, which is also known as ``simpset'' internally; the ``\<open>!\<close>''
   option indicates extra verbosity.
 
   The implicit simpset of the theory context is propagated monotonically
   through the theory hierarchy: forming a new theory, the union of the
   simpsets of its imports are taken as starting point. Also note that
   definitional packages like @{command "datatype"}, @{command "primrec"},
   @{command "fun"} routinely declare Simplifier rules to the target context,
   while plain @{command "definition"} is an exception in \<^emph>\<open>not\<close> declaring
   anything.
 
   \<^medskip>
   It is up the user to manipulate the current simpset further by explicitly
   adding or deleting theorems as simplification rules, or installing other
   tools via simplification procedures (\secref{sec:simproc}). Good simpsets
   are hard to design. Rules that obviously simplify, like \<open>?n + 0 \<equiv> ?n\<close> are
   good candidates for the implicit simpset, unless a special non-normalizing
   behavior of certain operations is intended. More specific rules (such as
   distributive laws, which duplicate subterms) should be added only for
   specific proof steps. Conversely, sometimes a rule needs to be deleted just
   for some part of a proof. The need of frequent additions or deletions may
   indicate a poorly designed simpset.
 
   \begin{warn}
   The union of simpsets from theory imports (as described above) is not always
   a good starting point for the new theory. If some ancestors have deleted
   simplification rules because they are no longer wanted, while others have
   left those rules in, then the union will contain the unwanted rules, and
   thus have to be deleted again in the theory body.
   \end{warn}
 \<close>
 
 
 subsection \<open>Ordered rewriting with permutative rules\<close>
 
 text \<open>
   A rewrite rule is \<^emph>\<open>permutative\<close> if the left-hand side and right-hand side
   are the equal up to renaming of variables. The most common permutative rule
   is commutativity: \<open>?x + ?y = ?y + ?x\<close>. Other examples include \<open>(?x - ?y) -
   ?z = (?x - ?z) - ?y\<close> in arithmetic and \<open>insert ?x (insert ?y ?A) = insert ?y
   (insert ?x ?A)\<close> for sets. Such rules are common enough to merit special
   attention.
 
   Because ordinary rewriting loops given such rules, the Simplifier employs a
   special strategy, called \<^emph>\<open>ordered rewriting\<close>. Permutative rules are
   detected and only applied if the rewriting step decreases the redex wrt.\ a
   given term ordering. For example, commutativity rewrites \<open>b + a\<close> to \<open>a + b\<close>,
   but then stops, because the redex cannot be decreased further in the sense
   of the term ordering.
 
   The default is lexicographic ordering of term structure, but this could be
   also changed locally for special applications via @{define_ML
   Simplifier.set_term_ord} in Isabelle/ML.
 
   \<^medskip>
   Permutative rewrite rules are declared to the Simplifier just like other
   rewrite rules. Their special status is recognized automatically, and their
   application is guarded by the term ordering accordingly.
 \<close>
 
 
 subsubsection \<open>Rewriting with AC operators\<close>
 
 text \<open>
   Ordered rewriting is particularly effective in the case of
   associative-commutative operators. (Associativity by itself is not
   permutative.) When dealing with an AC-operator \<open>f\<close>, keep the following
   points in mind:
 
     \<^item> The associative law must always be oriented from left to right, namely
     \<open>f (f x y) z = f x (f y z)\<close>. The opposite orientation, if used with
     commutativity, leads to looping in conjunction with the standard term
     order.
 
     \<^item> To complete your set of rewrite rules, you must add not just
     associativity (A) and commutativity (C) but also a derived rule
     \<^emph>\<open>left-commutativity\<close> (LC): \<open>f x (f y z) = f y (f x z)\<close>.
 
   Ordered rewriting with the combination of A, C, and LC sorts a term
   lexicographically --- the rewriting engine imitates bubble-sort.
 \<close>
 
 experiment
   fixes f :: "'a \<Rightarrow> 'a \<Rightarrow> 'a"  (infix "\<bullet>" 60)
   assumes assoc: "(x \<bullet> y) \<bullet> z = x \<bullet> (y \<bullet> z)"
   assumes commute: "x \<bullet> y = y \<bullet> x"
 begin
 
 lemma left_commute: "x \<bullet> (y \<bullet> z) = y \<bullet> (x \<bullet> z)"
 proof -
   have "(x \<bullet> y) \<bullet> z = (y \<bullet> x) \<bullet> z" by (simp only: commute)
   then show ?thesis by (simp only: assoc)
 qed
 
 lemmas AC_rules = assoc commute left_commute
 
 text \<open>
   Thus the Simplifier is able to establish equalities with arbitrary
   permutations of subterms, by normalizing to a common standard form. For
   example:
 \<close>
 
 lemma "(b \<bullet> c) \<bullet> a = xxx"
   apply (simp only: AC_rules)
   txt \<open>\<^subgoals>\<close>
   oops
 
 lemma "(b \<bullet> c) \<bullet> a = a \<bullet> (b \<bullet> c)" by (simp only: AC_rules)
 lemma "(b \<bullet> c) \<bullet> a = c \<bullet> (b \<bullet> a)" by (simp only: AC_rules)
 lemma "(b \<bullet> c) \<bullet> a = (c \<bullet> b) \<bullet> a" by (simp only: AC_rules)
 
 end
 
 text \<open>
-  Martin and Nipkow @{cite "martin-nipkow"} discuss the theory and give many
+  Martin and Nipkow \<^cite>\<open>"martin-nipkow"\<close> discuss the theory and give many
   examples; other algebraic structures are amenable to ordered rewriting, such
-  as Boolean rings. The Boyer-Moore theorem prover @{cite bm88book} also
+  as Boolean rings. The Boyer-Moore theorem prover \<^cite>\<open>bm88book\<close> also
   employs ordered rewriting.
 \<close>
 
 
 subsubsection \<open>Re-orienting equalities\<close>
 
 text \<open>Another application of ordered rewriting uses the derived rule
   @{thm [source] eq_commute}: @{thm [source = false] eq_commute} to
   reverse equations.
 
   This is occasionally useful to re-orient local assumptions according
   to the term ordering, when other built-in mechanisms of
   reorientation and mutual simplification fail to apply.\<close>
 
 
 subsection \<open>Simplifier tracing and debugging \label{sec:simp-trace}\<close>
 
 text \<open>
   \begin{tabular}{rcll}
     @{attribute_def simp_trace} & : & \<open>attribute\<close> & default \<open>false\<close> \\
     @{attribute_def simp_trace_depth_limit} & : & \<open>attribute\<close> & default \<open>1\<close> \\
     @{attribute_def simp_debug} & : & \<open>attribute\<close> & default \<open>false\<close> \\
     @{attribute_def simp_trace_new} & : & \<open>attribute\<close> \\
     @{attribute_def simp_break} & : & \<open>attribute\<close> \\
   \end{tabular}
   \<^medskip>
 
   \<^rail>\<open>
     @@{attribute simp_trace_new} ('interactive')? \<newline>
       ('mode' '=' ('full' | 'normal'))? \<newline>
       ('depth' '=' @{syntax nat})?
     ;
 
     @@{attribute simp_break} (@{syntax term}*)
   \<close>
 
   These attributes and configurations options control various aspects of
   Simplifier tracing and debugging.
 
   \<^descr> @{attribute simp_trace} makes the Simplifier output internal operations.
   This includes rewrite steps, but also bookkeeping like modifications of the
   simpset.
 
   \<^descr> @{attribute simp_trace_depth_limit} limits the effect of @{attribute
   simp_trace} to the given depth of recursive Simplifier invocations (when
   solving conditions of rewrite rules).
 
   \<^descr> @{attribute simp_debug} makes the Simplifier output some extra information
   about internal operations. This includes any attempted invocation of
   simplification procedures.
 
   \<^descr> @{attribute simp_trace_new} controls Simplifier tracing within
-  Isabelle/PIDE applications, notably Isabelle/jEdit @{cite "isabelle-jedit"}.
+  Isabelle/PIDE applications, notably Isabelle/jEdit \<^cite>\<open>"isabelle-jedit"\<close>.
   This provides a hierarchical representation of the rewriting steps performed
   by the Simplifier.
 
   Users can configure the behaviour by specifying breakpoints, verbosity and
   enabling or disabling the interactive mode. In normal verbosity (the
   default), only rule applications matching a breakpoint will be shown to the
   user. In full verbosity, all rule applications will be logged. Interactive
   mode interrupts the normal flow of the Simplifier and defers the decision
   how to continue to the user via some GUI dialog.
 
   \<^descr> @{attribute simp_break} declares term or theorem breakpoints for
   @{attribute simp_trace_new} as described above. Term breakpoints are
   patterns which are checked for matches on the redex of a rule application.
   Theorem breakpoints trigger when the corresponding theorem is applied in a
   rewrite step. For example:
 \<close>
 
 (*<*)experiment begin(*>*)
 declare conjI [simp_break]
 declare [[simp_break "?x \<and> ?y"]]
 (*<*)end(*>*)
 
 
 subsection \<open>Simplification procedures \label{sec:simproc}\<close>
 
 text \<open>
   Simplification procedures are ML functions that produce proven rewrite rules
   on demand. They are associated with higher-order patterns that approximate
   the left-hand sides of equations. The Simplifier first matches the current
   redex against one of the LHS patterns; if this succeeds, the corresponding
   ML function is invoked, passing the Simplifier context and redex term. Thus
   rules may be specifically fashioned for particular situations, resulting in
   a more powerful mechanism than term rewriting by a fixed set of rules.
 
   Any successful result needs to be a (possibly conditional) rewrite rule \<open>t \<equiv>
   u\<close> that is applicable to the current redex. The rule will be applied just as
   any ordinary rewrite rule. It is expected to be already in \<^emph>\<open>internal form\<close>,
   bypassing the automatic preprocessing of object-level equivalences.
 
   \begin{matharray}{rcl}
     @{command_def "simproc_setup"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
     simproc & : & \<open>attribute\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     @@{command simproc_setup} @{syntax name} '(' (@{syntax term} + '|') ')' '='
       @{syntax text};
 
     @@{attribute simproc} (('add' ':')? | 'del' ':') (@{syntax name}+)
   \<close>
 
   \<^descr> @{command "simproc_setup"} defines a named simplification procedure that
   is invoked by the Simplifier whenever any of the given term patterns match
   the current redex. The implementation, which is provided as ML source text,
   needs to be of type
   \<^ML_type>\<open>morphism -> Proof.context -> cterm -> thm option\<close>, where the
   \<^ML_type>\<open>cterm\<close> represents the current redex \<open>r\<close> and the result is supposed
   to be some proven rewrite rule \<open>r \<equiv> r'\<close> (or a generalized version), or \<^ML>\<open>NONE\<close> to indicate failure. The \<^ML_type>\<open>Proof.context\<close> argument holds the
   full context of the current Simplifier invocation. The \<^ML_type>\<open>morphism\<close>
   informs about the difference of the original compilation context wrt.\ the
   one of the actual application later on.
 
   Morphisms are only relevant for simprocs that are defined within a local
   target context, e.g.\ in a locale.
 
   \<^descr> \<open>simproc add: name\<close> and \<open>simproc del: name\<close> add or delete named simprocs
   to the current Simplifier context. The default is to add a simproc. Note
   that @{command "simproc_setup"} already adds the new simproc to the
   subsequent context.
 \<close>
 
 
 subsubsection \<open>Example\<close>
 
 text \<open>
   The following simplification procedure for @{thm [source = false,
   show_types] unit_eq} in HOL performs fine-grained control over rule
   application, beyond higher-order pattern matching. Declaring @{thm unit_eq}
   as @{attribute simp} directly would make the Simplifier loop! Note that a
   version of this simplification procedure is already active in Isabelle/HOL.
 \<close>
 
 (*<*)experiment begin(*>*)
 simproc_setup unit ("x::unit") =
   \<open>fn _ => fn _ => fn ct =>
     if HOLogic.is_unit (Thm.term_of ct) then NONE
     else SOME (mk_meta_eq @{thm unit_eq})\<close>
 (*<*)end(*>*)
 
 text \<open>
   Since the Simplifier applies simplification procedures frequently, it is
   important to make the failure check in ML reasonably fast.\<close>
 
 
 subsection \<open>Configurable Simplifier strategies \label{sec:simp-strategies}\<close>
 
 text \<open>
   The core term-rewriting engine of the Simplifier is normally used in
   combination with some add-on components that modify the strategy and allow
   to integrate other non-Simplifier proof tools. These may be reconfigured in
   ML as explained below. Even if the default strategies of object-logics like
   Isabelle/HOL are used unchanged, it helps to understand how the standard
   Simplifier strategies work.\<close>
 
 
 subsubsection \<open>The subgoaler\<close>
 
 text \<open>
   \begin{mldecls}
   @{define_ML Simplifier.set_subgoaler: "(Proof.context -> int -> tactic) ->
   Proof.context -> Proof.context"} \\
   @{define_ML Simplifier.prems_of: "Proof.context -> thm list"} \\
   \end{mldecls}
 
   The subgoaler is the tactic used to solve subgoals arising out of
   conditional rewrite rules or congruence rules. The default should be
   simplification itself. In rare situations, this strategy may need to be
   changed. For example, if the premise of a conditional rule is an instance of
   its conclusion, as in \<open>Suc ?m < ?n \<Longrightarrow> ?m < ?n\<close>, the default strategy could
   loop. % FIXME !??
 
     \<^descr> \<^ML>\<open>Simplifier.set_subgoaler\<close>~\<open>tac ctxt\<close> sets the subgoaler of the
     context to \<open>tac\<close>. The tactic will be applied to the context of the running
     Simplifier instance.
 
     \<^descr> \<^ML>\<open>Simplifier.prems_of\<close>~\<open>ctxt\<close> retrieves the current set of premises
     from the context. This may be non-empty only if the Simplifier has been
     told to utilize local assumptions in the first place (cf.\ the options in
     \secref{sec:simp-meth}).
 
   As an example, consider the following alternative subgoaler:
 \<close>
 
 ML_val \<open>
   fun subgoaler_tac ctxt =
     assume_tac ctxt ORELSE'
     resolve_tac ctxt (Simplifier.prems_of ctxt) ORELSE'
     asm_simp_tac ctxt
 \<close>
 
 text \<open>
   This tactic first tries to solve the subgoal by assumption or by resolving
   with with one of the premises, calling simplification only if that fails.\<close>
 
 
 subsubsection \<open>The solver\<close>
 
 text \<open>
   \begin{mldecls}
   @{define_ML_type solver} \\
   @{define_ML Simplifier.mk_solver: "string ->
   (Proof.context -> int -> tactic) -> solver"} \\
   @{define_ML_infix setSolver: "Proof.context * solver -> Proof.context"} \\
   @{define_ML_infix addSolver: "Proof.context * solver -> Proof.context"} \\
   @{define_ML_infix setSSolver: "Proof.context * solver -> Proof.context"} \\
   @{define_ML_infix addSSolver: "Proof.context * solver -> Proof.context"} \\
   \end{mldecls}
 
   A solver is a tactic that attempts to solve a subgoal after simplification.
   Its core functionality is to prove trivial subgoals such as \<^prop>\<open>True\<close>
   and \<open>t = t\<close>, but object-logics might be more ambitious. For example,
   Isabelle/HOL performs a restricted version of linear arithmetic here.
 
   Solvers are packaged up in abstract type \<^ML_type>\<open>solver\<close>, with \<^ML>\<open>Simplifier.mk_solver\<close> as the only operation to create a solver.
 
   \<^medskip>
   Rewriting does not instantiate unknowns. For example, rewriting alone cannot
   prove \<open>a \<in> ?A\<close> since this requires instantiating \<open>?A\<close>. The solver, however,
   is an arbitrary tactic and may instantiate unknowns as it pleases. This is
   the only way the Simplifier can handle a conditional rewrite rule whose
   condition contains extra variables. When a simplification tactic is to be
   combined with other provers, especially with the Classical Reasoner, it is
   important whether it can be considered safe or not. For this reason a
   simpset contains two solvers: safe and unsafe.
 
   The standard simplification strategy solely uses the unsafe solver, which is
   appropriate in most cases. For special applications where the simplification
   process is not allowed to instantiate unknowns within the goal,
   simplification starts with the safe solver, but may still apply the ordinary
   unsafe one in nested simplifications for conditional rules or congruences.
   Note that in this way the overall tactic is not totally safe: it may
   instantiate unknowns that appear also in other subgoals.
 
   \<^descr> \<^ML>\<open>Simplifier.mk_solver\<close>~\<open>name tac\<close> turns \<open>tac\<close> into a solver; the
   \<open>name\<close> is only attached as a comment and has no further significance.
 
   \<^descr> \<open>ctxt setSSolver solver\<close> installs \<open>solver\<close> as the safe solver of \<open>ctxt\<close>.
 
   \<^descr> \<open>ctxt addSSolver solver\<close> adds \<open>solver\<close> as an additional safe solver; it
   will be tried after the solvers which had already been present in \<open>ctxt\<close>.
 
   \<^descr> \<open>ctxt setSolver solver\<close> installs \<open>solver\<close> as the unsafe solver of \<open>ctxt\<close>.
 
   \<^descr> \<open>ctxt addSolver solver\<close> adds \<open>solver\<close> as an additional unsafe solver; it
   will be tried after the solvers which had already been present in \<open>ctxt\<close>.
 
 
   \<^medskip>
   The solver tactic is invoked with the context of the running Simplifier.
   Further operations may be used to retrieve relevant information, such as the
   list of local Simplifier premises via \<^ML>\<open>Simplifier.prems_of\<close> --- this
   list may be non-empty only if the Simplifier runs in a mode that utilizes
   local assumptions (see also \secref{sec:simp-meth}). The solver is also
   presented the full goal including its assumptions in any case. Thus it can
   use these (e.g.\ by calling \<^ML>\<open>assume_tac\<close>), even if the Simplifier proper
   happens to ignore local premises at the moment.
 
   \<^medskip>
   As explained before, the subgoaler is also used to solve the premises of
   congruence rules. These are usually of the form \<open>s = ?x\<close>, where \<open>s\<close> needs to
   be simplified and \<open>?x\<close> needs to be instantiated with the result. Typically,
   the subgoaler will invoke the Simplifier at some point, which will
   eventually call the solver. For this reason, solver tactics must be prepared
   to solve goals of the form \<open>t = ?x\<close>, usually by reflexivity. In particular,
   reflexivity should be tried before any of the fancy automated proof tools.
 
   It may even happen that due to simplification the subgoal is no longer an
   equality. For example, \<open>False \<longleftrightarrow> ?Q\<close> could be rewritten to \<open>\<not> ?Q\<close>. To cover
   this case, the solver could try resolving with the theorem \<open>\<not> False\<close> of the
   object-logic.
 
   \<^medskip>
   \begin{warn}
   If a premise of a congruence rule cannot be proved, then the congruence is
   ignored. This should only happen if the rule is \<^emph>\<open>conditional\<close> --- that is,
   contains premises not of the form \<open>t = ?x\<close>. Otherwise it indicates that some
   congruence rule, or possibly the subgoaler or solver, is faulty.
   \end{warn}
 \<close>
 
 
 subsubsection \<open>The looper\<close>
 
 text \<open>
   \begin{mldecls}
   @{define_ML_infix setloop: "Proof.context *
   (Proof.context -> int -> tactic) -> Proof.context"} \\
   @{define_ML_infix addloop: "Proof.context *
   (string * (Proof.context -> int -> tactic))
   -> Proof.context"} \\
   @{define_ML_infix delloop: "Proof.context * string -> Proof.context"} \\
   @{define_ML Splitter.add_split: "thm -> Proof.context -> Proof.context"} \\
   @{define_ML Splitter.add_split: "thm -> Proof.context -> Proof.context"} \\
   @{define_ML Splitter.add_split_bang: "
   thm -> Proof.context -> Proof.context"} \\
   @{define_ML Splitter.del_split: "thm -> Proof.context -> Proof.context"} \\
   \end{mldecls}
 
   The looper is a list of tactics that are applied after simplification, in
   case the solver failed to solve the simplified goal. If the looper succeeds,
   the simplification process is started all over again. Each of the subgoals
   generated by the looper is attacked in turn, in reverse order.
 
   A typical looper is \<^emph>\<open>case splitting\<close>: the expansion of a conditional.
   Another possibility is to apply an elimination rule on the assumptions. More
   adventurous loopers could start an induction.
 
     \<^descr> \<open>ctxt setloop tac\<close> installs \<open>tac\<close> as the only looper tactic of \<open>ctxt\<close>.
 
     \<^descr> \<open>ctxt addloop (name, tac)\<close> adds \<open>tac\<close> as an additional looper tactic
     with name \<open>name\<close>, which is significant for managing the collection of
     loopers. The tactic will be tried after the looper tactics that had
     already been present in \<open>ctxt\<close>.
 
     \<^descr> \<open>ctxt delloop name\<close> deletes the looper tactic that was associated with
     \<open>name\<close> from \<open>ctxt\<close>.
 
     \<^descr> \<^ML>\<open>Splitter.add_split\<close>~\<open>thm ctxt\<close> adds split tactic
     for \<open>thm\<close> as additional looper tactic of \<open>ctxt\<close>
     (overwriting previous split tactic for the same constant).
 
     \<^descr> \<^ML>\<open>Splitter.add_split_bang\<close>~\<open>thm ctxt\<close> adds aggressive
     (see \S\ref{sec:simp-meth})
     split tactic for \<open>thm\<close> as additional looper tactic of \<open>ctxt\<close>
     (overwriting previous split tactic for the same constant).
 
     \<^descr> \<^ML>\<open>Splitter.del_split\<close>~\<open>thm ctxt\<close> deletes the split tactic
     corresponding to \<open>thm\<close> from the looper tactics of \<open>ctxt\<close>.
 
   The splitter replaces applications of a given function; the right-hand side
   of the replacement can be anything. For example, here is a splitting rule
   for conditional expressions:
 
   @{text [display] "?P (if ?Q ?x ?y) \<longleftrightarrow> (?Q \<longrightarrow> ?P ?x) \<and> (\<not> ?Q \<longrightarrow> ?P ?y)"}
 
   Another example is the elimination operator for Cartesian products (which
   happens to be called \<^const>\<open>case_prod\<close> in Isabelle/HOL:
 
   @{text [display] "?P (case_prod ?f ?p) \<longleftrightarrow> (\<forall>a b. ?p = (a, b) \<longrightarrow> ?P (f a b))"}
 
   For technical reasons, there is a distinction between case splitting in the
   conclusion and in the premises of a subgoal. The former is done by \<^ML>\<open>Splitter.split_tac\<close> with rules like @{thm [source] if_split} or @{thm
   [source] option.split}, which do not split the subgoal, while the latter is
   done by \<^ML>\<open>Splitter.split_asm_tac\<close> with rules like @{thm [source]
   if_split_asm} or @{thm [source] option.split_asm}, which split the subgoal.
   The function \<^ML>\<open>Splitter.add_split\<close> automatically takes care of which
   tactic to call, analyzing the form of the rules given as argument; it is the
   same operation behind \<open>split\<close> attribute or method modifier syntax in the
   Isar source language.
 
   Case splits should be allowed only when necessary; they are expensive and
   hard to control. Case-splitting on if-expressions in the conclusion is
   usually beneficial, so it is enabled by default in Isabelle/HOL and
   Isabelle/FOL/ZF.
 
   \begin{warn}
   With \<^ML>\<open>Splitter.split_asm_tac\<close> as looper component, the Simplifier may
   split subgoals! This might cause unexpected problems in tactic expressions
   that silently assume 0 or 1 subgoals after simplification.
   \end{warn}
 \<close>
 
 
 subsection \<open>Forward simplification \label{sec:simp-forward}\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{attribute_def simplified} & : & \<open>attribute\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     @@{attribute simplified} opt? @{syntax thms}?
     ;
 
     opt: '(' ('no_asm' | 'no_asm_simp' | 'no_asm_use') ')'
   \<close>
 
   \<^descr> @{attribute simplified}~\<open>a\<^sub>1 \<dots> a\<^sub>n\<close> causes a theorem to be simplified,
   either by exactly the specified rules \<open>a\<^sub>1, \<dots>, a\<^sub>n\<close>, or the implicit
   Simplifier context if no arguments are given. The result is fully simplified
   by default, including assumptions and conclusion; the options \<open>no_asm\<close> etc.\
   tune the Simplifier in the same way as the for the \<open>simp\<close> method.
 
   Note that forward simplification restricts the Simplifier to its most basic
   operation of term rewriting; solver and looper tactics
   (\secref{sec:simp-strategies}) are \<^emph>\<open>not\<close> involved here. The @{attribute
   simplified} attribute should be only rarely required under normal
   circumstances.
 \<close>
 
 
 section \<open>The Classical Reasoner \label{sec:classical}\<close>
 
 subsection \<open>Basic concepts\<close>
 
 text \<open>Although Isabelle is generic, many users will be working in
   some extension of classical first-order logic.  Isabelle/ZF is built
   upon theory FOL, while Isabelle/HOL conceptually contains
   first-order logic as a fragment.  Theorem-proving in predicate logic
   is undecidable, but many automated strategies have been developed to
   assist in this task.
 
   Isabelle's classical reasoner is a generic package that accepts
   certain information about a logic and delivers a suite of automatic
   proof tools, based on rules that are classified and declared in the
   context.  These proof procedures are slow and simplistic compared
   with high-end automated theorem provers, but they can save
   considerable time and effort in practice.  They can prove theorems
-  such as Pelletier's @{cite pelletier86} problems 40 and 41 in a few
+  such as Pelletier's \<^cite>\<open>pelletier86\<close> problems 40 and 41 in a few
   milliseconds (including full proof reconstruction):\<close>
 
 lemma "(\<exists>y. \<forall>x. F x y \<longleftrightarrow> F x x) \<longrightarrow> \<not> (\<forall>x. \<exists>y. \<forall>z. F z y \<longleftrightarrow> \<not> F z x)"
   by blast
 
 lemma "(\<forall>z. \<exists>y. \<forall>x. f x y \<longleftrightarrow> f x z \<and> \<not> f x x) \<longrightarrow> \<not> (\<exists>z. \<forall>x. f x z)"
   by blast
 
 text \<open>The proof tools are generic.  They are not restricted to
   first-order logic, and have been heavily used in the development of
   the Isabelle/HOL library and applications.  The tactics can be
   traced, and their components can be called directly; in this manner,
   any proof can be viewed interactively.\<close>
 
 
 subsubsection \<open>The sequent calculus\<close>
 
 text \<open>Isabelle supports natural deduction, which is easy to use for
   interactive proof.  But natural deduction does not easily lend
   itself to automation, and has a bias towards intuitionism.  For
   certain proofs in classical logic, it can not be called natural.
   The \<^emph>\<open>sequent calculus\<close>, a generalization of natural deduction,
   is easier to automate.
 
   A \<^bold>\<open>sequent\<close> has the form \<open>\<Gamma> \<turnstile> \<Delta>\<close>, where \<open>\<Gamma>\<close>
   and \<open>\<Delta>\<close> are sets of formulae.\<^footnote>\<open>For first-order
   logic, sequents can equivalently be made from lists or multisets of
   formulae.\<close> The sequent \<open>P\<^sub>1, \<dots>, P\<^sub>m \<turnstile> Q\<^sub>1, \<dots>, Q\<^sub>n\<close> is
   \<^bold>\<open>valid\<close> if \<open>P\<^sub>1 \<and> \<dots> \<and> P\<^sub>m\<close> implies \<open>Q\<^sub>1 \<or> \<dots> \<or>
   Q\<^sub>n\<close>.  Thus \<open>P\<^sub>1, \<dots>, P\<^sub>m\<close> represent assumptions, each of which
   is true, while \<open>Q\<^sub>1, \<dots>, Q\<^sub>n\<close> represent alternative goals.  A
   sequent is \<^bold>\<open>basic\<close> if its left and right sides have a common
   formula, as in \<open>P, Q \<turnstile> Q, R\<close>; basic sequents are trivially
   valid.
 
   Sequent rules are classified as \<^bold>\<open>right\<close> or \<^bold>\<open>left\<close>,
   indicating which side of the \<open>\<turnstile>\<close> symbol they operate on.
   Rules that operate on the right side are analogous to natural
   deduction's introduction rules, and left rules are analogous to
   elimination rules.  The sequent calculus analogue of \<open>(\<longrightarrow>I)\<close>
   is the rule
   \[
   \infer[\<open>(\<longrightarrow>R)\<close>]{\<open>\<Gamma> \<turnstile> \<Delta>, P \<longrightarrow> Q\<close>}{\<open>P, \<Gamma> \<turnstile> \<Delta>, Q\<close>}
   \]
   Applying the rule backwards, this breaks down some implication on
   the right side of a sequent; \<open>\<Gamma>\<close> and \<open>\<Delta>\<close> stand for
   the sets of formulae that are unaffected by the inference.  The
   analogue of the pair \<open>(\<or>I1)\<close> and \<open>(\<or>I2)\<close> is the
   single rule
   \[
   \infer[\<open>(\<or>R)\<close>]{\<open>\<Gamma> \<turnstile> \<Delta>, P \<or> Q\<close>}{\<open>\<Gamma> \<turnstile> \<Delta>, P, Q\<close>}
   \]
   This breaks down some disjunction on the right side, replacing it by
   both disjuncts.  Thus, the sequent calculus is a kind of
   multiple-conclusion logic.
 
   To illustrate the use of multiple formulae on the right, let us
   prove the classical theorem \<open>(P \<longrightarrow> Q) \<or> (Q \<longrightarrow> P)\<close>.  Working
   backwards, we reduce this formula to a basic sequent:
   \[
   \infer[\<open>(\<or>R)\<close>]{\<open>\<turnstile> (P \<longrightarrow> Q) \<or> (Q \<longrightarrow> P)\<close>}
     {\infer[\<open>(\<longrightarrow>R)\<close>]{\<open>\<turnstile> (P \<longrightarrow> Q), (Q \<longrightarrow> P)\<close>}
       {\infer[\<open>(\<longrightarrow>R)\<close>]{\<open>P \<turnstile> Q, (Q \<longrightarrow> P)\<close>}
         {\<open>P, Q \<turnstile> Q, P\<close>}}}
   \]
 
   This example is typical of the sequent calculus: start with the
   desired theorem and apply rules backwards in a fairly arbitrary
   manner.  This yields a surprisingly effective proof procedure.
   Quantifiers add only few complications, since Isabelle handles
-  parameters and schematic variables.  See @{cite \<open>Chapter 10\<close>
-  "paulson-ml2"} for further discussion.\<close>
+  parameters and schematic variables.  See \<^cite>\<open>\<open>Chapter 10\<close> in
+  "paulson-ml2"\<close> for further discussion.\<close>
 
 
 subsubsection \<open>Simulating sequents by natural deduction\<close>
 
 text \<open>Isabelle can represent sequents directly, as in the
   object-logic LK.  But natural deduction is easier to work with, and
   most object-logics employ it.  Fortunately, we can simulate the
   sequent \<open>P\<^sub>1, \<dots>, P\<^sub>m \<turnstile> Q\<^sub>1, \<dots>, Q\<^sub>n\<close> by the Isabelle formula
   \<open>P\<^sub>1 \<Longrightarrow> \<dots> \<Longrightarrow> P\<^sub>m \<Longrightarrow> \<not> Q\<^sub>2 \<Longrightarrow> ... \<Longrightarrow> \<not> Q\<^sub>n \<Longrightarrow> Q\<^sub>1\<close> where the order of
   the assumptions and the choice of \<open>Q\<^sub>1\<close> are arbitrary.
   Elim-resolution plays a key role in simulating sequent proofs.
 
   We can easily handle reasoning on the left.  Elim-resolution with
   the rules \<open>(\<or>E)\<close>, \<open>(\<bottom>E)\<close> and \<open>(\<exists>E)\<close> achieves
   a similar effect as the corresponding sequent rules.  For the other
   connectives, we use sequent-style elimination rules instead of
   destruction rules such as \<open>(\<and>E1, 2)\<close> and \<open>(\<forall>E)\<close>.
   But note that the rule \<open>(\<not>L)\<close> has no effect under our
   representation of sequents!
   \[
   \infer[\<open>(\<not>L)\<close>]{\<open>\<not> P, \<Gamma> \<turnstile> \<Delta>\<close>}{\<open>\<Gamma> \<turnstile> \<Delta>, P\<close>}
   \]
 
   What about reasoning on the right?  Introduction rules can only
   affect the formula in the conclusion, namely \<open>Q\<^sub>1\<close>.  The
   other right-side formulae are represented as negated assumptions,
   \<open>\<not> Q\<^sub>2, \<dots>, \<not> Q\<^sub>n\<close>.  In order to operate on one of these, it
   must first be exchanged with \<open>Q\<^sub>1\<close>.  Elim-resolution with the
   \<open>swap\<close> rule has this effect: \<open>\<not> P \<Longrightarrow> (\<not> R \<Longrightarrow> P) \<Longrightarrow> R\<close>
 
   To ensure that swaps occur only when necessary, each introduction
   rule is converted into a swapped form: it is resolved with the
   second premise of \<open>(swap)\<close>.  The swapped form of \<open>(\<and>I)\<close>, which might be called \<open>(\<not>\<and>E)\<close>, is
   @{text [display] "\<not> (P \<and> Q) \<Longrightarrow> (\<not> R \<Longrightarrow> P) \<Longrightarrow> (\<not> R \<Longrightarrow> Q) \<Longrightarrow> R"}
 
   Similarly, the swapped form of \<open>(\<longrightarrow>I)\<close> is
   @{text [display] "\<not> (P \<longrightarrow> Q) \<Longrightarrow> (\<not> R \<Longrightarrow> P \<Longrightarrow> Q) \<Longrightarrow> R"}
 
   Swapped introduction rules are applied using elim-resolution, which
   deletes the negated formula.  Our representation of sequents also
   requires the use of ordinary introduction rules.  If we had no
   regard for readability of intermediate goal states, we could treat
   the right side more uniformly by representing sequents as @{text
   [display] "P\<^sub>1 \<Longrightarrow> \<dots> \<Longrightarrow> P\<^sub>m \<Longrightarrow> \<not> Q\<^sub>1 \<Longrightarrow> \<dots> \<Longrightarrow> \<not> Q\<^sub>n \<Longrightarrow> \<bottom>"}
 \<close>
 
 
 subsubsection \<open>Extra rules for the sequent calculus\<close>
 
 text \<open>As mentioned, destruction rules such as \<open>(\<and>E1, 2)\<close> and
   \<open>(\<forall>E)\<close> must be replaced by sequent-style elimination rules.
   In addition, we need rules to embody the classical equivalence
   between \<open>P \<longrightarrow> Q\<close> and \<open>\<not> P \<or> Q\<close>.  The introduction
   rules \<open>(\<or>I1, 2)\<close> are replaced by a rule that simulates
   \<open>(\<or>R)\<close>: @{text [display] "(\<not> Q \<Longrightarrow> P) \<Longrightarrow> P \<or> Q"}
 
   The destruction rule \<open>(\<longrightarrow>E)\<close> is replaced by @{text [display]
   "(P \<longrightarrow> Q) \<Longrightarrow> (\<not> P \<Longrightarrow> R) \<Longrightarrow> (Q \<Longrightarrow> R) \<Longrightarrow> R"}
 
   Quantifier replication also requires special rules.  In classical
   logic, \<open>\<exists>x. P x\<close> is equivalent to \<open>\<not> (\<forall>x. \<not> P x)\<close>;
   the rules \<open>(\<exists>R)\<close> and \<open>(\<forall>L)\<close> are dual:
   \[
   \infer[\<open>(\<exists>R)\<close>]{\<open>\<Gamma> \<turnstile> \<Delta>, \<exists>x. P x\<close>}{\<open>\<Gamma> \<turnstile> \<Delta>, \<exists>x. P x, P t\<close>}
   \qquad
   \infer[\<open>(\<forall>L)\<close>]{\<open>\<forall>x. P x, \<Gamma> \<turnstile> \<Delta>\<close>}{\<open>P t, \<forall>x. P x, \<Gamma> \<turnstile> \<Delta>\<close>}
   \]
   Thus both kinds of quantifier may be replicated.  Theorems requiring
   multiple uses of a universal formula are easy to invent; consider
   @{text [display] "(\<forall>x. P x \<longrightarrow> P (f x)) \<and> P a \<longrightarrow> P (f\<^sup>n a)"} for any
   \<open>n > 1\<close>.  Natural examples of the multiple use of an
   existential formula are rare; a standard one is \<open>\<exists>x. \<forall>y. P x
   \<longrightarrow> P y\<close>.
 
   Forgoing quantifier replication loses completeness, but gains
   decidability, since the search space becomes finite.  Many useful
   theorems can be proved without replication, and the search generally
   delivers its verdict in a reasonable time.  To adopt this approach,
   represent the sequent rules \<open>(\<exists>R)\<close>, \<open>(\<exists>L)\<close> and
   \<open>(\<forall>R)\<close> by \<open>(\<exists>I)\<close>, \<open>(\<exists>E)\<close> and \<open>(\<forall>I)\<close>,
   respectively, and put \<open>(\<forall>E)\<close> into elimination form: @{text
   [display] "\<forall>x. P x \<Longrightarrow> (P t \<Longrightarrow> Q) \<Longrightarrow> Q"}
 
   Elim-resolution with this rule will delete the universal formula
   after a single use.  To replicate universal quantifiers, replace the
   rule by @{text [display] "\<forall>x. P x \<Longrightarrow> (P t \<Longrightarrow> \<forall>x. P x \<Longrightarrow> Q) \<Longrightarrow> Q"}
 
   To replicate existential quantifiers, replace \<open>(\<exists>I)\<close> by
   @{text [display] "(\<not> (\<exists>x. P x) \<Longrightarrow> P t) \<Longrightarrow> \<exists>x. P x"}
 
   All introduction rules mentioned above are also useful in swapped
   form.
 
   Replication makes the search space infinite; we must apply the rules
   with care.  The classical reasoner distinguishes between safe and
   unsafe rules, applying the latter only when there is no alternative.
   Depth-first search may well go down a blind alley; best-first search
   is better behaved in an infinite search space.  However, quantifier
   replication is too expensive to prove any but the simplest theorems.
 \<close>
 
 
 subsection \<open>Rule declarations\<close>
 
 text \<open>The proof tools of the Classical Reasoner depend on
   collections of rules declared in the context, which are classified
   as introduction, elimination or destruction and as \<^emph>\<open>safe\<close> or
   \<^emph>\<open>unsafe\<close>.  In general, safe rules can be attempted blindly,
   while unsafe rules must be used with care.  A safe rule must never
   reduce a provable goal to an unprovable set of subgoals.
 
   The rule \<open>P \<Longrightarrow> P \<or> Q\<close> is unsafe because it reduces \<open>P
   \<or> Q\<close> to \<open>P\<close>, which might turn out as premature choice of an
   unprovable subgoal.  Any rule whose premises contain new unknowns is
   unsafe. The elimination rule \<open>\<forall>x. P x \<Longrightarrow> (P t \<Longrightarrow> Q) \<Longrightarrow> Q\<close> is
   unsafe, since it is applied via elim-resolution, which discards the
   assumption \<open>\<forall>x. P x\<close> and replaces it by the weaker
   assumption \<open>P t\<close>.  The rule \<open>P t \<Longrightarrow> \<exists>x. P x\<close> is
   unsafe for similar reasons.  The quantifier duplication rule \<open>\<forall>x. P x \<Longrightarrow> (P t \<Longrightarrow> \<forall>x. P x \<Longrightarrow> Q) \<Longrightarrow> Q\<close> is unsafe in a different sense:
   since it keeps the assumption \<open>\<forall>x. P x\<close>, it is prone to
   looping.  In classical first-order logic, all rules are safe except
   those mentioned above.
 
   The safe~/ unsafe distinction is vague, and may be regarded merely
   as a way of giving some rules priority over others.  One could argue
   that \<open>(\<or>E)\<close> is unsafe, because repeated application of it
   could generate exponentially many subgoals.  Induction rules are
   unsafe because inductive proofs are difficult to set up
   automatically.  Any inference that instantiates an unknown
   in the proof state is unsafe --- thus matching must be used, rather than
   unification.  Even proof by assumption is unsafe if it instantiates
   unknowns shared with other subgoals.
 
   \begin{matharray}{rcl}
     @{command_def "print_claset"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
     @{attribute_def intro} & : & \<open>attribute\<close> \\
     @{attribute_def elim} & : & \<open>attribute\<close> \\
     @{attribute_def dest} & : & \<open>attribute\<close> \\
     @{attribute_def rule} & : & \<open>attribute\<close> \\
     @{attribute_def iff} & : & \<open>attribute\<close> \\
     @{attribute_def swapped} & : & \<open>attribute\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     (@@{attribute intro} | @@{attribute elim} | @@{attribute dest}) ('!' | () | '?') @{syntax nat}?
     ;
     @@{attribute rule} 'del'
     ;
     @@{attribute iff} (((() | 'add') '?'?) | 'del')
   \<close>
 
   \<^descr> @{command "print_claset"} prints the collection of rules
   declared to the Classical Reasoner, i.e.\ the \<^ML_type>\<open>claset\<close>
   within the context.
 
   \<^descr> @{attribute intro}, @{attribute elim}, and @{attribute dest}
   declare introduction, elimination, and destruction rules,
   respectively.  By default, rules are considered as \<^emph>\<open>unsafe\<close>
   (i.e.\ not applied blindly without backtracking), while ``\<open>!\<close>'' classifies as \<^emph>\<open>safe\<close>.  Rule declarations marked by
   ``\<open>?\<close>'' coincide with those of Isabelle/Pure, cf.\
   \secref{sec:pure-meth-att} (i.e.\ are only applied in single steps
   of the @{method rule} method).  The optional natural number
   specifies an explicit weight argument, which is ignored by the
   automated reasoning tools, but determines the search order of single
   rule steps.
 
   Introduction rules are those that can be applied using ordinary
   resolution.  Their swapped forms are generated internally, which
   will be applied using elim-resolution.  Elimination rules are
   applied using elim-resolution.  Rules are sorted by the number of
   new subgoals they will yield; rules that generate the fewest
   subgoals will be tried first.  Otherwise, later declarations take
   precedence over earlier ones.
 
   Rules already present in the context with the same classification
   are ignored.  A warning is printed if the rule has already been
   added with some other classification, but the rule is added anyway
   as requested.
 
   \<^descr> @{attribute rule}~\<open>del\<close> deletes all occurrences of a
   rule from the classical context, regardless of its classification as
   introduction~/ elimination~/ destruction and safe~/ unsafe.
 
   \<^descr> @{attribute iff} declares logical equivalences to the
   Simplifier and the Classical reasoner at the same time.
   Non-conditional rules result in a safe introduction and elimination
   pair; conditional ones are considered unsafe.  Rules with negative
   conclusion are automatically inverted (using \<open>\<not>\<close>-elimination
   internally).
 
   The ``\<open>?\<close>'' version of @{attribute iff} declares rules to
   the Isabelle/Pure context only, and omits the Simplifier
   declaration.
 
   \<^descr> @{attribute swapped} turns an introduction rule into an
   elimination, by resolving with the classical swap principle \<open>\<not> P \<Longrightarrow> (\<not> R \<Longrightarrow> P) \<Longrightarrow> R\<close> in the second position.  This is mainly for
   illustrative purposes: the Classical Reasoner already swaps rules
   internally as explained above.
 \<close>
 
 
 subsection \<open>Structured methods\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{method_def rule} & : & \<open>method\<close> \\
     @{method_def contradiction} & : & \<open>method\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     @@{method rule} @{syntax thms}?
   \<close>
 
   \<^descr> @{method rule} as offered by the Classical Reasoner is a
   refinement over the Pure one (see \secref{sec:pure-meth-att}).  Both
   versions work the same, but the classical version observes the
   classical rule context in addition to that of Isabelle/Pure.
 
   Common object logics (HOL, ZF, etc.) declare a rich collection of
   classical rules (even if these would qualify as intuitionistic
   ones), but only few declarations to the rule context of
   Isabelle/Pure (\secref{sec:pure-meth-att}).
 
   \<^descr> @{method contradiction} solves some goal by contradiction,
   deriving any result from both \<open>\<not> A\<close> and \<open>A\<close>.  Chained
   facts, which are guaranteed to participate, may appear in either
   order.
 \<close>
 
 
 subsection \<open>Fully automated methods\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{method_def blast} & : & \<open>method\<close> \\
     @{method_def auto} & : & \<open>method\<close> \\
     @{method_def force} & : & \<open>method\<close> \\
     @{method_def fast} & : & \<open>method\<close> \\
     @{method_def slow} & : & \<open>method\<close> \\
     @{method_def best} & : & \<open>method\<close> \\
     @{method_def fastforce} & : & \<open>method\<close> \\
     @{method_def slowsimp} & : & \<open>method\<close> \\
     @{method_def bestsimp} & : & \<open>method\<close> \\
     @{method_def deepen} & : & \<open>method\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     @@{method blast} @{syntax nat}? (@{syntax clamod} * )
     ;
     @@{method auto} (@{syntax nat} @{syntax nat})? (@{syntax clasimpmod} * )
     ;
     @@{method force} (@{syntax clasimpmod} * )
     ;
     (@@{method fast} | @@{method slow} | @@{method best}) (@{syntax clamod} * )
     ;
     (@@{method fastforce} | @@{method slowsimp} | @@{method bestsimp})
       (@{syntax clasimpmod} * )
     ;
     @@{method deepen} (@{syntax nat} ?) (@{syntax clamod} * )
     ;
     @{syntax_def clamod}:
       (('intro' | 'elim' | 'dest') ('!' | () | '?') | 'del') ':' @{syntax thms}
     ;
     @{syntax_def clasimpmod}: ('simp' (() | 'add' | 'del' | 'only') |
       'cong' (() | 'add' | 'del') |
       'split' (() | '!' | 'del') |
       'iff' (((() | 'add') '?'?) | 'del') |
       (('intro' | 'elim' | 'dest') ('!' | () | '?') | 'del')) ':' @{syntax thms}
   \<close>
 
   \<^descr> @{method blast} is a separate classical tableau prover that
   uses the same classical rule declarations as explained before.
 
   Proof search is coded directly in ML using special data structures.
   A successful proof is then reconstructed using regular Isabelle
   inferences.  It is faster and more powerful than the other classical
   reasoning tools, but has major limitations too.
 
     \<^item> It does not use the classical wrapper tacticals, such as the
     integration with the Simplifier of @{method fastforce}.
 
     \<^item> It does not perform higher-order unification, as needed by the
     rule @{thm [source=false] rangeI} in HOL.  There are often
     alternatives to such rules, for example @{thm [source=false]
     range_eqI}.
 
     \<^item> Function variables may only be applied to parameters of the
     subgoal.  (This restriction arises because the prover does not use
     higher-order unification.)  If other function variables are present
     then the prover will fail with the message
     @{verbatim [display] \<open>Function unknown's argument not a bound variable\<close>}
 
     \<^item> Its proof strategy is more general than @{method fast} but can
     be slower.  If @{method blast} fails or seems to be running forever,
     try @{method fast} and the other proof tools described below.
 
   The optional integer argument specifies a bound for the number of
   unsafe steps used in a proof.  By default, @{method blast} starts
   with a bound of 0 and increases it successively to 20.  In contrast,
   \<open>(blast lim)\<close> tries to prove the goal using a search bound
   of \<open>lim\<close>.  Sometimes a slow proof using @{method blast} can
   be made much faster by supplying the successful search bound to this
   proof method instead.
 
   \<^descr> @{method auto} combines classical reasoning with
   simplification.  It is intended for situations where there are a lot
   of mostly trivial subgoals; it proves all the easy ones, leaving the
   ones it cannot prove.  Occasionally, attempting to prove the hard
   ones may take a long time.
 
   The optional depth arguments in \<open>(auto m n)\<close> refer to its
   builtin classical reasoning procedures: \<open>m\<close> (default 4) is for
   @{method blast}, which is tried first, and \<open>n\<close> (default 2) is
   for a slower but more general alternative that also takes wrappers
   into account.
 
   \<^descr> @{method force} is intended to prove the first subgoal
   completely, using many fancy proof tools and performing a rather
   exhaustive search.  As a result, proof attempts may take rather long
   or diverge easily.
 
   \<^descr> @{method fast}, @{method best}, @{method slow} attempt to
   prove the first subgoal using sequent-style reasoning as explained
   before.  Unlike @{method blast}, they construct proofs directly in
   Isabelle.
 
   There is a difference in search strategy and back-tracking: @{method
   fast} uses depth-first search and @{method best} uses best-first
   search (guided by a heuristic function: normally the total size of
   the proof state).
 
   Method @{method slow} is like @{method fast}, but conducts a broader
   search: it may, when backtracking from a failed proof attempt, undo
   even the step of proving a subgoal by assumption.
 
   \<^descr> @{method fastforce}, @{method slowsimp}, @{method bestsimp}
   are like @{method fast}, @{method slow}, @{method best},
   respectively, but use the Simplifier as additional wrapper. The name
   @{method fastforce}, reflects the behaviour of this popular method
   better without requiring an understanding of its implementation.
 
   \<^descr> @{method deepen} works by exhaustive search up to a certain
   depth.  The start depth is 4 (unless specified explicitly), and the
   depth is increased iteratively up to 10.  Unsafe rules are modified
   to preserve the formula they act on, so that it be used repeatedly.
   This method can prove more goals than @{method fast}, but is much
   slower, for example if the assumptions have many universal
   quantifiers.
 
 
   Any of the above methods support additional modifiers of the context
   of classical (and simplifier) rules, but the ones related to the
   Simplifier are explicitly prefixed by \<open>simp\<close> here.  The
   semantics of these ad-hoc rule declarations is analogous to the
   attributes given before.  Facts provided by forward chaining are
   inserted into the goal before commencing proof search.
 \<close>
 
 
 subsection \<open>Partially automated methods\label{sec:classical:partial}\<close>
 
 text \<open>These proof methods may help in situations when the
   fully-automated tools fail.  The result is a simpler subgoal that
   can be tackled by other means, such as by manual instantiation of
   quantifiers.
 
   \begin{matharray}{rcl}
     @{method_def safe} & : & \<open>method\<close> \\
     @{method_def clarify} & : & \<open>method\<close> \\
     @{method_def clarsimp} & : & \<open>method\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     (@@{method safe} | @@{method clarify}) (@{syntax clamod} * )
     ;
     @@{method clarsimp} (@{syntax clasimpmod} * )
   \<close>
 
   \<^descr> @{method safe} repeatedly performs safe steps on all subgoals.
   It is deterministic, with at most one outcome.
 
   \<^descr> @{method clarify} performs a series of safe steps without
   splitting subgoals; see also @{method clarify_step}.
 
   \<^descr> @{method clarsimp} acts like @{method clarify}, but also does
   simplification.  Note that if the Simplifier context includes a
   splitter for the premises, the subgoal may still be split.
 \<close>
 
 
 subsection \<open>Single-step tactics\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{method_def safe_step} & : & \<open>method\<close> \\
     @{method_def inst_step} & : & \<open>method\<close> \\
     @{method_def step} & : & \<open>method\<close> \\
     @{method_def slow_step} & : & \<open>method\<close> \\
     @{method_def clarify_step} & : &  \<open>method\<close> \\
   \end{matharray}
 
   These are the primitive tactics behind the automated proof methods
   of the Classical Reasoner.  By calling them yourself, you can
   execute these procedures one step at a time.
 
   \<^descr> @{method safe_step} performs a safe step on the first subgoal.
   The safe wrapper tacticals are applied to a tactic that may include
   proof by assumption or Modus Ponens (taking care not to instantiate
   unknowns), or substitution.
 
   \<^descr> @{method inst_step} is like @{method safe_step}, but allows
   unknowns to be instantiated.
 
   \<^descr> @{method step} is the basic step of the proof procedure, it
   operates on the first subgoal.  The unsafe wrapper tacticals are
   applied to a tactic that tries @{method safe}, @{method inst_step},
   or applies an unsafe rule from the context.
 
   \<^descr> @{method slow_step} resembles @{method step}, but allows
   backtracking between using safe rules with instantiation (@{method
   inst_step}) and using unsafe rules.  The resulting search space is
   larger.
 
   \<^descr> @{method clarify_step} performs a safe step on the first
   subgoal; no splitting step is applied.  For example, the subgoal
   \<open>A \<and> B\<close> is left as a conjunction.  Proof by assumption,
   Modus Ponens, etc., may be performed provided they do not
   instantiate unknowns.  Assumptions of the form \<open>x = t\<close> may
   be eliminated.  The safe wrapper tactical is applied.
 \<close>
 
 
 subsection \<open>Modifying the search step\<close>
 
 text \<open>
   \begin{mldecls}
     @{define_ML_type wrapper = "(int -> tactic) -> (int -> tactic)"} \\[0.5ex]
     @{define_ML_infix addSWrapper: "Proof.context *
   (string * (Proof.context -> wrapper)) -> Proof.context"} \\
     @{define_ML_infix addSbefore: "Proof.context *
   (string * (Proof.context -> int -> tactic)) -> Proof.context"} \\
     @{define_ML_infix addSafter: "Proof.context *
   (string * (Proof.context -> int -> tactic)) -> Proof.context"} \\
     @{define_ML_infix delSWrapper: "Proof.context * string -> Proof.context"} \\[0.5ex]
     @{define_ML_infix addWrapper: "Proof.context *
   (string * (Proof.context -> wrapper)) -> Proof.context"} \\
     @{define_ML_infix addbefore: "Proof.context *
   (string * (Proof.context -> int -> tactic)) -> Proof.context"} \\
     @{define_ML_infix addafter: "Proof.context *
   (string * (Proof.context -> int -> tactic)) -> Proof.context"} \\
     @{define_ML_infix delWrapper: "Proof.context * string -> Proof.context"} \\[0.5ex]
     @{define_ML addSss: "Proof.context -> Proof.context"} \\
     @{define_ML addss: "Proof.context -> Proof.context"} \\
   \end{mldecls}
 
   The proof strategy of the Classical Reasoner is simple.  Perform as
   many safe inferences as possible; or else, apply certain safe rules,
   allowing instantiation of unknowns; or else, apply an unsafe rule.
   The tactics also eliminate assumptions of the form \<open>x = t\<close>
   by substitution if they have been set up to do so.  They may perform
   a form of Modus Ponens: if there are assumptions \<open>P \<longrightarrow> Q\<close> and
   \<open>P\<close>, then replace \<open>P \<longrightarrow> Q\<close> by \<open>Q\<close>.
 
   The classical reasoning tools --- except @{method blast} --- allow
   to modify this basic proof strategy by applying two lists of
   arbitrary \<^emph>\<open>wrapper tacticals\<close> to it.  The first wrapper list,
   which is considered to contain safe wrappers only, affects @{method
   safe_step} and all the tactics that call it.  The second one, which
   may contain unsafe wrappers, affects the unsafe parts of @{method
   step}, @{method slow_step}, and the tactics that call them.  A
   wrapper transforms each step of the search, for example by
   attempting other tactics before or after the original step tactic.
   All members of a wrapper list are applied in turn to the respective
   step tactic.
 
   Initially the two wrapper lists are empty, which means no
   modification of the step tactics. Safe and unsafe wrappers are added
   to the context with the functions given below, supplying them with
   wrapper names.  These names may be used to selectively delete
   wrappers.
 
   \<^descr> \<open>ctxt addSWrapper (name, wrapper)\<close> adds a new wrapper,
   which should yield a safe tactic, to modify the existing safe step
   tactic.
 
   \<^descr> \<open>ctxt addSbefore (name, tac)\<close> adds the given tactic as a
   safe wrapper, such that it is tried \<^emph>\<open>before\<close> each safe step of
   the search.
 
   \<^descr> \<open>ctxt addSafter (name, tac)\<close> adds the given tactic as a
   safe wrapper, such that it is tried when a safe step of the search
   would fail.
 
   \<^descr> \<open>ctxt delSWrapper name\<close> deletes the safe wrapper with
   the given name.
 
   \<^descr> \<open>ctxt addWrapper (name, wrapper)\<close> adds a new wrapper to
   modify the existing (unsafe) step tactic.
 
   \<^descr> \<open>ctxt addbefore (name, tac)\<close> adds the given tactic as an
   unsafe wrapper, such that it its result is concatenated
   \<^emph>\<open>before\<close> the result of each unsafe step.
 
   \<^descr> \<open>ctxt addafter (name, tac)\<close> adds the given tactic as an
   unsafe wrapper, such that it its result is concatenated \<^emph>\<open>after\<close>
   the result of each unsafe step.
 
   \<^descr> \<open>ctxt delWrapper name\<close> deletes the unsafe wrapper with
   the given name.
 
   \<^descr> \<open>addSss\<close> adds the simpset of the context to its
   classical set. The assumptions and goal will be simplified, in a
   rather safe way, after each safe step of the search.
 
   \<^descr> \<open>addss\<close> adds the simpset of the context to its
   classical set. The assumptions and goal will be simplified, before
   the each unsafe step of the search.
 \<close>
 
 
 section \<open>Object-logic setup \label{sec:object-logic}\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{command_def "judgment"} & : & \<open>theory \<rightarrow> theory\<close> \\
     @{method_def atomize} & : & \<open>method\<close> \\
     @{attribute_def atomize} & : & \<open>attribute\<close> \\
     @{attribute_def rule_format} & : & \<open>attribute\<close> \\
     @{attribute_def rulify} & : & \<open>attribute\<close> \\
   \end{matharray}
 
   The very starting point for any Isabelle object-logic is a ``truth
   judgment'' that links object-level statements to the meta-logic
   (with its minimal language of \<open>prop\<close> that covers universal
   quantification \<open>\<And>\<close> and implication \<open>\<Longrightarrow>\<close>).
 
   Common object-logics are sufficiently expressive to internalize rule
   statements over \<open>\<And>\<close> and \<open>\<Longrightarrow>\<close> within their own
   language.  This is useful in certain situations where a rule needs
   to be viewed as an atomic statement from the meta-level perspective,
   e.g.\ \<open>\<And>x. x \<in> A \<Longrightarrow> P x\<close> versus \<open>\<forall>x \<in> A. P x\<close>.
 
   From the following language elements, only the @{method atomize}
   method and @{attribute rule_format} attribute are occasionally
   required by end-users, the rest is for those who need to setup their
   own object-logic.  In the latter case existing formulations of
   Isabelle/FOL or Isabelle/HOL may be taken as realistic examples.
 
   Generic tools may refer to the information provided by object-logic
   declarations internally.
 
   \<^rail>\<open>
     @@{command judgment} @{syntax name} '::' @{syntax type} @{syntax mixfix}?
     ;
     @@{attribute atomize} ('(' 'full' ')')?
     ;
     @@{attribute rule_format} ('(' 'noasm' ')')?
   \<close>
 
   \<^descr> @{command "judgment"}~\<open>c :: \<sigma> (mx)\<close> declares constant
   \<open>c\<close> as the truth judgment of the current object-logic.  Its
   type \<open>\<sigma>\<close> should specify a coercion of the category of
   object-level propositions to \<open>prop\<close> of the Pure meta-logic;
   the mixfix annotation \<open>(mx)\<close> would typically just link the
   object language (internally of syntactic category \<open>logic\<close>)
   with that of \<open>prop\<close>.  Only one @{command "judgment"}
   declaration may be given in any theory development.
   
   \<^descr> @{method atomize} (as a method) rewrites any non-atomic
   premises of a sub-goal, using the meta-level equations declared via
   @{attribute atomize} (as an attribute) beforehand.  As a result,
   heavily nested goals become amenable to fundamental operations such
   as resolution (cf.\ the @{method (Pure) rule} method).  Giving the ``\<open>(full)\<close>'' option here means to turn the whole subgoal into an
   object-statement (if possible), including the outermost parameters
   and assumptions as well.
 
   A typical collection of @{attribute atomize} rules for a particular
   object-logic would provide an internalization for each of the
   connectives of \<open>\<And>\<close>, \<open>\<Longrightarrow>\<close>, and \<open>\<equiv>\<close>.
   Meta-level conjunction should be covered as well (this is
   particularly important for locales, see \secref{sec:locale}).
 
   \<^descr> @{attribute rule_format} rewrites a theorem by the equalities
   declared as @{attribute rulify} rules in the current object-logic.
   By default, the result is fully normalized, including assumptions
   and conclusions at any depth.  The \<open>(no_asm)\<close> option
   restricts the transformation to the conclusion of a rule.
 
   In common object-logics (HOL, FOL, ZF), the effect of @{attribute
   rule_format} is to replace (bounded) universal quantification
   (\<open>\<forall>\<close>) and implication (\<open>\<longrightarrow>\<close>) by the corresponding
   rule statements over \<open>\<And>\<close> and \<open>\<Longrightarrow>\<close>.
 \<close>
 
 
 section \<open>Tracing higher-order unification\<close>
 
 text \<open>
   \begin{tabular}{rcll}
     @{attribute_def unify_trace_simp} & : & \<open>attribute\<close> & default \<open>false\<close> \\
     @{attribute_def unify_trace_types} & : & \<open>attribute\<close> & default \<open>false\<close> \\
     @{attribute_def unify_trace_bound} & : & \<open>attribute\<close> & default \<open>50\<close> \\
     @{attribute_def unify_search_bound} & : & \<open>attribute\<close> & default \<open>60\<close> \\
   \end{tabular}
   \<^medskip>
 
   Higher-order unification works well in most practical situations,
   but sometimes needs extra care to identify problems.  These tracing
   options may help.
 
   \<^descr> @{attribute unify_trace_simp} controls tracing of the
   simplification phase of higher-order unification.
 
   \<^descr> @{attribute unify_trace_types} controls warnings of
   incompleteness, when unification is not considering all possible
   instantiations of schematic type variables.
 
   \<^descr> @{attribute unify_trace_bound} determines the depth where
   unification starts to print tracing information once it reaches
   depth; 0 for full tracing.  At the default value, tracing
   information is almost never printed in practice.
 
   \<^descr> @{attribute unify_search_bound} prevents unification from
   searching past the given depth.  Because of this bound, higher-order
   unification cannot return an infinite sequence, though it can return
   an exponentially long one.  The search rarely approaches the default
   value in practice.  If the search is cut off, unification prints a
   warning ``Unification bound exceeded''.
 
 
   \begin{warn}
   Options for unification cannot be modified in a local context.  Only
   the global theory content is taken into account.
   \end{warn}
 \<close>
 
 end
diff --git a/src/Doc/Isar_Ref/HOL_Specific.thy b/src/Doc/Isar_Ref/HOL_Specific.thy
--- a/src/Doc/Isar_Ref/HOL_Specific.thy
+++ b/src/Doc/Isar_Ref/HOL_Specific.thy
@@ -1,2518 +1,2510 @@
 (*:maxLineLen=78:*)
 
 theory HOL_Specific
   imports
     Main
     "HOL-Library.Old_Datatype"
     "HOL-Library.Old_Recdef"
     "HOL-Library.Adhoc_Overloading"
     "HOL-Library.Dlist"
     "HOL-Library.FSet"
     Base
 begin
 
 
 chapter \<open>Higher-Order Logic\<close>
 
 text \<open>
   Isabelle/HOL is based on Higher-Order Logic, a polymorphic version of
   Church's Simple Theory of Types. HOL can be best understood as a
   simply-typed version of classical set theory. The logic was first
-  implemented in Gordon's HOL system @{cite "mgordon-hol"}. It extends
-  Church's original logic @{cite "church40"} by explicit type variables (naive
+  implemented in Gordon's HOL system \<^cite>\<open>"mgordon-hol"\<close>. It extends
+  Church's original logic \<^cite>\<open>"church40"\<close> by explicit type variables (naive
   polymorphism) and a sound axiomatization scheme for new types based on
   subsets of existing types.
 
-  Andrews's book @{cite andrews86} is a full description of the original
+  Andrews's book \<^cite>\<open>andrews86\<close> is a full description of the original
   Church-style higher-order logic, with proofs of correctness and completeness
   wrt.\ certain set-theoretic interpretations. The particular extensions of
   Gordon-style HOL are explained semantically in two chapters of the 1993 HOL
-  book @{cite pitts93}.
+  book \<^cite>\<open>pitts93\<close>.
 
   Experience with HOL over decades has demonstrated that higher-order logic is
   widely applicable in many areas of mathematics and computer science. In a
   sense, Higher-Order Logic is simpler than First-Order Logic, because there
   are fewer restrictions and special cases. Note that HOL is \<^emph>\<open>weaker\<close> than
   FOL with axioms for ZF set theory, which is traditionally considered the
   standard foundation of regular mathematics, but for most applications this
   does not matter. If you prefer ML to Lisp, you will probably prefer HOL to
   ZF.
 
   \<^medskip> The syntax of HOL follows \<open>\<lambda>\<close>-calculus and functional programming.
   Function application is curried. To apply the function \<open>f\<close> of type \<open>\<tau>\<^sub>1 \<Rightarrow>
   \<tau>\<^sub>2 \<Rightarrow> \<tau>\<^sub>3\<close> to the arguments \<open>a\<close> and \<open>b\<close> in HOL, you simply write \<open>f a b\<close> (as
   in ML or Haskell). There is no ``apply'' operator; the existing application
   of the Pure \<open>\<lambda>\<close>-calculus is re-used. Note that in HOL \<open>f (a, b)\<close> means ``\<open>f\<close>
   applied to the pair \<open>(a, b)\<close> (which is notation for \<open>Pair a b\<close>). The latter
   typically introduces extra formal efforts that can be avoided by currying
   functions by default. Explicit tuples are as infrequent in HOL
   formalizations as in good ML or Haskell programs.
 
   \<^medskip> Isabelle/HOL has a distinct feel, compared to other object-logics like
   Isabelle/ZF. It identifies object-level types with meta-level types, taking
   advantage of the default type-inference mechanism of Isabelle/Pure. HOL
   fully identifies object-level functions with meta-level functions, with
   native abstraction and application.
 
   These identifications allow Isabelle to support HOL particularly nicely, but
   they also mean that HOL requires some sophistication from the user. In
   particular, an understanding of Hindley-Milner type-inference with
   type-classes, which are both used extensively in the standard libraries and
   applications.
 \<close>
 
 
 chapter \<open>Derived specification elements\<close>
 
 section \<open>Inductive and coinductive definitions \label{sec:hol-inductive}\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{command_def (HOL) "inductive"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
     @{command_def (HOL) "inductive_set"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
     @{command_def (HOL) "coinductive"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
     @{command_def (HOL) "coinductive_set"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
     @{command_def "print_inductives"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
     @{attribute_def (HOL) mono} & : & \<open>attribute\<close> \\
   \end{matharray}
 
   An \<^emph>\<open>inductive definition\<close> specifies the least predicate or set \<open>R\<close> closed
   under given rules: applying a rule to elements of \<open>R\<close> yields a result within
   \<open>R\<close>. For example, a structural operational semantics is an inductive
   definition of an evaluation relation.
 
   Dually, a \<^emph>\<open>coinductive definition\<close> specifies the greatest predicate or set
   \<open>R\<close> that is consistent with given rules: every element of \<open>R\<close> can be seen as
   arising by applying a rule to elements of \<open>R\<close>. An important example is using
   bisimulation relations to formalise equivalence of processes and infinite
   data structures.
 
   Both inductive and coinductive definitions are based on the Knaster-Tarski
   fixed-point theorem for complete lattices. The collection of introduction
   rules given by the user determines a functor on subsets of set-theoretic
   relations. The required monotonicity of the recursion scheme is proven as a
   prerequisite to the fixed-point definition and the resulting consequences.
   This works by pushing inclusion through logical connectives and any other
   operator that might be wrapped around recursive occurrences of the defined
   relation: there must be a monotonicity theorem of the form \<open>A \<le> B \<Longrightarrow> \<M> A \<le> \<M>
   B\<close>, for each premise \<open>\<M> R t\<close> in an introduction rule. The default rule
   declarations of Isabelle/HOL already take care of most common situations.
 
   \<^rail>\<open>
     (@@{command (HOL) inductive} | @@{command (HOL) inductive_set} |
       @@{command (HOL) coinductive} | @@{command (HOL) coinductive_set})
       @{syntax vars} @{syntax for_fixes} \<newline>
       (@'where' @{syntax multi_specs})? (@'monos' @{syntax thms})?
     ;
     @@{command print_inductives} ('!'?)
     ;
     @@{attribute (HOL) mono} (() | 'add' | 'del')
   \<close>
 
   \<^descr> @{command (HOL) "inductive"} and @{command (HOL) "coinductive"} define
   (co)inductive predicates from the introduction rules.
 
   The propositions given as \<open>clauses\<close> in the @{keyword "where"} part are
   either rules of the usual \<open>\<And>/\<Longrightarrow>\<close> format (with arbitrary nesting), or
   equalities using \<open>\<equiv>\<close>. The latter specifies extra-logical abbreviations in
   the sense of @{command_ref abbreviation}. Introducing abstract syntax
   simultaneously with the actual introduction rules is occasionally useful for
   complex specifications.
 
   The optional @{keyword "for"} part contains a list of parameters of the
   (co)inductive predicates that remain fixed throughout the definition, in
   contrast to arguments of the relation that may vary in each occurrence
   within the given \<open>clauses\<close>.
 
   The optional @{keyword "monos"} declaration contains additional
   \<^emph>\<open>monotonicity theorems\<close>, which are required for each operator applied to a
   recursive set in the introduction rules.
 
   \<^descr> @{command (HOL) "inductive_set"} and @{command (HOL) "coinductive_set"}
   are wrappers for to the previous commands for native HOL predicates. This
   allows to define (co)inductive sets, where multiple arguments are simulated
   via tuples.
 
   \<^descr> @{command "print_inductives"} prints (co)inductive definitions and
   monotonicity rules; the ``\<open>!\<close>'' option indicates extra verbosity.
 
   \<^descr> @{attribute (HOL) mono} declares monotonicity rules in the context. These
   rule are involved in the automated monotonicity proof of the above inductive
   and coinductive definitions.
 \<close>
 
 
 subsection \<open>Derived rules\<close>
 
 text \<open>
   A (co)inductive definition of \<open>R\<close> provides the following main theorems:
 
   \<^descr> \<open>R.intros\<close> is the list of introduction rules as proven theorems, for the
   recursive predicates (or sets). The rules are also available individually,
   using the names given them in the theory file;
 
   \<^descr> \<open>R.cases\<close> is the case analysis (or elimination) rule;
 
   \<^descr> \<open>R.induct\<close> or \<open>R.coinduct\<close> is the (co)induction rule;
 
   \<^descr> \<open>R.simps\<close> is the equation unrolling the fixpoint of the predicate one
   step.
 
 
   When several predicates \<open>R\<^sub>1, \<dots>, R\<^sub>n\<close> are defined simultaneously, the list
   of introduction rules is called \<open>R\<^sub>1_\<dots>_R\<^sub>n.intros\<close>, the case analysis rules
   are called \<open>R\<^sub>1.cases, \<dots>, R\<^sub>n.cases\<close>, and the list of mutual induction rules
   is called \<open>R\<^sub>1_\<dots>_R\<^sub>n.inducts\<close>.
 \<close>
 
 
 subsection \<open>Monotonicity theorems\<close>
 
 text \<open>
   The context maintains a default set of theorems that are used in
   monotonicity proofs. New rules can be declared via the @{attribute (HOL)
   mono} attribute. See the main Isabelle/HOL sources for some examples. The
   general format of such monotonicity theorems is as follows:
 
   \<^item> Theorems of the form \<open>A \<le> B \<Longrightarrow> \<M> A \<le> \<M> B\<close>, for proving monotonicity of
   inductive definitions whose introduction rules have premises involving terms
   such as \<open>\<M> R t\<close>.
 
   \<^item> Monotonicity theorems for logical operators, which are of the general form
   \<open>(\<dots> \<longrightarrow> \<dots>) \<Longrightarrow> \<dots> (\<dots> \<longrightarrow> \<dots>) \<Longrightarrow> \<dots> \<longrightarrow> \<dots>\<close>. For example, in the case of the operator \<open>\<or>\<close>,
   the corresponding theorem is
   \[
   \infer{\<open>P\<^sub>1 \<or> P\<^sub>2 \<longrightarrow> Q\<^sub>1 \<or> Q\<^sub>2\<close>}{\<open>P\<^sub>1 \<longrightarrow> Q\<^sub>1\<close> & \<open>P\<^sub>2 \<longrightarrow> Q\<^sub>2\<close>}
   \]
 
   \<^item> De Morgan style equations for reasoning about the ``polarity'' of
   expressions, e.g.
   \[
   \<^prop>\<open>\<not> \<not> P \<longleftrightarrow> P\<close> \qquad\qquad
   \<^prop>\<open>\<not> (P \<and> Q) \<longleftrightarrow> \<not> P \<or> \<not> Q\<close>
   \]
 
   \<^item> Equations for reducing complex operators to more primitive ones whose
   monotonicity can easily be proved, e.g.
   \[
   \<^prop>\<open>(P \<longrightarrow> Q) \<longleftrightarrow> \<not> P \<or> Q\<close> \qquad\qquad
   \<^prop>\<open>Ball A P \<equiv> \<forall>x. x \<in> A \<longrightarrow> P x\<close>
   \]
 \<close>
 
 
 subsubsection \<open>Examples\<close>
 
 text \<open>The finite powerset operator can be defined inductively like this:\<close>
 
 (*<*)experiment begin(*>*)
 inductive_set Fin :: "'a set \<Rightarrow> 'a set set" for A :: "'a set"
 where
   empty: "{} \<in> Fin A"
 | insert: "a \<in> A \<Longrightarrow> B \<in> Fin A \<Longrightarrow> insert a B \<in> Fin A"
 
 text \<open>The accessible part of a relation is defined as follows:\<close>
 
 inductive acc :: "('a \<Rightarrow> 'a \<Rightarrow> bool) \<Rightarrow> 'a \<Rightarrow> bool"
   for r :: "'a \<Rightarrow> 'a \<Rightarrow> bool"  (infix "\<prec>" 50)
 where acc: "(\<And>y. y \<prec> x \<Longrightarrow> acc r y) \<Longrightarrow> acc r x"
 (*<*)end(*>*)
 
 text \<open>
   Common logical connectives can be easily characterized as non-recursive
   inductive definitions with parameters, but without arguments.
 \<close>
 
 (*<*)experiment begin(*>*)
 inductive AND for A B :: bool
 where "A \<Longrightarrow> B \<Longrightarrow> AND A B"
 
 inductive OR for A B :: bool
 where "A \<Longrightarrow> OR A B"
   | "B \<Longrightarrow> OR A B"
 
 inductive EXISTS for B :: "'a \<Rightarrow> bool"
 where "B a \<Longrightarrow> EXISTS B"
 (*<*)end(*>*)
 
 text \<open>
   Here the \<open>cases\<close> or \<open>induct\<close> rules produced by the @{command inductive}
   package coincide with the expected elimination rules for Natural Deduction.
-  Already in the original article by Gerhard Gentzen @{cite "Gentzen:1935"}
+  Already in the original article by Gerhard Gentzen \<^cite>\<open>"Gentzen:1935"\<close>
   there is a hint that each connective can be characterized by its
   introductions, and the elimination can be constructed systematically.
 \<close>
 
 
 section \<open>Recursive functions \label{sec:recursion}\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{command_def (HOL) "primrec"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
     @{command_def (HOL) "fun"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
     @{command_def (HOL) "function"} & : & \<open>local_theory \<rightarrow> proof(prove)\<close> \\
     @{command_def (HOL) "termination"} & : & \<open>local_theory \<rightarrow> proof(prove)\<close> \\
     @{command_def (HOL) "fun_cases"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     @@{command (HOL) primrec} @{syntax specification}
     ;
     (@@{command (HOL) fun} | @@{command (HOL) function}) opts? @{syntax specification}
     ;
     opts: '(' (('sequential' | 'domintros') + ',') ')'
     ;
     @@{command (HOL) termination} @{syntax term}?
     ;
     @@{command (HOL) fun_cases} (@{syntax thmdecl}? @{syntax prop} + @'and')
   \<close>
 
   \<^descr> @{command (HOL) "primrec"} defines primitive recursive functions over
   datatypes (see also @{command_ref (HOL) datatype}). The given \<open>equations\<close>
   specify reduction rules that are produced by instantiating the generic
   combinator for primitive recursion that is available for each datatype.
 
   Each equation needs to be of the form:
 
   @{text [display] "f x\<^sub>1 \<dots> x\<^sub>m (C y\<^sub>1 \<dots> y\<^sub>k) z\<^sub>1 \<dots> z\<^sub>n = rhs"}
 
   such that \<open>C\<close> is a datatype constructor, \<open>rhs\<close> contains only the free
   variables on the left-hand side (or from the context), and all recursive
   occurrences of \<open>f\<close> in \<open>rhs\<close> are of the form \<open>f \<dots> y\<^sub>i \<dots>\<close> for some \<open>i\<close>. At
   most one reduction rule for each constructor can be given. The order does
   not matter. For missing constructors, the function is defined to return a
   default value, but this equation is made difficult to access for users.
 
   The reduction rules are declared as @{attribute simp} by default, which
   enables standard proof methods like @{method simp} and @{method auto} to
   normalize expressions of \<open>f\<close> applied to datatype constructions, by
   simulating symbolic computation via rewriting.
 
   \<^descr> @{command (HOL) "function"} defines functions by general wellfounded
-  recursion. A detailed description with examples can be found in @{cite
-  "isabelle-function"}. The function is specified by a set of (possibly
+  recursion. A detailed description with examples can be found in \<^cite>\<open>"isabelle-function"\<close>. The function is specified by a set of (possibly
   conditional) recursive equations with arbitrary pattern matching. The
   command generates proof obligations for the completeness and the
   compatibility of patterns.
 
   The defined function is considered partial, and the resulting simplification
   rules (named \<open>f.psimps\<close>) and induction rule (named \<open>f.pinduct\<close>) are guarded
   by a generated domain predicate \<open>f_dom\<close>. The @{command (HOL) "termination"}
   command can then be used to establish that the function is total.
 
   \<^descr> @{command (HOL) "fun"} is a shorthand notation for ``@{command (HOL)
   "function"}~\<open>(sequential)\<close>'', followed by automated proof attempts regarding
-  pattern matching and termination. See @{cite "isabelle-function"} for
+  pattern matching and termination. See \<^cite>\<open>"isabelle-function"\<close> for
   further details.
 
   \<^descr> @{command (HOL) "termination"}~\<open>f\<close> commences a termination proof for the
   previously defined function \<open>f\<close>. If this is omitted, the command refers to
   the most recent function definition. After the proof is closed, the
   recursive equations and the induction principle is established.
 
   \<^descr> @{command (HOL) "fun_cases"} generates specialized elimination rules for
   function equations. It expects one or more function equations and produces
   rules that eliminate the given equalities, following the cases given in the
   function definition.
 
 
   Recursive definitions introduced by the @{command (HOL) "function"} command
   accommodate reasoning by induction (cf.\ @{method induct}): rule \<open>f.induct\<close>
   refers to a specific induction rule, with parameters named according to the
   user-specified equations. Cases are numbered starting from 1. For @{command
   (HOL) "primrec"}, the induction principle coincides with structural
   recursion on the datatype where the recursion is carried out.
 
   The equations provided by these packages may be referred later as theorem
   list \<open>f.simps\<close>, where \<open>f\<close> is the (collective) name of the functions defined.
   Individual equations may be named explicitly as well.
 
   The @{command (HOL) "function"} command accepts the following options.
 
   \<^descr> \<open>sequential\<close> enables a preprocessor which disambiguates overlapping
   patterns by making them mutually disjoint. Earlier equations take precedence
   over later ones. This allows to give the specification in a format very
   similar to functional programming. Note that the resulting simplification
   and induction rules correspond to the transformed specification, not the one
   given originally. This usually means that each equation given by the user
   may result in several theorems. Also note that this automatic transformation
   only works for ML-style datatype patterns.
 
   \<^descr> \<open>domintros\<close> enables the automated generation of introduction rules for the
   domain predicate. While mostly not needed, they can be helpful in some
   proofs about partial functions.
 \<close>
 
 
 subsubsection \<open>Example: evaluation of expressions\<close>
 
 text \<open>
   Subsequently, we define mutual datatypes for arithmetic and boolean
   expressions, and use @{command primrec} for evaluation functions that follow
   the same recursive structure.
 \<close>
 
 (*<*)experiment begin(*>*)
 datatype 'a aexp =
     IF "'a bexp"  "'a aexp"  "'a aexp"
   | Sum "'a aexp"  "'a aexp"
   | Diff "'a aexp"  "'a aexp"
   | Var 'a
   | Num nat
 and 'a bexp =
     Less "'a aexp"  "'a aexp"
   | And "'a bexp"  "'a bexp"
   | Neg "'a bexp"
 
 text \<open>\<^medskip> Evaluation of arithmetic and boolean expressions\<close>
 
 primrec evala :: "('a \<Rightarrow> nat) \<Rightarrow> 'a aexp \<Rightarrow> nat"
   and evalb :: "('a \<Rightarrow> nat) \<Rightarrow> 'a bexp \<Rightarrow> bool"
 where
   "evala env (IF b a1 a2) = (if evalb env b then evala env a1 else evala env a2)"
 | "evala env (Sum a1 a2) = evala env a1 + evala env a2"
 | "evala env (Diff a1 a2) = evala env a1 - evala env a2"
 | "evala env (Var v) = env v"
 | "evala env (Num n) = n"
 | "evalb env (Less a1 a2) = (evala env a1 < evala env a2)"
 | "evalb env (And b1 b2) = (evalb env b1 \<and> evalb env b2)"
 | "evalb env (Neg b) = (\<not> evalb env b)"
 
 text \<open>
   Since the value of an expression depends on the value of its variables, the
   functions \<^const>\<open>evala\<close> and \<^const>\<open>evalb\<close> take an additional parameter, an
   \<^emph>\<open>environment\<close> that maps variables to their values.
 
   \<^medskip>
   Substitution on expressions can be defined similarly. The mapping \<open>f\<close> of
   type \<^typ>\<open>'a \<Rightarrow> 'a aexp\<close> given as a parameter is lifted canonically on the
   types \<^typ>\<open>'a aexp\<close> and \<^typ>\<open>'a bexp\<close>, respectively.
 \<close>
 
 primrec substa :: "('a \<Rightarrow> 'b aexp) \<Rightarrow> 'a aexp \<Rightarrow> 'b aexp"
   and substb :: "('a \<Rightarrow> 'b aexp) \<Rightarrow> 'a bexp \<Rightarrow> 'b bexp"
 where
   "substa f (IF b a1 a2) = IF (substb f b) (substa f a1) (substa f a2)"
 | "substa f (Sum a1 a2) = Sum (substa f a1) (substa f a2)"
 | "substa f (Diff a1 a2) = Diff (substa f a1) (substa f a2)"
 | "substa f (Var v) = f v"
 | "substa f (Num n) = Num n"
 | "substb f (Less a1 a2) = Less (substa f a1) (substa f a2)"
 | "substb f (And b1 b2) = And (substb f b1) (substb f b2)"
 | "substb f (Neg b) = Neg (substb f b)"
 
 text \<open>
   In textbooks about semantics one often finds substitution theorems, which
   express the relationship between substitution and evaluation. For \<^typ>\<open>'a
   aexp\<close> and \<^typ>\<open>'a bexp\<close>, we can prove such a theorem by mutual
   induction, followed by simplification.
 \<close>
 
 lemma subst_one:
   "evala env (substa (Var (v := a')) a) = evala (env (v := evala env a')) a"
   "evalb env (substb (Var (v := a')) b) = evalb (env (v := evala env a')) b"
   by (induct a and b) simp_all
 
 lemma subst_all:
   "evala env (substa s a) = evala (\<lambda>x. evala env (s x)) a"
   "evalb env (substb s b) = evalb (\<lambda>x. evala env (s x)) b"
   by (induct a and b) simp_all
 (*<*)end(*>*)
 
 
 subsubsection \<open>Example: a substitution function for terms\<close>
 
 text \<open>Functions on datatypes with nested recursion are also defined
   by mutual primitive recursion.\<close>
 
 (*<*)experiment begin(*>*)
 datatype ('a, 'b) "term" = Var 'a | App 'b "('a, 'b) term list"
 
 text \<open>
   A substitution function on type \<^typ>\<open>('a, 'b) term\<close> can be defined as
   follows, by working simultaneously on \<^typ>\<open>('a, 'b) term list\<close>:
 \<close>
 
 primrec subst_term :: "('a \<Rightarrow> ('a, 'b) term) \<Rightarrow> ('a, 'b) term \<Rightarrow> ('a, 'b) term" and
   subst_term_list :: "('a \<Rightarrow> ('a, 'b) term) \<Rightarrow> ('a, 'b) term list \<Rightarrow> ('a, 'b) term list"
 where
   "subst_term f (Var a) = f a"
 | "subst_term f (App b ts) = App b (subst_term_list f ts)"
 | "subst_term_list f [] = []"
 | "subst_term_list f (t # ts) = subst_term f t # subst_term_list f ts"
 
 text \<open>
   The recursion scheme follows the structure of the unfolded definition of
   type \<^typ>\<open>('a, 'b) term\<close>. To prove properties of this substitution
   function, mutual induction is needed:
 \<close>
 
 lemma "subst_term (subst_term f1 \<circ> f2) t =
     subst_term f1 (subst_term f2 t)" and
   "subst_term_list (subst_term f1 \<circ> f2) ts =
     subst_term_list f1 (subst_term_list f2 ts)"
   by (induct t and ts rule: subst_term.induct subst_term_list.induct) simp_all
 (*<*)end(*>*)
 
 
 subsubsection \<open>Example: a map function for infinitely branching trees\<close>
 
 text \<open>Defining functions on infinitely branching datatypes by primitive
   recursion is just as easy.\<close>
 
 (*<*)experiment begin(*>*)
 datatype 'a tree = Atom 'a | Branch "nat \<Rightarrow> 'a tree"
 
 primrec map_tree :: "('a \<Rightarrow> 'b) \<Rightarrow> 'a tree \<Rightarrow> 'b tree"
 where
   "map_tree f (Atom a) = Atom (f a)"
 | "map_tree f (Branch ts) = Branch (\<lambda>x. map_tree f (ts x))"
 
 text \<open>
   Note that all occurrences of functions such as \<open>ts\<close> above must be applied to
   an argument. In particular, \<^term>\<open>map_tree f \<circ> ts\<close> is not allowed here.
 
   \<^medskip>
   Here is a simple composition lemma for \<^term>\<open>map_tree\<close>:
 \<close>
 
 lemma "map_tree g (map_tree f t) = map_tree (g \<circ> f) t"
   by (induct t) simp_all
 (*<*)end(*>*)
 
 
 subsection \<open>Proof methods related to recursive definitions\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{method_def (HOL) pat_completeness} & : & \<open>method\<close> \\
     @{method_def (HOL) relation} & : & \<open>method\<close> \\
     @{method_def (HOL) lexicographic_order} & : & \<open>method\<close> \\
     @{method_def (HOL) size_change} & : & \<open>method\<close> \\
     @{attribute_def (HOL) termination_simp} & : & \<open>attribute\<close> \\
     @{method_def (HOL) induction_schema} & : & \<open>method\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     @@{method (HOL) relation} @{syntax term}
     ;
     @@{method (HOL) lexicographic_order} (@{syntax clasimpmod} * )
     ;
     @@{method (HOL) size_change} ( orders (@{syntax clasimpmod} * ) )
     ;
     @@{method (HOL) induction_schema}
     ;
     orders: ( 'max' | 'min' | 'ms' ) *
   \<close>
 
   \<^descr> @{method (HOL) pat_completeness} is a specialized method to solve goals
   regarding the completeness of pattern matching, as required by the @{command
-  (HOL) "function"} package (cf.\ @{cite "isabelle-function"}).
+  (HOL) "function"} package (cf.\ \<^cite>\<open>"isabelle-function"\<close>).
 
   \<^descr> @{method (HOL) relation}~\<open>R\<close> introduces a termination proof using the
   relation \<open>R\<close>. The resulting proof state will contain goals expressing that
   \<open>R\<close> is wellfounded, and that the arguments of recursive calls decrease with
   respect to \<open>R\<close>. Usually, this method is used as the initial proof step of
   manual termination proofs.
 
   \<^descr> @{method (HOL) "lexicographic_order"} attempts a fully automated
   termination proof by searching for a lexicographic combination of size
   measures on the arguments of the function. The method accepts the same
   arguments as the @{method auto} method, which it uses internally to prove
   local descents. The @{syntax clasimpmod} modifiers are accepted (as for
   @{method auto}).
 
   In case of failure, extensive information is printed, which can help to
-  analyse the situation (cf.\ @{cite "isabelle-function"}).
+  analyse the situation (cf.\ \<^cite>\<open>"isabelle-function"\<close>).
 
   \<^descr> @{method (HOL) "size_change"} also works on termination goals, using a
   variation of the size-change principle, together with a graph decomposition
-  technique (see @{cite krauss_phd} for details). Three kinds of orders are
+  technique (see \<^cite>\<open>krauss_phd\<close> for details). Three kinds of orders are
   used internally: \<open>max\<close>, \<open>min\<close>, and \<open>ms\<close> (multiset), which is only available
   when the theory \<open>Multiset\<close> is loaded. When no order kinds are given, they
   are tried in order. The search for a termination proof uses SAT solving
   internally.
 
   For local descent proofs, the @{syntax clasimpmod} modifiers are accepted
   (as for @{method auto}).
 
   \<^descr> @{attribute (HOL) termination_simp} declares extra rules for the
   simplifier, when invoked in termination proofs. This can be useful, e.g.,
   for special rules involving size estimations.
 
   \<^descr> @{method (HOL) induction_schema} derives user-specified induction rules
   from well-founded induction and completeness of patterns. This factors out
   some operations that are done internally by the function package and makes
   them available separately. See \<^file>\<open>~~/src/HOL/Examples/Induction_Schema.thy\<close> for
   examples.
 \<close>
 
 
 subsection \<open>Functions with explicit partiality\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{command_def (HOL) "partial_function"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
     @{attribute_def (HOL) "partial_function_mono"} & : & \<open>attribute\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     @@{command (HOL) partial_function} '(' @{syntax name} ')'
       @{syntax specification}
   \<close>
 
   \<^descr> @{command (HOL) "partial_function"}~\<open>(mode)\<close> defines recursive functions
   based on fixpoints in complete partial orders. No termination proof is
   required from the user or constructed internally. Instead, the possibility
   of non-termination is modelled explicitly in the result type, which contains
   an explicit bottom element.
 
   Pattern matching and mutual recursion are currently not supported. Thus, the
   specification consists of a single function described by a single recursive
   equation.
 
   There are no fixed syntactic restrictions on the body of the function, but
   the induced functional must be provably monotonic wrt.\ the underlying
   order. The monotonicity proof is performed internally, and the definition is
   rejected when it fails. The proof can be influenced by declaring hints using
   the @{attribute (HOL) partial_function_mono} attribute.
 
   The mandatory \<open>mode\<close> argument specifies the mode of operation of the
   command, which directly corresponds to a complete partial order on the
   result type. By default, the following modes are defined:
 
     \<^descr> \<open>option\<close> defines functions that map into the \<^type>\<open>option\<close> type. Here,
     the value \<^term>\<open>None\<close> is used to model a non-terminating computation.
     Monotonicity requires that if \<^term>\<open>None\<close> is returned by a recursive
     call, then the overall result must also be \<^term>\<open>None\<close>. This is best
     achieved through the use of the monadic operator \<^const>\<open>Option.bind\<close>.
 
     \<^descr> \<open>tailrec\<close> defines functions with an arbitrary result type and uses the
     slightly degenerated partial order where \<^term>\<open>undefined\<close> is the bottom
     element. Now, monotonicity requires that if \<^term>\<open>undefined\<close> is returned
     by a recursive call, then the overall result must also be \<^term>\<open>undefined\<close>. In practice, this is only satisfied when each recursive call
     is a tail call, whose result is directly returned. Thus, this mode of
     operation allows the definition of arbitrary tail-recursive functions.
 
   Experienced users may define new modes by instantiating the locale \<^const>\<open>partial_function_definitions\<close> appropriately.
 
   \<^descr> @{attribute (HOL) partial_function_mono} declares rules for use in the
   internal monotonicity proofs of partial function definitions.
 \<close>
 
 
 subsection \<open>Old-style recursive function definitions (TFL)\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{command_def (HOL) "recdef"} & : & \<open>theory \<rightarrow> theory)\<close> \\
   \end{matharray}
 
   The old TFL command @{command (HOL) "recdef"} for defining recursive is
   mostly obsolete; @{command (HOL) "function"} or @{command (HOL) "fun"}
   should be used instead.
 
   \<^rail>\<open>
     @@{command (HOL) recdef} ('(' @'permissive' ')')? \<newline>
       @{syntax name} @{syntax term} (@{syntax prop} +) hints?
     ;
     hints: '(' @'hints' ( recdefmod * ) ')'
     ;
     recdefmod: (('recdef_simp' | 'recdef_cong' | 'recdef_wf')
       (() | 'add' | 'del') ':' @{syntax thms}) | @{syntax clasimpmod}
   \<close>
 
   \<^descr> @{command (HOL) "recdef"} defines general well-founded recursive functions
   (using the TFL package). The ``\<open>(permissive)\<close>'' option tells TFL to recover
   from failed proof attempts, returning unfinished results. The \<open>recdef_simp\<close>,
   \<open>recdef_cong\<close>, and \<open>recdef_wf\<close> hints refer to auxiliary rules to be used in
   the internal automated proof process of TFL. Additional @{syntax clasimpmod}
   declarations may be given to tune the context of the Simplifier (cf.\
   \secref{sec:simplifier}) and Classical reasoner (cf.\
   \secref{sec:classical}).
 
 
   \<^medskip>
   Hints for @{command (HOL) "recdef"} may be also declared globally, using the
   following attributes.
 
   \begin{matharray}{rcl}
     @{attribute_def (HOL) recdef_simp} & : & \<open>attribute\<close> \\
     @{attribute_def (HOL) recdef_cong} & : & \<open>attribute\<close> \\
     @{attribute_def (HOL) recdef_wf} & : & \<open>attribute\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     (@@{attribute (HOL) recdef_simp} | @@{attribute (HOL) recdef_cong} |
       @@{attribute (HOL) recdef_wf}) (() | 'add' | 'del')
   \<close>
 \<close>
 
 
 section \<open>Adhoc overloading of constants\<close>
 
 text \<open>
   \begin{tabular}{rcll}
   @{command_def "adhoc_overloading"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
   @{command_def "no_adhoc_overloading"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
   @{attribute_def "show_variants"} & : & \<open>attribute\<close> & default \<open>false\<close> \\
   \end{tabular}
 
   \<^medskip>
   Adhoc overloading allows to overload a constant depending on its type.
   Typically this involves the introduction of an uninterpreted constant (used
   for input and output) and the addition of some variants (used internally).
   For examples see \<^file>\<open>~~/src/HOL/Examples/Adhoc_Overloading_Examples.thy\<close> and
   \<^file>\<open>~~/src/HOL/Library/Monad_Syntax.thy\<close>.
 
   \<^rail>\<open>
     (@@{command adhoc_overloading} | @@{command no_adhoc_overloading})
       (@{syntax name} (@{syntax term} + ) + @'and')
   \<close>
 
   \<^descr> @{command "adhoc_overloading"}~\<open>c v\<^sub>1 ... v\<^sub>n\<close> associates variants with an
   existing constant.
 
   \<^descr> @{command "no_adhoc_overloading"} is similar to @{command
   "adhoc_overloading"}, but removes the specified variants from the present
   context.
 
   \<^descr> @{attribute "show_variants"} controls printing of variants of overloaded
   constants. If enabled, the internally used variants are printed instead of
   their respective overloaded constants. This is occasionally useful to check
   whether the system agrees with a user's expectations about derived variants.
 \<close>
 
 
 section \<open>Definition by specification \label{sec:hol-specification}\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{command_def (HOL) "specification"} & : & \<open>theory \<rightarrow> proof(prove)\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     @@{command (HOL) specification} '(' (decl +) ')' \<newline>
       (@{syntax thmdecl}? @{syntax prop} +)
     ;
     decl: (@{syntax name} ':')? @{syntax term} ('(' @'overloaded' ')')?
   \<close>
 
   \<^descr> @{command (HOL) "specification"}~\<open>decls \<phi>\<close> sets up a goal stating the
   existence of terms with the properties specified to hold for the constants
   given in \<open>decls\<close>. After finishing the proof, the theory will be augmented
   with definitions for the given constants, as well as with theorems stating
   the properties for these constants.
 
   \<open>decl\<close> declares a constant to be defined by the specification given. The
   definition for the constant \<open>c\<close> is bound to the name \<open>c_def\<close> unless a
   theorem name is given in the declaration. Overloaded constants should be
   declared as such.
 \<close>
 
 
 section \<open>Old-style datatypes \label{sec:hol-datatype}\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{command_def (HOL) "old_rep_datatype"} & : & \<open>theory \<rightarrow> proof(prove)\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     @@{command (HOL) old_rep_datatype} ('(' (@{syntax name} +) ')')? (@{syntax term} +)
     ;
 
     spec: @{syntax typespec_sorts} @{syntax mixfix}? '=' (cons + '|')
     ;
     cons: @{syntax name} (@{syntax type} * ) @{syntax mixfix}?
   \<close>
 
   \<^descr> @{command (HOL) "old_rep_datatype"} represents existing types as
   old-style datatypes.
 
 
   These commands are mostly obsolete; @{command (HOL) "datatype"} should be
   used instead.
 
-  See @{cite "isabelle-datatypes"} for more details on datatypes. Apart from
+  See \<^cite>\<open>"isabelle-datatypes"\<close> for more details on datatypes. Apart from
   proper proof methods for case analysis and induction, there are also
   emulations of ML tactics @{method (HOL) case_tac} and @{method (HOL)
   induct_tac} available, see \secref{sec:hol-induct-tac}; these admit to refer
   directly to the internal structure of subgoals (including internally bound
   parameters).
 \<close>
 
 
 subsubsection \<open>Examples\<close>
 
 text \<open>
   We define a type of finite sequences, with slightly different names than the
   existing \<^typ>\<open>'a list\<close> that is already in \<^theory>\<open>Main\<close>:
 \<close>
 
 (*<*)experiment begin(*>*)
 datatype 'a seq = Empty | Seq 'a "'a seq"
 
 text \<open>We can now prove some simple lemma by structural induction:\<close>
 
 lemma "Seq x xs \<noteq> xs"
 proof (induct xs arbitrary: x)
   case Empty
   txt \<open>This case can be proved using the simplifier: the freeness
     properties of the datatype are already declared as @{attribute
     simp} rules.\<close>
   show "Seq x Empty \<noteq> Empty"
     by simp
 next
   case (Seq y ys)
   txt \<open>The step case is proved similarly.\<close>
   show "Seq x (Seq y ys) \<noteq> Seq y ys"
     using \<open>Seq y ys \<noteq> ys\<close> by simp
 qed
 
 text \<open>Here is a more succinct version of the same proof:\<close>
 
 lemma "Seq x xs \<noteq> xs"
   by (induct xs arbitrary: x) simp_all
 (*<*)end(*>*)
 
 
 section \<open>Records \label{sec:hol-record}\<close>
 
 text \<open>
   In principle, records merely generalize the concept of tuples, where
   components may be addressed by labels instead of just position. The logical
   infrastructure of records in Isabelle/HOL is slightly more advanced, though,
   supporting truly extensible record schemes. This admits operations that are
   polymorphic with respect to record extension, yielding ``object-oriented''
-  effects like (single) inheritance. See also @{cite "NaraschewskiW-TPHOLs98"}
+  effects like (single) inheritance. See also \<^cite>\<open>"NaraschewskiW-TPHOLs98"\<close>
   for more details on object-oriented verification and record subtyping in
   HOL.
 \<close>
 
 
 subsection \<open>Basic concepts\<close>
 
 text \<open>
   Isabelle/HOL supports both \<^emph>\<open>fixed\<close> and \<^emph>\<open>schematic\<close> records at the level of
   terms and types. The notation is as follows:
 
   \begin{center}
   \begin{tabular}{l|l|l}
     & record terms & record types \\ \hline
     fixed & \<open>\<lparr>x = a, y = b\<rparr>\<close> & \<open>\<lparr>x :: A, y :: B\<rparr>\<close> \\
     schematic & \<open>\<lparr>x = a, y = b, \<dots> = m\<rparr>\<close> &
       \<open>\<lparr>x :: A, y :: B, \<dots> :: M\<rparr>\<close> \\
   \end{tabular}
   \end{center}
 
   The ASCII representation of \<open>\<lparr>x = a\<rparr>\<close> is \<open>(| x = a |)\<close>.
 
   A fixed record \<open>\<lparr>x = a, y = b\<rparr>\<close> has field \<open>x\<close> of value \<open>a\<close> and field \<open>y\<close> of
   value \<open>b\<close>. The corresponding type is \<open>\<lparr>x :: A, y :: B\<rparr>\<close>, assuming that \<open>a ::
   A\<close> and \<open>b :: B\<close>.
 
   A record scheme like \<open>\<lparr>x = a, y = b, \<dots> = m\<rparr>\<close> contains fields \<open>x\<close> and \<open>y\<close> as
   before, but also possibly further fields as indicated by the ``\<open>\<dots>\<close>''
   notation (which is actually part of the syntax). The improper field ``\<open>\<dots>\<close>''
   of a record scheme is called the \<^emph>\<open>more part\<close>. Logically it is just a free
   variable, which is occasionally referred to as ``row variable'' in the
   literature. The more part of a record scheme may be instantiated by zero or
   more further components. For example, the previous scheme may get
   instantiated to \<open>\<lparr>x = a, y = b, z = c, \<dots> = m'\<rparr>\<close>, where \<open>m'\<close> refers to a
   different more part. Fixed records are special instances of record schemes,
   where ``\<open>\<dots>\<close>'' is properly terminated by the \<open>() :: unit\<close> element. In fact,
   \<open>\<lparr>x = a, y = b\<rparr>\<close> is just an abbreviation for \<open>\<lparr>x = a, y = b, \<dots> = ()\<rparr>\<close>.
 
   \<^medskip>
   Two key observations make extensible records in a simply typed language like
   HOL work out:
 
   \<^enum> the more part is internalized, as a free term or type variable,
 
   \<^enum> field names are externalized, they cannot be accessed within the logic as
   first-class values.
 
 
   \<^medskip>
   In Isabelle/HOL record types have to be defined explicitly, fixing their
   field names and types, and their (optional) parent record. Afterwards,
   records may be formed using above syntax, while obeying the canonical order
   of fields as given by their declaration. The record package provides several
   standard operations like selectors and updates. The common setup for various
   generic proof tools enable succinct reasoning patterns. See also the
-  Isabelle/HOL tutorial @{cite "isabelle-hol-book"} for further instructions
+  Isabelle/HOL tutorial \<^cite>\<open>"isabelle-hol-book"\<close> for further instructions
   on using records in practice.
 \<close>
 
 
 subsection \<open>Record specifications\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{command_def (HOL) "record"} & : & \<open>theory \<rightarrow> theory\<close> \\
     @{command_def (HOL) "print_record"} & : & \<open>context \<rightarrow>\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     @@{command (HOL) record} @{syntax "overloaded"}? @{syntax typespec_sorts} '=' \<newline>
       (@{syntax type} '+')? (constdecl +)
     ;
     constdecl: @{syntax name} '::' @{syntax type} @{syntax mixfix}?
     ;
     @@{command (HOL) print_record} modes? @{syntax typespec_sorts}
     ;
     modes: '(' (@{syntax name} +) ')'
   \<close>
 
   \<^descr> @{command (HOL) "record"}~\<open>(\<alpha>\<^sub>1, \<dots>, \<alpha>\<^sub>m) t = \<tau> + c\<^sub>1 :: \<sigma>\<^sub>1 \<dots> c\<^sub>n :: \<sigma>\<^sub>n\<close>
   defines extensible record type \<open>(\<alpha>\<^sub>1, \<dots>, \<alpha>\<^sub>m) t\<close>, derived from the optional
   parent record \<open>\<tau>\<close> by adding new field components \<open>c\<^sub>i :: \<sigma>\<^sub>i\<close> etc.
 
   The type variables of \<open>\<tau>\<close> and \<open>\<sigma>\<^sub>i\<close> need to be covered by the (distinct)
   parameters \<open>\<alpha>\<^sub>1, \<dots>, \<alpha>\<^sub>m\<close>. Type constructor \<open>t\<close> has to be new, while \<open>\<tau>\<close>
   needs to specify an instance of an existing record type. At least one new
   field \<open>c\<^sub>i\<close> has to be specified. Basically, field names need to belong to a
   unique record. This is not a real restriction in practice, since fields are
   qualified by the record name internally.
 
   The parent record specification \<open>\<tau>\<close> is optional; if omitted \<open>t\<close> becomes a
   root record. The hierarchy of all records declared within a theory context
   forms a forest structure, i.e.\ a set of trees starting with a root record
   each. There is no way to merge multiple parent records!
 
   For convenience, \<open>(\<alpha>\<^sub>1, \<dots>, \<alpha>\<^sub>m) t\<close> is made a type abbreviation for the fixed
   record type \<open>\<lparr>c\<^sub>1 :: \<sigma>\<^sub>1, \<dots>, c\<^sub>n :: \<sigma>\<^sub>n\<rparr>\<close>, likewise is \<open>(\<alpha>\<^sub>1, \<dots>, \<alpha>\<^sub>m, \<zeta>)
   t_scheme\<close> made an abbreviation for \<open>\<lparr>c\<^sub>1 :: \<sigma>\<^sub>1, \<dots>, c\<^sub>n :: \<sigma>\<^sub>n, \<dots> :: \<zeta>\<rparr>\<close>.
 
   \<^descr> @{command (HOL) "print_record"}~\<open>(\<alpha>\<^sub>1, \<dots>, \<alpha>\<^sub>m) t\<close> prints the definition of
   record \<open>(\<alpha>\<^sub>1, \<dots>, \<alpha>\<^sub>m) t\<close>. Optionally \<open>modes\<close> can be specified, which are
   appended to the current print mode; see \secref{sec:print-modes}.
 \<close>
 
 
 subsection \<open>Record operations\<close>
 
 text \<open>
   Any record definition of the form presented above produces certain standard
   operations. Selectors and updates are provided for any field, including the
   improper one ``\<open>more\<close>''. There are also cumulative record constructor
   functions. To simplify the presentation below, we assume for now that \<open>(\<alpha>\<^sub>1,
   \<dots>, \<alpha>\<^sub>m) t\<close> is a root record with fields \<open>c\<^sub>1 :: \<sigma>\<^sub>1, \<dots>, c\<^sub>n :: \<sigma>\<^sub>n\<close>.
 
   \<^medskip>
   \<^bold>\<open>Selectors\<close> and \<^bold>\<open>updates\<close> are available for any
   field (including ``\<open>more\<close>''):
 
   \begin{matharray}{lll}
     \<open>c\<^sub>i\<close> & \<open>::\<close> & \<open>\<lparr>\<^vec>c :: \<^vec>\<sigma>, \<dots> :: \<zeta>\<rparr> \<Rightarrow> \<sigma>\<^sub>i\<close> \\
     \<open>c\<^sub>i_update\<close> & \<open>::\<close> & \<open>\<sigma>\<^sub>i \<Rightarrow> \<lparr>\<^vec>c :: \<^vec>\<sigma>, \<dots> :: \<zeta>\<rparr> \<Rightarrow> \<lparr>\<^vec>c :: \<^vec>\<sigma>, \<dots> :: \<zeta>\<rparr>\<close> \\
   \end{matharray}
 
   There is special syntax for application of updates: \<open>r\<lparr>x := a\<rparr>\<close> abbreviates
   term \<open>x_update a r\<close>. Further notation for repeated updates is also
   available: \<open>r\<lparr>x := a\<rparr>\<lparr>y := b\<rparr>\<lparr>z := c\<rparr>\<close> may be written \<open>r\<lparr>x := a, y := b, z
   := c\<rparr>\<close>. Note that because of postfix notation the order of fields shown here
   is reverse than in the actual term. Since repeated updates are just function
   applications, fields may be freely permuted in \<open>\<lparr>x := a, y := b, z := c\<rparr>\<close>,
   as far as logical equality is concerned. Thus commutativity of independent
   updates can be proven within the logic for any two fields, but not as a
   general theorem.
 
   \<^medskip>
   The \<^bold>\<open>make\<close> operation provides a cumulative record constructor function:
 
   \begin{matharray}{lll}
     \<open>t.make\<close> & \<open>::\<close> & \<open>\<sigma>\<^sub>1 \<Rightarrow> \<dots> \<sigma>\<^sub>n \<Rightarrow> \<lparr>\<^vec>c :: \<^vec>\<sigma>\<rparr>\<close> \\
   \end{matharray}
 
   \<^medskip>
   We now reconsider the case of non-root records, which are derived of some
   parent. In general, the latter may depend on another parent as well,
   resulting in a list of \<^emph>\<open>ancestor records\<close>. Appending the lists of fields of
   all ancestors results in a certain field prefix. The record package
   automatically takes care of this by lifting operations over this context of
   ancestor fields. Assuming that \<open>(\<alpha>\<^sub>1, \<dots>, \<alpha>\<^sub>m) t\<close> has ancestor fields \<open>b\<^sub>1 ::
   \<rho>\<^sub>1, \<dots>, b\<^sub>k :: \<rho>\<^sub>k\<close>, the above record operations will get the following
   types:
 
   \<^medskip>
   \begin{tabular}{lll}
     \<open>c\<^sub>i\<close> & \<open>::\<close> & \<open>\<lparr>\<^vec>b :: \<^vec>\<rho>, \<^vec>c :: \<^vec>\<sigma>, \<dots> :: \<zeta>\<rparr> \<Rightarrow> \<sigma>\<^sub>i\<close> \\
     \<open>c\<^sub>i_update\<close> & \<open>::\<close> & \<open>\<sigma>\<^sub>i \<Rightarrow>
       \<lparr>\<^vec>b :: \<^vec>\<rho>, \<^vec>c :: \<^vec>\<sigma>, \<dots> :: \<zeta>\<rparr> \<Rightarrow>
       \<lparr>\<^vec>b :: \<^vec>\<rho>, \<^vec>c :: \<^vec>\<sigma>, \<dots> :: \<zeta>\<rparr>\<close> \\
     \<open>t.make\<close> & \<open>::\<close> & \<open>\<rho>\<^sub>1 \<Rightarrow> \<dots> \<rho>\<^sub>k \<Rightarrow> \<sigma>\<^sub>1 \<Rightarrow> \<dots> \<sigma>\<^sub>n \<Rightarrow>
       \<lparr>\<^vec>b :: \<^vec>\<rho>, \<^vec>c :: \<^vec>\<sigma>\<rparr>\<close> \\
   \end{tabular}
   \<^medskip>
 
   Some further operations address the extension aspect of a derived record
   scheme specifically: \<open>t.fields\<close> produces a record fragment consisting of
   exactly the new fields introduced here (the result may serve as a more part
   elsewhere); \<open>t.extend\<close> takes a fixed record and adds a given more part;
   \<open>t.truncate\<close> restricts a record scheme to a fixed record.
 
   \<^medskip>
   \begin{tabular}{lll}
     \<open>t.fields\<close> & \<open>::\<close> & \<open>\<sigma>\<^sub>1 \<Rightarrow> \<dots> \<sigma>\<^sub>n \<Rightarrow> \<lparr>\<^vec>c :: \<^vec>\<sigma>\<rparr>\<close> \\
     \<open>t.extend\<close> & \<open>::\<close> & \<open>\<lparr>\<^vec>b :: \<^vec>\<rho>, \<^vec>c :: \<^vec>\<sigma>\<rparr> \<Rightarrow>
       \<zeta> \<Rightarrow> \<lparr>\<^vec>b :: \<^vec>\<rho>, \<^vec>c :: \<^vec>\<sigma>, \<dots> :: \<zeta>\<rparr>\<close> \\
     \<open>t.truncate\<close> & \<open>::\<close> & \<open>\<lparr>\<^vec>b :: \<^vec>\<rho>, \<^vec>c :: \<^vec>\<sigma>, \<dots> :: \<zeta>\<rparr> \<Rightarrow> \<lparr>\<^vec>b :: \<^vec>\<rho>, \<^vec>c :: \<^vec>\<sigma>\<rparr>\<close> \\
   \end{tabular}
   \<^medskip>
 
   Note that \<open>t.make\<close> and \<open>t.fields\<close> coincide for root records.
 \<close>
 
 
 subsection \<open>Derived rules and proof tools\<close>
 
 text \<open>
   The record package proves several results internally, declaring these facts
   to appropriate proof tools. This enables users to reason about record
   structures quite conveniently. Assume that \<open>t\<close> is a record type as specified
   above.
 
   \<^enum> Standard conversions for selectors or updates applied to record
   constructor terms are made part of the default Simplifier context; thus
   proofs by reduction of basic operations merely require the @{method simp}
   method without further arguments. These rules are available as \<open>t.simps\<close>,
   too.
 
   \<^enum> Selectors applied to updated records are automatically reduced by an
   internal simplification procedure, which is also part of the standard
   Simplifier setup.
 
   \<^enum> Inject equations of a form analogous to \<^prop>\<open>(x, y) = (x', y') \<equiv> x = x'
   \<and> y = y'\<close> are declared to the Simplifier and Classical Reasoner as
   @{attribute iff} rules. These rules are available as \<open>t.iffs\<close>.
 
   \<^enum> The introduction rule for record equality analogous to \<open>x r = x r' \<Longrightarrow> y r =
   y r' \<dots> \<Longrightarrow> r = r'\<close> is declared to the Simplifier, and as the basic rule
   context as ``@{attribute intro}\<open>?\<close>''. The rule is called \<open>t.equality\<close>.
 
   \<^enum> Representations of arbitrary record expressions as canonical constructor
   terms are provided both in @{method cases} and @{method induct} format (cf.\
   the generic proof methods of the same name, \secref{sec:cases-induct}).
   Several variations are available, for fixed records, record schemes, more
   parts etc.
 
   The generic proof methods are sufficiently smart to pick the most sensible
   rule according to the type of the indicated record expression: users just
   need to apply something like ``\<open>(cases r)\<close>'' to a certain proof problem.
 
   \<^enum> The derived record operations \<open>t.make\<close>, \<open>t.fields\<close>, \<open>t.extend\<close>,
   \<open>t.truncate\<close> are \<^emph>\<open>not\<close> treated automatically, but usually need to be
   expanded by hand, using the collective fact \<open>t.defs\<close>.
 \<close>
 
 
 subsubsection \<open>Examples\<close>
 
 text \<open>See \<^file>\<open>~~/src/HOL/Examples/Records.thy\<close>, for example.\<close>
 
 
 section \<open>Semantic subtype definitions \label{sec:hol-typedef}\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{command_def (HOL) "typedef"} & : & \<open>local_theory \<rightarrow> proof(prove)\<close> \\
   \end{matharray}
 
   A type definition identifies a new type with a non-empty subset of an
   existing type. More precisely, the new type is defined by exhibiting an
   existing type \<open>\<tau>\<close>, a set \<open>A :: \<tau> set\<close>, and proving \<^prop>\<open>\<exists>x. x \<in> A\<close>. Thus
   \<open>A\<close> is a non-empty subset of \<open>\<tau>\<close>, and the new type denotes this subset. New
   functions are postulated that establish an isomorphism between the new type
   and the subset. In general, the type \<open>\<tau>\<close> may involve type variables \<open>\<alpha>\<^sub>1, \<dots>,
   \<alpha>\<^sub>n\<close> which means that the type definition produces a type constructor \<open>(\<alpha>\<^sub>1,
   \<dots>, \<alpha>\<^sub>n) t\<close> depending on those type arguments.
 
   \<^rail>\<open>
     @@{command (HOL) typedef} @{syntax "overloaded"}? abs_type '=' rep_set
     ;
     @{syntax_def "overloaded"}: ('(' @'overloaded' ')')
     ;
     abs_type: @{syntax typespec_sorts} @{syntax mixfix}?
     ;
     rep_set: @{syntax term} (@'morphisms' @{syntax name} @{syntax name})?
   \<close>
 
   To understand the concept of type definition better, we need to recount its
   somewhat complex history. The HOL logic goes back to the ``Simple Theory of
-  Types'' (STT) of A. Church @{cite "church40"}, which is further explained in
-  the book by P. Andrews @{cite "andrews86"}. The overview article by W.
-  Farmer @{cite "Farmer:2008"} points out the ``seven virtues'' of this
+  Types'' (STT) of A. Church \<^cite>\<open>"church40"\<close>, which is further explained in
+  the book by P. Andrews \<^cite>\<open>"andrews86"\<close>. The overview article by W.
+  Farmer \<^cite>\<open>"Farmer:2008"\<close> points out the ``seven virtues'' of this
   relatively simple family of logics. STT has only ground types, without
   polymorphism and without type definitions.
 
   \<^medskip>
-  M. Gordon @{cite "Gordon:1985:HOL"} augmented Church's STT by adding
+  M. Gordon \<^cite>\<open>"Gordon:1985:HOL"\<close> augmented Church's STT by adding
   schematic polymorphism (type variables and type constructors) and a facility
   to introduce new types as semantic subtypes from existing types. This
   genuine extension of the logic was explained semantically by A. Pitts in the
-  book of the original Cambridge HOL88 system @{cite "pitts93"}. Type
+  book of the original Cambridge HOL88 system \<^cite>\<open>"pitts93"\<close>. Type
   definitions work in this setting, because the general model-theory of STT is
   restricted to models that ensure that the universe of type interpretations
   is closed by forming subsets (via predicates taken from the logic).
 
   \<^medskip>
   Isabelle/HOL goes beyond Gordon-style HOL by admitting overloaded constant
-  definitions @{cite "Wenzel:1997:TPHOL" and "Haftmann-Wenzel:2006:classes"},
+  definitions \<^cite>\<open>"Wenzel:1997:TPHOL" and "Haftmann-Wenzel:2006:classes"\<close>,
   which are actually a concept of Isabelle/Pure and do not depend on
   particular set-theoretic semantics of HOL. Over many years, there was no
   formal checking of semantic type definitions in Isabelle/HOL versus
   syntactic constant definitions in Isabelle/Pure. So the @{command typedef}
   command was described as ``axiomatic'' in the sense of
   \secref{sec:axiomatizations}, only with some local checks of the given type
   and its representing set.
 
-  Recent clarification of overloading in the HOL logic proper @{cite
-  "Kuncar-Popescu:2015"} demonstrates how the dissimilar concepts of constant
+  Recent clarification of overloading in the HOL logic proper \<^cite>\<open>"Kuncar-Popescu:2015"\<close> demonstrates how the dissimilar concepts of constant
   definitions versus type definitions may be understood uniformly. This
   requires an interpretation of Isabelle/HOL that substantially reforms the
-  set-theoretic model of A. Pitts @{cite "pitts93"}, by taking a schematic
+  set-theoretic model of A. Pitts \<^cite>\<open>"pitts93"\<close>, by taking a schematic
   view on polymorphism and interpreting only ground types in the set-theoretic
   sense of HOL88. Moreover, type-constructors may be explicitly overloaded,
   e.g.\ by making the subset depend on type-class parameters (cf.\
   \secref{sec:class}). This is semantically like a dependent type: the meaning
   relies on the operations provided by different type-class instances.
 
   \<^descr> @{command (HOL) "typedef"}~\<open>(\<alpha>\<^sub>1, \<dots>, \<alpha>\<^sub>n) t = A\<close> defines a new type \<open>(\<alpha>\<^sub>1,
   \<dots>, \<alpha>\<^sub>n) t\<close> from the set \<open>A\<close> over an existing type. The set \<open>A\<close> may contain
   type variables \<open>\<alpha>\<^sub>1, \<dots>, \<alpha>\<^sub>n\<close> as specified on the LHS, but no term variables.
   Non-emptiness of \<open>A\<close> needs to be proven on the spot, in order to turn the
   internal conditional characterization into usable theorems.
 
   The ``\<open>(overloaded)\<close>'' option allows the @{command "typedef"} specification
   to depend on constants that are not (yet) specified and thus left open as
   parameters, e.g.\ type-class parameters.
 
   Within a local theory specification, the newly introduced type constructor
   cannot depend on parameters or assumptions of the context: this is
   syntactically impossible in HOL. The non-emptiness proof may formally depend
   on local assumptions, but this has little practical relevance.
 
   For @{command (HOL) "typedef"}~\<open>t = A\<close> the newly introduced type \<open>t\<close> is
   accompanied by a pair of morphisms to relate it to the representing set over
   the old type. By default, the injection from type to set is called \<open>Rep_t\<close>
   and its inverse \<open>Abs_t\<close>: An explicit @{keyword (HOL) "morphisms"}
   specification allows to provide alternative names.
 
   The logical characterization of @{command typedef} uses the predicate of
   locale \<^const>\<open>type_definition\<close> that is defined in Isabelle/HOL. Various
   basic consequences of that are instantiated accordingly, re-using the locale
   facts with names derived from the new type constructor. Thus the generic
   theorem @{thm type_definition.Rep} is turned into the specific \<open>Rep_t\<close>, for
   example.
 
   Theorems @{thm type_definition.Rep}, @{thm type_definition.Rep_inverse}, and
   @{thm type_definition.Abs_inverse} provide the most basic characterization
   as a corresponding injection/surjection pair (in both directions). The
   derived rules @{thm type_definition.Rep_inject} and @{thm
   type_definition.Abs_inject} provide a more convenient version of
   injectivity, suitable for automated proof tools (e.g.\ in declarations
   involving @{attribute simp} or @{attribute iff}). Furthermore, the rules
   @{thm type_definition.Rep_cases}~/ @{thm type_definition.Rep_induct}, and
   @{thm type_definition.Abs_cases}~/ @{thm type_definition.Abs_induct} provide
   alternative views on surjectivity. These rules are already declared as set
   or type rules for the generic @{method cases} and @{method induct} methods,
   respectively.
 \<close>
 
 
 subsubsection \<open>Examples\<close>
 
 text \<open>
   The following trivial example pulls a three-element type into existence
   within the formal logical environment of Isabelle/HOL.\<close>
 
 (*<*)experiment begin(*>*)
 typedef three = "{(True, True), (True, False), (False, True)}"
   by blast
 
 definition "One = Abs_three (True, True)"
 definition "Two = Abs_three (True, False)"
 definition "Three = Abs_three (False, True)"
 
 lemma three_distinct: "One \<noteq> Two"  "One \<noteq> Three"  "Two \<noteq> Three"
   by (simp_all add: One_def Two_def Three_def Abs_three_inject)
 
 lemma three_cases:
   fixes x :: three obtains "x = One" | "x = Two" | "x = Three"
   by (cases x) (auto simp: One_def Two_def Three_def Abs_three_inject)
 (*<*)end(*>*)
 
 text \<open>Note that such trivial constructions are better done with
   derived specification mechanisms such as @{command datatype}:\<close>
 
 (*<*)experiment begin(*>*)
 datatype three = One | Two | Three
 (*<*)end(*>*)
 
 text \<open>This avoids re-doing basic definitions and proofs from the
   primitive @{command typedef} above.\<close>
 
 
 
 section \<open>Functorial structure of types\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{command_def (HOL) "functor"} & : & \<open>local_theory \<rightarrow> proof(prove)\<close>
   \end{matharray}
 
   \<^rail>\<open>
     @@{command (HOL) functor} (@{syntax name} ':')? @{syntax term}
   \<close>
 
   \<^descr> @{command (HOL) "functor"}~\<open>prefix: m\<close> allows to prove and register
   properties about the functorial structure of type constructors. These
   properties then can be used by other packages to deal with those type
   constructors in certain type constructions. Characteristic theorems are
   noted in the current local theory. By default, they are prefixed with the
   base name of the type constructor, an explicit prefix can be given
   alternatively.
 
   The given term \<open>m\<close> is considered as \<^emph>\<open>mapper\<close> for the corresponding type
   constructor and must conform to the following type pattern:
 
   \begin{matharray}{lll}
     \<open>m\<close> & \<open>::\<close> &
       \<open>\<sigma>\<^sub>1 \<Rightarrow> \<dots> \<sigma>\<^sub>k \<Rightarrow> (\<^vec>\<alpha>\<^sub>n) t \<Rightarrow> (\<^vec>\<beta>\<^sub>n) t\<close> \\
   \end{matharray}
 
   where \<open>t\<close> is the type constructor, \<open>\<^vec>\<alpha>\<^sub>n\<close> and \<open>\<^vec>\<beta>\<^sub>n\<close> are
   distinct type variables free in the local theory and \<open>\<sigma>\<^sub>1\<close>, \ldots, \<open>\<sigma>\<^sub>k\<close> is
   a subsequence of \<open>\<alpha>\<^sub>1 \<Rightarrow> \<beta>\<^sub>1\<close>, \<open>\<beta>\<^sub>1 \<Rightarrow> \<alpha>\<^sub>1\<close>, \ldots, \<open>\<alpha>\<^sub>n \<Rightarrow> \<beta>\<^sub>n\<close>, \<open>\<beta>\<^sub>n \<Rightarrow> \<alpha>\<^sub>n\<close>.
 \<close>
 
 
 section \<open>Quotient types with lifting and transfer\<close>
 
 text \<open>
   The quotient package defines a new quotient type given a raw type and a
   partial equivalence relation (\secref{sec:quotient-type}). The package also
   historically includes automation for transporting definitions and theorems
   (\secref{sec:old-quotient}), but most of this automation was superseded by
   the Lifting (\secref{sec:lifting}) and Transfer (\secref{sec:transfer})
   packages.
 \<close>
 
 
 subsection \<open>Quotient type definition \label{sec:quotient-type}\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{command_def (HOL) "quotient_type"} & : & \<open>local_theory \<rightarrow> proof(prove)\<close>\\
   \end{matharray}
 
   \<^rail>\<open>
     @@{command (HOL) quotient_type} @{syntax "overloaded"}? \<newline>
       @{syntax typespec} @{syntax mixfix}? '=' quot_type \<newline>
       quot_morphisms? quot_parametric?
     ;
     quot_type: @{syntax type} '/' ('partial' ':')? @{syntax term}
     ;
     quot_morphisms: @'morphisms' @{syntax name} @{syntax name}
     ;
     quot_parametric: @'parametric' @{syntax thm}
   \<close>
 
   \<^descr> @{command (HOL) "quotient_type"} defines a new quotient type \<open>\<tau>\<close>. The
   injection from a quotient type to a raw type is called \<open>rep_\<tau>\<close>, its inverse
   \<open>abs_\<tau>\<close> unless explicit @{keyword (HOL) "morphisms"} specification provides
   alternative names. @{command (HOL) "quotient_type"} requires the user to
   prove that the relation is an equivalence relation (predicate \<open>equivp\<close>),
   unless the user specifies explicitly \<open>partial\<close> in which case the obligation
   is \<open>part_equivp\<close>. A quotient defined with \<open>partial\<close> is weaker in the sense
   that less things can be proved automatically.
 
   The command internally proves a Quotient theorem and sets up the Lifting
   package by the command @{command (HOL) setup_lifting}. Thus the Lifting and
   Transfer packages can be used also with quotient types defined by @{command
   (HOL) "quotient_type"} without any extra set-up. The parametricity theorem
   for the equivalence relation R can be provided as an extra argument of the
   command and is passed to the corresponding internal call of @{command (HOL)
   setup_lifting}. This theorem allows the Lifting package to generate a
   stronger transfer rule for equality.
 \<close>
 
 
 subsection \<open>Lifting package \label{sec:lifting}\<close>
 
 text \<open>
   The Lifting package allows users to lift terms of the raw type to the
   abstract type, which is a necessary step in building a library for an
   abstract type. Lifting defines a new constant by combining coercion
   functions (\<^term>\<open>Abs\<close> and \<^term>\<open>Rep\<close>) with the raw term. It also proves an
   appropriate transfer rule for the Transfer (\secref{sec:transfer}) package
   and, if possible, an equation for the code generator.
 
   The Lifting package provides two main commands: @{command (HOL)
   "setup_lifting"} for initializing the package to work with a new type, and
   @{command (HOL) "lift_definition"} for lifting constants. The Lifting
   package works with all four kinds of type abstraction: type copies,
   subtypes, total quotients and partial quotients.
 
-  Theoretical background can be found in @{cite
-  "Huffman-Kuncar:2013:lifting_transfer"}.
+  Theoretical background can be found in \<^cite>\<open>"Huffman-Kuncar:2013:lifting_transfer"\<close>.
 
   \begin{matharray}{rcl}
     @{command_def (HOL) "setup_lifting"} & : & \<open>local_theory \<rightarrow> local_theory\<close>\\
     @{command_def (HOL) "lift_definition"} & : & \<open>local_theory \<rightarrow> proof(prove)\<close>\\
     @{command_def (HOL) "lifting_forget"} & : & \<open>local_theory \<rightarrow> local_theory\<close>\\
     @{command_def (HOL) "lifting_update"} & : & \<open>local_theory \<rightarrow> local_theory\<close>\\
     @{command_def (HOL) "print_quot_maps"} & : & \<open>context \<rightarrow>\<close>\\
     @{command_def (HOL) "print_quotients"} & : & \<open>context \<rightarrow>\<close>\\
     @{attribute_def (HOL) "quot_map"} & : & \<open>attribute\<close> \\
     @{attribute_def (HOL) "relator_eq_onp"} & : & \<open>attribute\<close> \\
     @{attribute_def (HOL) "relator_mono"} & : & \<open>attribute\<close> \\
     @{attribute_def (HOL) "relator_distr"} & : & \<open>attribute\<close> \\
     @{attribute_def (HOL) "quot_del"} & : & \<open>attribute\<close> \\
     @{attribute_def (HOL) "lifting_restore"} & : & \<open>attribute\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     @@{command (HOL) setup_lifting} @{syntax thm} @{syntax thm}? \<newline>
       (@'parametric' @{syntax thm})?
     ;
     @@{command (HOL) lift_definition} ('(' 'code_dt' ')')? \<newline>
       @{syntax name} '::' @{syntax type} @{syntax mixfix}? 'is' @{syntax term} \<newline>
       (@'parametric' (@{syntax thm}+))?
     ;
     @@{command (HOL) lifting_forget} @{syntax name}
     ;
     @@{command (HOL) lifting_update} @{syntax name}
     ;
     @@{attribute (HOL) lifting_restore}
       @{syntax thm} (@{syntax thm} @{syntax thm})?
   \<close>
 
   \<^descr> @{command (HOL) "setup_lifting"} Sets up the Lifting package to work with
   a user-defined type. The command supports two modes.
 
     \<^enum> The first one is a low-level mode when the user must provide as a first
     argument of @{command (HOL) "setup_lifting"} a quotient theorem \<^term>\<open>Quotient R Abs Rep T\<close>. The package configures a transfer rule for
     equality, a domain transfer rules and sets up the @{command_def (HOL)
     "lift_definition"} command to work with the abstract type. An optional
     theorem \<^term>\<open>reflp R\<close>, which certifies that the equivalence relation R
     is total, can be provided as a second argument. This allows the package to
     generate stronger transfer rules. And finally, the parametricity theorem
     for \<^term>\<open>R\<close> can be provided as a third argument. This allows the package
     to generate a stronger transfer rule for equality.
 
     Users generally will not prove the \<open>Quotient\<close> theorem manually for new
     types, as special commands exist to automate the process.
 
     \<^enum> When a new subtype is defined by @{command (HOL) typedef}, @{command
     (HOL) "lift_definition"} can be used in its second mode, where only the
     \<^term>\<open>type_definition\<close> theorem \<^term>\<open>type_definition Rep Abs A\<close> is
     used as an argument of the command. The command internally proves the
     corresponding \<^term>\<open>Quotient\<close> theorem and registers it with @{command
     (HOL) setup_lifting} using its first mode.
 
   For quotients, the command @{command (HOL) quotient_type} can be used. The
   command defines a new quotient type and similarly to the previous case, the
   corresponding Quotient theorem is proved and registered by @{command (HOL)
   setup_lifting}.
 
   \<^medskip>
   The command @{command (HOL) "setup_lifting"} also sets up the code generator
   for the new type. Later on, when a new constant is defined by @{command
   (HOL) "lift_definition"}, the Lifting package proves and registers a code
   equation (if there is one) for the new constant.
 
   \<^descr> @{command (HOL) "lift_definition"} \<open>f :: \<tau>\<close> @{keyword (HOL) "is"} \<open>t\<close>
   Defines a new function \<open>f\<close> with an abstract type \<open>\<tau>\<close> in terms of a
   corresponding operation \<open>t\<close> on a representation type. More formally, if \<open>t
   :: \<sigma>\<close>, then the command builds a term \<open>F\<close> as a corresponding combination of
   abstraction and representation functions such that \<open>F :: \<sigma> \<Rightarrow> \<tau>\<close> and defines
   \<open>f \<equiv> F t\<close>. The term \<open>t\<close> does not have to be necessarily a constant but it
   can be any term.
 
   The command opens a proof and the user must discharge a respectfulness proof
   obligation. For a type copy, i.e.\ a typedef with \<open>UNIV\<close>, the obligation is
   discharged automatically. The proof goal is presented in a user-friendly,
   readable form. A respectfulness theorem in the standard format \<open>f.rsp\<close> and a
   transfer rule \<open>f.transfer\<close> for the Transfer package are generated by the
   package.
 
   The user can specify a parametricity theorems for \<open>t\<close> after the keyword
   @{keyword "parametric"}, which allows the command to generate parametric
   transfer rules for \<open>f\<close>.
 
   For each constant defined through trivial quotients (type copies or
   subtypes) \<open>f.rep_eq\<close> is generated. The equation is a code certificate that
   defines \<open>f\<close> using the representation function.
 
   For each constant \<open>f.abs_eq\<close> is generated. The equation is unconditional for
   total quotients. The equation defines \<open>f\<close> using the abstraction function.
 
   \<^medskip>
   Integration with [@{attribute code} abstract]: For subtypes (e.g.\
   corresponding to a datatype invariant, such as \<^typ>\<open>'a dlist\<close>), @{command
   (HOL) "lift_definition"} uses a code certificate theorem \<open>f.rep_eq\<close> as a
   code equation. Because of the limitation of the code generator, \<open>f.rep_eq\<close>
   cannot be used as a code equation if the subtype occurs inside the result
   type rather than at the top level (e.g.\ function returning \<^typ>\<open>'a dlist
   option\<close> vs. \<^typ>\<open>'a dlist\<close>).
 
   In this case, an extension of @{command (HOL) "lift_definition"} can be
   invoked by specifying the flag \<open>code_dt\<close>. This extension enables code
   execution through series of internal type and lifting definitions if the
   return type \<open>\<tau>\<close> meets the following inductive conditions:
 
     \<^descr> \<open>\<tau>\<close> is a type variable
 
     \<^descr> \<open>\<tau> = \<tau>\<^sub>1 \<dots> \<tau>\<^sub>n \<kappa>\<close>, where \<open>\<kappa>\<close> is an abstract type constructor and \<open>\<tau>\<^sub>1 \<dots>
     \<tau>\<^sub>n\<close> do not contain abstract types (i.e.\ \<^typ>\<open>int dlist\<close> is allowed
     whereas \<^typ>\<open>int dlist dlist\<close> not)
 
     \<^descr> \<open>\<tau> = \<tau>\<^sub>1 \<dots> \<tau>\<^sub>n \<kappa>\<close>, \<open>\<kappa>\<close> is a type constructor that was defined as a
     (co)datatype whose constructor argument types do not contain either
     non-free datatypes or the function type.
 
   Integration with [@{attribute code} equation]: For total quotients,
   @{command (HOL) "lift_definition"} uses \<open>f.abs_eq\<close> as a code equation.
 
   \<^descr> @{command (HOL) lifting_forget} and @{command (HOL) lifting_update} These
   two commands serve for storing and deleting the set-up of the Lifting
   package and corresponding transfer rules defined by this package. This is
   useful for hiding of type construction details of an abstract type when the
   construction is finished but it still allows additions to this construction
   when this is later necessary.
 
   Whenever the Lifting package is set up with a new abstract type \<open>\<tau>\<close> by
   @{command_def (HOL) "lift_definition"}, the package defines a new bundle
   that is called \<open>\<tau>.lifting\<close>. This bundle already includes set-up for the
   Lifting package. The new transfer rules introduced by @{command (HOL)
   "lift_definition"} can be stored in the bundle by the command @{command
   (HOL) "lifting_update"} \<open>\<tau>.lifting\<close>.
 
   The command @{command (HOL) "lifting_forget"} \<open>\<tau>.lifting\<close> deletes set-up of
   the Lifting package for \<open>\<tau>\<close> and deletes all the transfer rules that were
   introduced by @{command (HOL) "lift_definition"} using \<open>\<tau>\<close> as an abstract
   type.
 
   The stored set-up in a bundle can be reintroduced by the Isar commands for
   including a bundle (@{command "include"}, @{keyword "includes"} and
   @{command "including"}).
 
   \<^descr> @{command (HOL) "print_quot_maps"} prints stored quotient map theorems.
 
   \<^descr> @{command (HOL) "print_quotients"} prints stored quotient theorems.
 
   \<^descr> @{attribute (HOL) quot_map} registers a quotient map theorem, a theorem
   showing how to ``lift'' quotients over type constructors. E.g.\ \<^term>\<open>Quotient R Abs Rep T \<Longrightarrow> Quotient (rel_set R) (image Abs) (image Rep)
   (rel_set T)\<close>. For examples see \<^file>\<open>~~/src/HOL/Lifting_Set.thy\<close> or
   \<^file>\<open>~~/src/HOL/Lifting.thy\<close>. This property is proved automatically if the
   involved type is BNF without dead variables.
 
   \<^descr> @{attribute (HOL) relator_eq_onp} registers a theorem that shows that a
   relator applied to an equality restricted by a predicate \<^term>\<open>P\<close> (i.e.\
   \<^term>\<open>eq_onp P\<close>) is equal to a predicator applied to the \<^term>\<open>P\<close>. The
   combinator \<^const>\<open>eq_onp\<close> is used for internal encoding of proper subtypes.
   Such theorems allows the package to hide \<open>eq_onp\<close> from a user in a
   user-readable form of a respectfulness theorem. For examples see
   \<^file>\<open>~~/src/HOL/Lifting_Set.thy\<close> or \<^file>\<open>~~/src/HOL/Lifting.thy\<close>. This property
   is proved automatically if the involved type is BNF without dead variables.
 
   \<^descr> @{attribute (HOL) "relator_mono"} registers a property describing a
   monotonicity of a relator. E.g.\ \<^prop>\<open>A \<le> B \<Longrightarrow> rel_set A \<le> rel_set B\<close>.
   This property is needed for proving a stronger transfer rule in
   @{command_def (HOL) "lift_definition"} when a parametricity theorem for the
   raw term is specified and also for the reflexivity prover. For examples see
   \<^file>\<open>~~/src/HOL/Lifting_Set.thy\<close> or \<^file>\<open>~~/src/HOL/Lifting.thy\<close>. This property
   is proved automatically if the involved type is BNF without dead variables.
 
   \<^descr> @{attribute (HOL) "relator_distr"} registers a property describing a
   distributivity of the relation composition and a relator. E.g.\ \<open>rel_set R
   \<circ>\<circ> rel_set S = rel_set (R \<circ>\<circ> S)\<close>. This property is needed for proving a
   stronger transfer rule in @{command_def (HOL) "lift_definition"} when a
   parametricity theorem for the raw term is specified. When this equality does
   not hold unconditionally (e.g.\ for the function type), the user can
   specified each direction separately and also register multiple theorems with
   different set of assumptions. This attribute can be used only after the
   monotonicity property was already registered by @{attribute (HOL)
   "relator_mono"}. For examples see \<^file>\<open>~~/src/HOL/Lifting_Set.thy\<close> or
   \<^file>\<open>~~/src/HOL/Lifting.thy\<close>. This property is proved automatically if the
   involved type is BNF without dead variables.
 
   \<^descr> @{attribute (HOL) quot_del} deletes a corresponding Quotient theorem from
   the Lifting infrastructure and thus de-register the corresponding quotient.
   This effectively causes that @{command (HOL) lift_definition} will not do
   any lifting for the corresponding type. This attribute is rather used for
   low-level manipulation with set-up of the Lifting package because @{command
   (HOL) lifting_forget} is preferred for normal usage.
 
   \<^descr> @{attribute (HOL) lifting_restore} \<open>Quotient_thm pcr_def pcr_cr_eq_thm\<close>
   registers the Quotient theorem \<open>Quotient_thm\<close> in the Lifting infrastructure
   and thus sets up lifting for an abstract type \<open>\<tau>\<close> (that is defined by
   \<open>Quotient_thm\<close>). Optional theorems \<open>pcr_def\<close> and \<open>pcr_cr_eq_thm\<close> can be
   specified to register the parametrized correspondence relation for \<open>\<tau>\<close>.
   E.g.\ for \<^typ>\<open>'a dlist\<close>, \<open>pcr_def\<close> is \<open>pcr_dlist A \<equiv> list_all2 A \<circ>\<circ>
   cr_dlist\<close> and \<open>pcr_cr_eq_thm\<close> is \<open>pcr_dlist (=) = (=)\<close>. This attribute
   is rather used for low-level manipulation with set-up of the Lifting package
   because using of the bundle \<open>\<tau>.lifting\<close> together with the commands @{command
   (HOL) lifting_forget} and @{command (HOL) lifting_update} is preferred for
   normal usage.
 
-  \<^descr> Integration with the BNF package @{cite "isabelle-datatypes"}: As already
+  \<^descr> Integration with the BNF package \<^cite>\<open>"isabelle-datatypes"\<close>: As already
   mentioned, the theorems that are registered by the following attributes are
   proved and registered automatically if the involved type is BNF without dead
   variables: @{attribute (HOL) quot_map}, @{attribute (HOL) relator_eq_onp},
   @{attribute (HOL) "relator_mono"}, @{attribute (HOL) "relator_distr"}. Also
   the definition of a relator and predicator is provided automatically.
   Moreover, if the BNF represents a datatype, simplification rules for a
   predicator are again proved automatically.
 \<close>
 
 
 subsection \<open>Transfer package \label{sec:transfer}\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{method_def (HOL) "transfer"} & : & \<open>method\<close> \\
     @{method_def (HOL) "transfer'"} & : & \<open>method\<close> \\
     @{method_def (HOL) "transfer_prover"} & : & \<open>method\<close> \\
     @{attribute_def (HOL) "Transfer.transferred"} & : & \<open>attribute\<close> \\
     @{attribute_def (HOL) "untransferred"} & : & \<open>attribute\<close> \\
     @{method_def (HOL) "transfer_start"} & : & \<open>method\<close> \\
     @{method_def (HOL) "transfer_prover_start"} & : & \<open>method\<close> \\
     @{method_def (HOL) "transfer_step"} & : & \<open>method\<close> \\
     @{method_def (HOL) "transfer_end"} & : & \<open>method\<close> \\
     @{method_def (HOL) "transfer_prover_end"} & : & \<open>method\<close> \\
     @{attribute_def (HOL) "transfer_rule"} & : & \<open>attribute\<close> \\
     @{attribute_def (HOL) "transfer_domain_rule"} & : & \<open>attribute\<close> \\
     @{attribute_def (HOL) "relator_eq"} & : & \<open>attribute\<close> \\
     @{attribute_def (HOL) "relator_domain"} & : & \<open>attribute\<close> \\
   \end{matharray}
 
   \<^descr> @{method (HOL) "transfer"} method replaces the current subgoal with a
   logically equivalent one that uses different types and constants. The
   replacement of types and constants is guided by the database of transfer
   rules. Goals are generalized over all free variables by default; this is
   necessary for variables whose types change, but can be overridden for
   specific variables with e.g. \<open>transfer fixing: x y z\<close>.
 
   \<^descr> @{method (HOL) "transfer'"} is a variant of @{method (HOL) transfer} that
   allows replacing a subgoal with one that is logically stronger (rather than
   equivalent). For example, a subgoal involving equality on a quotient type
   could be replaced with a subgoal involving equality (instead of the
   corresponding equivalence relation) on the underlying raw type.
 
   \<^descr> @{method (HOL) "transfer_prover"} method assists with proving a transfer
   rule for a new constant, provided the constant is defined in terms of other
   constants that already have transfer rules. It should be applied after
   unfolding the constant definitions.
 
   \<^descr> @{method (HOL) "transfer_start"}, @{method (HOL) "transfer_step"},
   @{method (HOL) "transfer_end"}, @{method (HOL) "transfer_prover_start"} and
   @{method (HOL) "transfer_prover_end"} methods are meant to be used for
   debugging of @{method (HOL) "transfer"} and @{method (HOL)
   "transfer_prover"}, which we can decompose as follows: @{method (HOL)
   "transfer"} = (@{method (HOL) "transfer_start"}, @{method (HOL)
   "transfer_step"}+, @{method (HOL) "transfer_end"}) and @{method (HOL)
   "transfer_prover"} = (@{method (HOL) "transfer_prover_start"}, @{method
   (HOL) "transfer_step"}+, @{method (HOL) "transfer_prover_end"}). For usage
   examples see \<^file>\<open>~~/src/HOL/ex/Transfer_Debug.thy\<close>.
 
   \<^descr> @{attribute (HOL) "untransferred"} proves the same equivalent theorem as
   @{method (HOL) "transfer"} internally does.
 
   \<^descr> @{attribute (HOL) Transfer.transferred} works in the opposite direction
   than @{method (HOL) "transfer'"}. E.g.\ given the transfer relation \<open>ZN x n
   \<equiv> (x = int n)\<close>, corresponding transfer rules and the theorem \<open>\<forall>x::int \<in>
   {0..}. x < x + 1\<close>, the attribute would prove \<open>\<forall>n::nat. n < n + 1\<close>. The
   attribute is still in experimental phase of development.
 
   \<^descr> @{attribute (HOL) "transfer_rule"} attribute maintains a collection of
   transfer rules, which relate constants at two different types. Typical
   transfer rules may relate different type instances of the same polymorphic
   constant, or they may relate an operation on a raw type to a corresponding
   operation on an abstract type (quotient or subtype). For example:
 
     \<open>((A ===> B) ===> list_all2 A ===> list_all2 B) map map\<close> \\
     \<open>(cr_int ===> cr_int ===> cr_int) (\<lambda>(x,y) (u,v). (x+u, y+v)) plus\<close>
 
   Lemmas involving predicates on relations can also be registered using the
   same attribute. For example:
 
     \<open>bi_unique A \<Longrightarrow> (list_all2 A ===> (=)) distinct distinct\<close> \\
     \<open>\<lbrakk>bi_unique A; bi_unique B\<rbrakk> \<Longrightarrow> bi_unique (rel_prod A B)\<close>
 
   Preservation of predicates on relations (\<open>bi_unique, bi_total, right_unique,
   right_total, left_unique, left_total\<close>) with the respect to a relator is
-  proved automatically if the involved type is BNF @{cite
-  "isabelle-datatypes"} without dead variables.
+  proved automatically if the involved type is BNF \<^cite>\<open>"isabelle-datatypes"\<close> without dead variables.
 
   \<^descr> @{attribute (HOL) "transfer_domain_rule"} attribute maintains a collection
   of rules, which specify a domain of a transfer relation by a predicate.
   E.g.\ given the transfer relation \<open>ZN x n \<equiv> (x = int n)\<close>, one can register
   the following transfer domain rule: \<open>Domainp ZN = (\<lambda>x. x \<ge> 0)\<close>. The rules
   allow the package to produce more readable transferred goals, e.g.\ when
   quantifiers are transferred.
 
   \<^descr> @{attribute (HOL) relator_eq} attribute collects identity laws for
   relators of various type constructors, e.g. \<^term>\<open>rel_set (=) = (=)\<close>.
   The @{method (HOL) transfer} method uses these lemmas to infer
   transfer rules for non-polymorphic constants on the fly. For examples see
   \<^file>\<open>~~/src/HOL/Lifting_Set.thy\<close> or \<^file>\<open>~~/src/HOL/Lifting.thy\<close>. This property
   is proved automatically if the involved type is BNF without dead variables.
 
   \<^descr> @{attribute_def (HOL) "relator_domain"} attribute collects rules
   describing domains of relators by predicators. E.g.\ \<^term>\<open>Domainp
   (rel_set T) = (\<lambda>A. Ball A (Domainp T))\<close>. This allows the package to lift
   transfer domain rules through type constructors. For examples see
   \<^file>\<open>~~/src/HOL/Lifting_Set.thy\<close> or \<^file>\<open>~~/src/HOL/Lifting.thy\<close>. This property
   is proved automatically if the involved type is BNF without dead variables.
 
 
-  Theoretical background can be found in @{cite
-  "Huffman-Kuncar:2013:lifting_transfer"}.
+  Theoretical background can be found in \<^cite>\<open>"Huffman-Kuncar:2013:lifting_transfer"\<close>.
 \<close>
 
 
 subsection \<open>Old-style definitions for quotient types \label{sec:old-quotient}\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{command_def (HOL) "quotient_definition"} & : & \<open>local_theory \<rightarrow> proof(prove)\<close>\\
     @{command_def (HOL) "print_quotmapsQ3"} & : & \<open>context \<rightarrow>\<close>\\
     @{command_def (HOL) "print_quotientsQ3"} & : & \<open>context \<rightarrow>\<close>\\
     @{command_def (HOL) "print_quotconsts"} & : & \<open>context \<rightarrow>\<close>\\
     @{method_def (HOL) "lifting"} & : & \<open>method\<close> \\
     @{method_def (HOL) "lifting_setup"} & : & \<open>method\<close> \\
     @{method_def (HOL) "descending"} & : & \<open>method\<close> \\
     @{method_def (HOL) "descending_setup"} & : & \<open>method\<close> \\
     @{method_def (HOL) "partiality_descending"} & : & \<open>method\<close> \\
     @{method_def (HOL) "partiality_descending_setup"} & : & \<open>method\<close> \\
     @{method_def (HOL) "regularize"} & : & \<open>method\<close> \\
     @{method_def (HOL) "injection"} & : & \<open>method\<close> \\
     @{method_def (HOL) "cleaning"} & : & \<open>method\<close> \\
     @{attribute_def (HOL) "quot_thm"} & : & \<open>attribute\<close> \\
     @{attribute_def (HOL) "quot_lifted"} & : & \<open>attribute\<close> \\
     @{attribute_def (HOL) "quot_respect"} & : & \<open>attribute\<close> \\
     @{attribute_def (HOL) "quot_preserve"} & : & \<open>attribute\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     @@{command (HOL) quotient_definition} constdecl? @{syntax thmdecl}? \<newline>
     @{syntax term} 'is' @{syntax term}
     ;
     constdecl: @{syntax name} ('::' @{syntax type})? @{syntax mixfix}?
     ;
     @@{method (HOL) lifting} @{syntax thms}?
     ;
     @@{method (HOL) lifting_setup} @{syntax thms}?
   \<close>
 
   \<^descr> @{command (HOL) "quotient_definition"} defines a constant on the quotient
   type.
 
   \<^descr> @{command (HOL) "print_quotmapsQ3"} prints quotient map functions.
 
   \<^descr> @{command (HOL) "print_quotientsQ3"} prints quotients.
 
   \<^descr> @{command (HOL) "print_quotconsts"} prints quotient constants.
 
   \<^descr> @{method (HOL) "lifting"} and @{method (HOL) "lifting_setup"} methods
   match the current goal with the given raw theorem to be lifted producing
   three new subgoals: regularization, injection and cleaning subgoals.
   @{method (HOL) "lifting"} tries to apply the heuristics for automatically
   solving these three subgoals and leaves only the subgoals unsolved by the
   heuristics to the user as opposed to @{method (HOL) "lifting_setup"} which
   leaves the three subgoals unsolved.
 
   \<^descr> @{method (HOL) "descending"} and @{method (HOL) "descending_setup"} try to
   guess a raw statement that would lift to the current subgoal. Such statement
   is assumed as a new subgoal and @{method (HOL) "descending"} continues in
   the same way as @{method (HOL) "lifting"} does. @{method (HOL) "descending"}
   tries to solve the arising regularization, injection and cleaning subgoals
   with the analogous method @{method (HOL) "descending_setup"} which leaves
   the four unsolved subgoals.
 
   \<^descr> @{method (HOL) "partiality_descending"} finds the regularized theorem that
   would lift to the current subgoal, lifts it and leaves as a subgoal. This
   method can be used with partial equivalence quotients where the non
   regularized statements would not be true. @{method (HOL)
   "partiality_descending_setup"} leaves the injection and cleaning subgoals
   unchanged.
 
   \<^descr> @{method (HOL) "regularize"} applies the regularization heuristics to the
   current subgoal.
 
   \<^descr> @{method (HOL) "injection"} applies the injection heuristics to the
   current goal using the stored quotient respectfulness theorems.
 
   \<^descr> @{method (HOL) "cleaning"} applies the injection cleaning heuristics to
   the current subgoal using the stored quotient preservation theorems.
 
   \<^descr> @{attribute (HOL) quot_lifted} attribute tries to automatically transport
   the theorem to the quotient type. The attribute uses all the defined
   quotients types and quotient constants often producing undesired results or
   theorems that cannot be lifted.
 
   \<^descr> @{attribute (HOL) quot_respect} and @{attribute (HOL) quot_preserve}
   attributes declare a theorem as a respectfulness and preservation theorem
   respectively. These are stored in the local theory store and used by the
   @{method (HOL) "injection"} and @{method (HOL) "cleaning"} methods
   respectively.
 
   \<^descr> @{attribute (HOL) quot_thm} declares that a certain theorem is a quotient
   extension theorem. Quotient extension theorems allow for quotienting inside
   container types. Given a polymorphic type that serves as a container, a map
   function defined for this container using @{command (HOL) "functor"} and a
   relation map defined for for the container type, the quotient extension
   theorem should be \<^term>\<open>Quotient3 R Abs Rep \<Longrightarrow> Quotient3 (rel_map R) (map
   Abs) (map Rep)\<close>. Quotient extension theorems are stored in a database and
   are used all the steps of lifting theorems.
 \<close>
 
 
 chapter \<open>Proof tools\<close>
 
 section \<open>Proving propositions\<close>
 
 text \<open>
   In addition to the standard proof methods, a number of diagnosis tools
   search for proofs and provide an Isar proof snippet on success. These tools
   are available via the following commands.
 
   \begin{matharray}{rcl}
     @{command_def (HOL) "solve_direct"}\<open>\<^sup>*\<close> & : & \<open>proof \<rightarrow>\<close> \\
     @{command_def (HOL) "try"}\<open>\<^sup>*\<close> & : & \<open>proof \<rightarrow>\<close> \\
     @{command_def (HOL) "try0"}\<open>\<^sup>*\<close> & : & \<open>proof \<rightarrow>\<close> \\
     @{command_def (HOL) "sledgehammer"}\<open>\<^sup>*\<close> & : & \<open>proof \<rightarrow>\<close> \\
     @{command_def (HOL) "sledgehammer_params"} & : & \<open>theory \<rightarrow> theory\<close>
   \end{matharray}
 
   \<^rail>\<open>
     @@{command (HOL) try}
     ;
 
     @@{command (HOL) try0} ( ( ( 'simp' | 'intro' | 'elim' | 'dest' ) ':' @{syntax thms} ) + ) ?
       @{syntax nat}?
     ;
 
     @@{command (HOL) sledgehammer} ( '[' args ']' )? facts? @{syntax nat}?
     ;
 
     @@{command (HOL) sledgehammer_params} ( ( '[' args ']' ) ? )
     ;
     args: ( @{syntax name} '=' value + ',' )
     ;
     facts: '(' ( ( ( ( 'add' | 'del' ) ':' ) ? @{syntax thms} ) + ) ? ')'
   \<close> % FIXME check args "value"
 
   \<^descr> @{command (HOL) "solve_direct"} checks whether the current subgoals can be
   solved directly by an existing theorem. Duplicate lemmas can be detected in
   this way.
 
   \<^descr> @{command (HOL) "try0"} attempts to prove a subgoal using a combination of
   standard proof methods (@{method auto}, @{method simp}, @{method blast},
   etc.). Additional facts supplied via \<open>simp:\<close>, \<open>intro:\<close>, \<open>elim:\<close>, and \<open>dest:\<close>
   are passed to the appropriate proof methods.
 
   \<^descr> @{command (HOL) "try"} attempts to prove or disprove a subgoal using a
   combination of provers and disprovers (@{command (HOL) "solve_direct"},
   @{command (HOL) "quickcheck"}, @{command (HOL) "try0"}, @{command (HOL)
   "sledgehammer"}, @{command (HOL) "nitpick"}).
 
   \<^descr> @{command (HOL) "sledgehammer"} attempts to prove a subgoal using external
   automatic provers (resolution provers and SMT solvers). See the Sledgehammer
-  manual @{cite "isabelle-sledgehammer"} for details.
+  manual \<^cite>\<open>"isabelle-sledgehammer"\<close> for details.
 
   \<^descr> @{command (HOL) "sledgehammer_params"} changes @{command (HOL)
   "sledgehammer"} configuration options persistently.
 \<close>
 
 
 section \<open>Checking and refuting propositions\<close>
 
 text \<open>
   Identifying incorrect propositions usually involves evaluation of particular
   assignments and systematic counterexample search. This is supported by the
   following commands.
 
   \begin{matharray}{rcl}
     @{command_def (HOL) "value"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
     @{command_def (HOL) "values"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
     @{command_def (HOL) "quickcheck"}\<open>\<^sup>*\<close> & : & \<open>proof \<rightarrow>\<close> \\
     @{command_def (HOL) "nitpick"}\<open>\<^sup>*\<close> & : & \<open>proof \<rightarrow>\<close> \\
     @{command_def (HOL) "quickcheck_params"} & : & \<open>theory \<rightarrow> theory\<close> \\
     @{command_def (HOL) "nitpick_params"} & : & \<open>theory \<rightarrow> theory\<close> \\
     @{command_def (HOL) "quickcheck_generator"} & : & \<open>theory \<rightarrow> theory\<close> \\
     @{command_def (HOL) "find_unused_assms"} & : & \<open>context \<rightarrow>\<close>
   \end{matharray}
 
   \<^rail>\<open>
     @@{command (HOL) value} ( '[' @{syntax name} ']' )? modes? @{syntax term}
     ;
 
     @@{command (HOL) values} modes? @{syntax nat}? @{syntax term}
     ;
 
     (@@{command (HOL) quickcheck} | @@{command (HOL) nitpick})
       ( '[' args ']' )? @{syntax nat}?
     ;
 
     (@@{command (HOL) quickcheck_params} |
       @@{command (HOL) nitpick_params}) ( '[' args ']' )?
     ;
 
     @@{command (HOL) quickcheck_generator} @{syntax name} \<newline>
       'operations:' ( @{syntax term} +)
     ;
 
     @@{command (HOL) find_unused_assms} @{syntax name}?
     ;
     modes: '(' (@{syntax name} +) ')'
     ;
     args: ( @{syntax name} '=' value + ',' )
   \<close> % FIXME check "value"
 
   \<^descr> @{command (HOL) "value"}~\<open>t\<close> evaluates and prints a term; optionally
   \<open>modes\<close> can be specified, which are appended to the current print mode; see
   \secref{sec:print-modes}. Evaluation is tried first using ML, falling back
   to normalization by evaluation if this fails. Alternatively a specific
   evaluator can be selected using square brackets; typical evaluators use the
   current set of code equations to normalize and include \<open>simp\<close> for fully
   symbolic evaluation using the simplifier, \<open>nbe\<close> for \<^emph>\<open>normalization by
   evaluation\<close> and \<^emph>\<open>code\<close> for code generation in SML.
 
   \<^descr> @{command (HOL) "values"}~\<open>t\<close> enumerates a set comprehension by evaluation
   and prints its values up to the given number of solutions; optionally
   \<open>modes\<close> can be specified, which are appended to the current print mode; see
   \secref{sec:print-modes}.
 
   \<^descr> @{command (HOL) "quickcheck"} tests the current goal for counterexamples
   using a series of assignments for its free variables; by default the first
   subgoal is tested, an other can be selected explicitly using an optional
   goal index. Assignments can be chosen exhausting the search space up to a
   given size, or using a fixed number of random assignments in the search
   space, or exploring the search space symbolically using narrowing. By
   default, quickcheck uses exhaustive testing. A number of configuration
   options are supported for @{command (HOL) "quickcheck"}, notably:
 
     \<^descr>[\<open>tester\<close>] specifies which testing approach to apply. There are three
     testers, \<open>exhaustive\<close>, \<open>random\<close>, and \<open>narrowing\<close>. An unknown configuration
     option is treated as an argument to tester, making \<open>tester =\<close> optional.
     When multiple testers are given, these are applied in parallel. If no
     tester is specified, quickcheck uses the testers that are set active,
     i.e.\ configurations @{attribute quickcheck_exhaustive_active},
     @{attribute quickcheck_random_active}, @{attribute
     quickcheck_narrowing_active} are set to true.
 
     \<^descr>[\<open>size\<close>] specifies the maximum size of the search space for assignment
     values.
 
     \<^descr>[\<open>genuine_only\<close>] sets quickcheck only to return genuine counterexample,
     but not potentially spurious counterexamples due to underspecified
     functions.
 
     \<^descr>[\<open>abort_potential\<close>] sets quickcheck to abort once it found a potentially
     spurious counterexample and to not continue to search for a further
     genuine counterexample. For this option to be effective, the
     \<open>genuine_only\<close> option must be set to false.
 
     \<^descr>[\<open>eval\<close>] takes a term or a list of terms and evaluates these terms under
     the variable assignment found by quickcheck. This option is currently only
     supported by the default (exhaustive) tester.
 
     \<^descr>[\<open>iterations\<close>] sets how many sets of assignments are generated for each
     particular size.
 
     \<^descr>[\<open>no_assms\<close>] specifies whether assumptions in structured proofs should be
     ignored.
 
     \<^descr>[\<open>locale\<close>] specifies how to process conjectures in a locale context,
     i.e.\ they can be interpreted or expanded. The option is a
     whitespace-separated list of the two words \<open>interpret\<close> and \<open>expand\<close>. The
     list determines the order they are employed. The default setting is to
     first use interpretations and then test the expanded conjecture. The
     option is only provided as attribute declaration, but not as parameter to
     the command.
 
     \<^descr>[\<open>timeout\<close>] sets the time limit in seconds.
 
     \<^descr>[\<open>default_type\<close>] sets the type(s) generally used to instantiate type
     variables.
 
     \<^descr>[\<open>report\<close>] if set quickcheck reports how many tests fulfilled the
     preconditions.
 
     \<^descr>[\<open>use_subtype\<close>] if set quickcheck automatically lifts conjectures to
     registered subtypes if possible, and tests the lifted conjecture.
 
     \<^descr>[\<open>quiet\<close>] if set quickcheck does not output anything while testing.
 
     \<^descr>[\<open>verbose\<close>] if set quickcheck informs about the current size and
     cardinality while testing.
 
     \<^descr>[\<open>expect\<close>] can be used to check if the user's expectation was met
     (\<open>no_expectation\<close>, \<open>no_counterexample\<close>, or \<open>counterexample\<close>).
 
   These option can be given within square brackets.
 
   Using the following type classes, the testers generate values and convert
   them back into Isabelle terms for displaying counterexamples.
 
     \<^descr>[\<open>exhaustive\<close>] The parameters of the type classes \<^class>\<open>exhaustive\<close> and
     \<^class>\<open>full_exhaustive\<close> implement the testing. They take a testing
     function as a parameter, which takes a value of type \<^typ>\<open>'a\<close> and
     optionally produces a counterexample, and a size parameter for the test
     values. In \<^class>\<open>full_exhaustive\<close>, the testing function parameter
     additionally expects a lazy term reconstruction in the type \<^typ>\<open>Code_Evaluation.term\<close> of the tested value.
 
     The canonical implementation for \<open>exhaustive\<close> testers calls the given
     testing function on all values up to the given size and stops as soon as a
     counterexample is found.
 
     \<^descr>[\<open>random\<close>] The operation \<^const>\<open>Quickcheck_Random.random\<close> of the type
     class \<^class>\<open>random\<close> generates a pseudo-random value of the given size
     and a lazy term reconstruction of the value in the type \<^typ>\<open>Code_Evaluation.term\<close>. A pseudo-randomness generator is defined in theory
     \<^theory>\<open>HOL.Random\<close>.
 
-    \<^descr>[\<open>narrowing\<close>] implements Haskell's Lazy Smallcheck @{cite
-    "runciman-naylor-lindblad"} using the type classes \<^class>\<open>narrowing\<close> and
+    \<^descr>[\<open>narrowing\<close>] implements Haskell's Lazy Smallcheck \<^cite>\<open>"runciman-naylor-lindblad"\<close> using the type classes \<^class>\<open>narrowing\<close> and
     \<^class>\<open>partial_term_of\<close>. Variables in the current goal are initially
     represented as symbolic variables. If the execution of the goal tries to
     evaluate one of them, the test engine replaces it with refinements
     provided by \<^const>\<open>narrowing\<close>. Narrowing views every value as a
     sum-of-products which is expressed using the operations \<^const>\<open>Quickcheck_Narrowing.cons\<close> (embedding a value), \<^const>\<open>Quickcheck_Narrowing.apply\<close> (product) and \<^const>\<open>Quickcheck_Narrowing.sum\<close> (sum). The refinement should enable further
     evaluation of the goal.
 
     For example, \<^const>\<open>narrowing\<close> for the list type \<^typ>\<open>'a :: narrowing list\<close>
     can be recursively defined as
     \<^term>\<open>Quickcheck_Narrowing.sum (Quickcheck_Narrowing.cons [])
               (Quickcheck_Narrowing.apply
                 (Quickcheck_Narrowing.apply
                   (Quickcheck_Narrowing.cons (#))
                   narrowing)
                 narrowing)\<close>.
     If a symbolic variable of type \<^typ>\<open>_ list\<close> is evaluated, it is
     replaced by (i)~the empty list \<^term>\<open>[]\<close> and (ii)~by a non-empty list
     whose head and tail can then be recursively refined if needed.
 
     To reconstruct counterexamples, the operation \<^const>\<open>partial_term_of\<close>
     transforms \<open>narrowing\<close>'s deep representation of terms to the type \<^typ>\<open>Code_Evaluation.term\<close>. The deep representation models symbolic variables
     as \<^const>\<open>Quickcheck_Narrowing.Narrowing_variable\<close>, which are normally
     converted to \<^const>\<open>Code_Evaluation.Free\<close>, and refined values as \<^term>\<open>Quickcheck_Narrowing.Narrowing_constructor i args\<close>, where \<^term>\<open>i ::
     integer\<close> denotes the index in the sum of refinements. In the above
     example for lists, \<^term>\<open>0\<close> corresponds to \<^term>\<open>[]\<close> and \<^term>\<open>1\<close>
     to \<^term>\<open>(#)\<close>.
 
     The command @{command (HOL) "code_datatype"} sets up \<^const>\<open>partial_term_of\<close> such that the \<^term>\<open>i\<close>-th refinement is interpreted as
     the \<^term>\<open>i\<close>-th constructor, but it does not ensures consistency with
     \<^const>\<open>narrowing\<close>.
 
   \<^descr> @{command (HOL) "quickcheck_params"} changes @{command (HOL) "quickcheck"}
   configuration options persistently.
 
   \<^descr> @{command (HOL) "quickcheck_generator"} creates random and exhaustive
   value generators for a given type and operations. It generates values by
   using the operations as if they were constructors of that type.
 
   \<^descr> @{command (HOL) "nitpick"} tests the current goal for counterexamples
   using a reduction to first-order relational logic. See the Nitpick manual
-  @{cite "isabelle-nitpick"} for details.
+  \<^cite>\<open>"isabelle-nitpick"\<close> for details.
 
   \<^descr> @{command (HOL) "nitpick_params"} changes @{command (HOL) "nitpick"}
   configuration options persistently.
 
   \<^descr> @{command (HOL) "find_unused_assms"} finds potentially superfluous
   assumptions in theorems using quickcheck. It takes the theory name to be
   checked for superfluous assumptions as optional argument. If not provided,
   it checks the current theory. Options to the internal quickcheck invocations
   can be changed with common configuration declarations.
 \<close>
 
 
 section \<open>Coercive subtyping\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{attribute_def (HOL) coercion} & : & \<open>attribute\<close> \\
     @{attribute_def (HOL) coercion_delete} & : & \<open>attribute\<close> \\
     @{attribute_def (HOL) coercion_enabled} & : & \<open>attribute\<close> \\
     @{attribute_def (HOL) coercion_map} & : & \<open>attribute\<close> \\
     @{attribute_def (HOL) coercion_args} & : & \<open>attribute\<close> \\
   \end{matharray}
 
   Coercive subtyping allows the user to omit explicit type conversions, also
   called \<^emph>\<open>coercions\<close>. Type inference will add them as necessary when parsing
-  a term. See @{cite "traytel-berghofer-nipkow-2011"} for details.
+  a term. See \<^cite>\<open>"traytel-berghofer-nipkow-2011"\<close> for details.
 
   \<^rail>\<open>
     @@{attribute (HOL) coercion} (@{syntax term})
     ;
     @@{attribute (HOL) coercion_delete} (@{syntax term})
     ;
     @@{attribute (HOL) coercion_map} (@{syntax term})
     ;
     @@{attribute (HOL) coercion_args} (@{syntax const}) (('+' | '0' | '-')+)
   \<close>
 
   \<^descr> @{attribute (HOL) "coercion"}~\<open>f\<close> registers a new coercion function \<open>f ::
   \<sigma>\<^sub>1 \<Rightarrow> \<sigma>\<^sub>2\<close> where \<open>\<sigma>\<^sub>1\<close> and \<open>\<sigma>\<^sub>2\<close> are type constructors without arguments.
   Coercions are composed by the inference algorithm if needed. Note that the
   type inference algorithm is complete only if the registered coercions form a
   lattice.
 
   \<^descr> @{attribute (HOL) "coercion_delete"}~\<open>f\<close> deletes a preceding declaration
   (using @{attribute (HOL) "coercion"}) of the function \<open>f :: \<sigma>\<^sub>1 \<Rightarrow> \<sigma>\<^sub>2\<close> as a
   coercion.
 
   \<^descr> @{attribute (HOL) "coercion_map"}~\<open>map\<close> registers a new map function to
   lift coercions through type constructors. The function \<open>map\<close> must conform to
   the following type pattern
 
   \begin{matharray}{lll}
     \<open>map\<close> & \<open>::\<close> &
       \<open>f\<^sub>1 \<Rightarrow> \<dots> \<Rightarrow> f\<^sub>n \<Rightarrow> (\<alpha>\<^sub>1, \<dots>, \<alpha>\<^sub>n) t \<Rightarrow> (\<beta>\<^sub>1, \<dots>, \<beta>\<^sub>n) t\<close> \\
   \end{matharray}
 
   where \<open>t\<close> is a type constructor and \<open>f\<^sub>i\<close> is of type \<open>\<alpha>\<^sub>i \<Rightarrow> \<beta>\<^sub>i\<close> or \<open>\<beta>\<^sub>i \<Rightarrow>
   \<alpha>\<^sub>i\<close>. Registering a map function overwrites any existing map function for
   this particular type constructor.
 
   \<^descr> @{attribute (HOL) "coercion_args"} can be used to disallow coercions to be
   inserted in certain positions in a term. For example, given the constant \<open>c
   :: \<sigma>\<^sub>1 \<Rightarrow> \<sigma>\<^sub>2 \<Rightarrow> \<sigma>\<^sub>3 \<Rightarrow> \<sigma>\<^sub>4\<close> and the list of policies \<open>- + 0\<close> as arguments,
   coercions will not be inserted in the first argument of \<open>c\<close> (policy \<open>-\<close>);
   they may be inserted in the second argument (policy \<open>+\<close>) even if the
   constant \<open>c\<close> itself is in a position where coercions are disallowed; the
   third argument inherits the allowance of coercsion insertion from the
   position of the constant \<open>c\<close> (policy \<open>0\<close>). The standard usage of policies is
   the definition of syntatic constructs (usually extralogical, i.e., processed
   and stripped during type inference), that should not be destroyed by the
   insertion of coercions (see, for example, the setup for the case syntax in
   \<^theory>\<open>HOL.Ctr_Sugar\<close>).
 
   \<^descr> @{attribute (HOL) "coercion_enabled"} enables the coercion inference
   algorithm.
 \<close>
 
 
 section \<open>Arithmetic proof support\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{method_def (HOL) arith} & : & \<open>method\<close> \\
     @{attribute_def (HOL) arith} & : & \<open>attribute\<close> \\
     @{attribute_def (HOL) linarith_split} & : & \<open>attribute\<close> \\
   \end{matharray}
 
   \<^descr> @{method (HOL) arith} decides linear arithmetic problems (on types \<open>nat\<close>,
   \<open>int\<close>, \<open>real\<close>). Any current facts are inserted into the goal before running
   the procedure.
 
   \<^descr> @{attribute (HOL) arith} declares facts that are supplied to the
   arithmetic provers implicitly.
 
   \<^descr> @{attribute (HOL) linarith_split} attribute declares case split rules to be
   expanded before @{method (HOL) arith} is invoked.
 
 
   Note that a simpler (but faster) arithmetic prover is already invoked by the
   Simplifier.
 \<close>
 
 
 section \<open>Intuitionistic proof search\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{method_def (HOL) iprover} & : & \<open>method\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     @@{method (HOL) iprover} (@{syntax rulemod} *)
   \<close>
 
   \<^descr> @{method (HOL) iprover} performs intuitionistic proof search, depending on
   specifically declared rules from the context, or given as explicit
   arguments. Chained facts are inserted into the goal before commencing proof
   search.
 
   Rules need to be classified as @{attribute (Pure) intro}, @{attribute (Pure)
   elim}, or @{attribute (Pure) dest}; here the ``\<open>!\<close>'' indicator refers to
   ``safe'' rules, which may be applied aggressively (without considering
   back-tracking later). Rules declared with ``\<open>?\<close>'' are ignored in proof
   search (the single-step @{method (Pure) rule} method still observes these).
   An explicit weight annotation may be given as well; otherwise the number of
   rule premises will be taken into account here.
 \<close>
 
 
 section \<open>Model Elimination and Resolution\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{method_def (HOL) "meson"} & : & \<open>method\<close> \\
     @{method_def (HOL) "metis"} & : & \<open>method\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     @@{method (HOL) meson} @{syntax thms}?
     ;
     @@{method (HOL) metis}
       ('(' ('partial_types' | 'full_types' | 'no_types' | @{syntax name}) ')')?
       @{syntax thms}?
   \<close>
 
   \<^descr> @{method (HOL) meson} implements Loveland's model elimination procedure
-  @{cite "loveland-78"}. See \<^file>\<open>~~/src/HOL/ex/Meson_Test.thy\<close> for examples.
+  \<^cite>\<open>"loveland-78"\<close>. See \<^file>\<open>~~/src/HOL/ex/Meson_Test.thy\<close> for examples.
 
   \<^descr> @{method (HOL) metis} combines ordered resolution and ordered
   paramodulation to find first-order (or mildly higher-order) proofs. The
   first optional argument specifies a type encoding; see the Sledgehammer
-  manual @{cite "isabelle-sledgehammer"} for details. The directory
+  manual \<^cite>\<open>"isabelle-sledgehammer"\<close> for details. The directory
   \<^dir>\<open>~~/src/HOL/Metis_Examples\<close> contains several small theories developed to a
   large extent using @{method (HOL) metis}.
 \<close>
 
 
 section \<open>Algebraic reasoning via Gröbner bases\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{method_def (HOL) "algebra"} & : & \<open>method\<close> \\
     @{attribute_def (HOL) algebra} & : & \<open>attribute\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     @@{method (HOL) algebra}
       ('add' ':' @{syntax thms})?
       ('del' ':' @{syntax thms})?
     ;
     @@{attribute (HOL) algebra} (() | 'add' | 'del')
   \<close>
 
   \<^descr> @{method (HOL) algebra} performs algebraic reasoning via Gröbner bases,
-  see also @{cite "Chaieb-Wenzel:2007"} and @{cite \<open>\S3.2\<close> "Chaieb-thesis"}.
+  see also \<^cite>\<open>"Chaieb-Wenzel:2007"\<close> and \<^cite>\<open>\<open>\S3.2\<close> in "Chaieb-thesis"\<close>.
   The method handles deals with two main classes of problems:
 
     \<^enum> Universal problems over multivariate polynomials in a
     (semi)-ring/field/idom; the capabilities of the method are augmented
     according to properties of these structures. For this problem class the
     method is only complete for algebraically closed fields, since the
     underlying method is based on Hilbert's Nullstellensatz, where the
     equivalence only holds for algebraically closed fields.
 
     The problems can contain equations \<open>p = 0\<close> or inequations \<open>q \<noteq> 0\<close> anywhere
     within a universal problem statement.
 
     \<^enum> All-exists problems of the following restricted (but useful) form:
 
     @{text [display] "\<forall>x\<^sub>1 \<dots> x\<^sub>n.
       e\<^sub>1(x\<^sub>1, \<dots>, x\<^sub>n) = 0 \<and> \<dots> \<and> e\<^sub>m(x\<^sub>1, \<dots>, x\<^sub>n) = 0 \<longrightarrow>
       (\<exists>y\<^sub>1 \<dots> y\<^sub>k.
         p\<^sub>1\<^sub>1(x\<^sub>1, \<dots> ,x\<^sub>n) * y\<^sub>1 + \<dots> + p\<^sub>1\<^sub>k(x\<^sub>1, \<dots>, x\<^sub>n) * y\<^sub>k = 0 \<and>
         \<dots> \<and>
         p\<^sub>t\<^sub>1(x\<^sub>1, \<dots>, x\<^sub>n) * y\<^sub>1 + \<dots> + p\<^sub>t\<^sub>k(x\<^sub>1, \<dots>, x\<^sub>n) * y\<^sub>k = 0)"}
 
     Here \<open>e\<^sub>1, \<dots>, e\<^sub>n\<close> and the \<open>p\<^sub>i\<^sub>j\<close> are multivariate polynomials only in
     the variables mentioned as arguments.
 
   The proof method is preceded by a simplification step, which may be modified
   by using the form \<open>(algebra add: ths\<^sub>1 del: ths\<^sub>2)\<close>. This acts like
   declarations for the Simplifier (\secref{sec:simplifier}) on a private
   simpset for this tool.
 
   \<^descr> @{attribute algebra} (as attribute) manages the default collection of
   pre-simplification rules of the above proof method.
 \<close>
 
 
 subsubsection \<open>Example\<close>
 
 text \<open>
   The subsequent example is from geometry: collinearity is invariant by
   rotation.
 \<close>
 
 (*<*)experiment begin(*>*)
 type_synonym point = "int \<times> int"
 
 fun collinear :: "point \<Rightarrow> point \<Rightarrow> point \<Rightarrow> bool" where
   "collinear (Ax, Ay) (Bx, By) (Cx, Cy) \<longleftrightarrow>
     (Ax - Bx) * (By - Cy) = (Ay - By) * (Bx - Cx)"
 
 lemma collinear_inv_rotation:
   assumes "collinear (Ax, Ay) (Bx, By) (Cx, Cy)" and "c\<^sup>2 + s\<^sup>2 = 1"
   shows "collinear (Ax * c - Ay * s, Ay * c + Ax * s)
     (Bx * c - By * s, By * c + Bx * s) (Cx * c - Cy * s, Cy * c + Cx * s)"
   using assms by (algebra add: collinear.simps)
 (*<*)end(*>*)
 
 text \<open>
   See also \<^file>\<open>~~/src/HOL/Examples/Groebner_Examples.thy\<close>.
 \<close>
 
 
 section \<open>Coherent Logic\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{method_def (HOL) "coherent"} & : & \<open>method\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     @@{method (HOL) coherent} @{syntax thms}?
   \<close>
 
-  \<^descr> @{method (HOL) coherent} solves problems of \<^emph>\<open>Coherent Logic\<close> @{cite
-  "Bezem-Coquand:2005"}, which covers applications in confluence theory,
+  \<^descr> @{method (HOL) coherent} solves problems of \<^emph>\<open>Coherent Logic\<close> \<^cite>\<open>"Bezem-Coquand:2005"\<close>, which covers applications in confluence theory,
   lattice theory and projective geometry. See \<^file>\<open>~~/src/HOL/Examples/Coherent.thy\<close>
   for some examples.
 \<close>
 
 
 section \<open>Unstructured case analysis and induction \label{sec:hol-induct-tac}\<close>
 
 text \<open>
   The following tools of Isabelle/HOL support cases analysis and induction in
   unstructured tactic scripts; see also \secref{sec:cases-induct} for proper
   Isar versions of similar ideas.
 
   \begin{matharray}{rcl}
     @{method_def (HOL) case_tac}\<open>\<^sup>*\<close> & : & \<open>method\<close> \\
     @{method_def (HOL) induct_tac}\<open>\<^sup>*\<close> & : & \<open>method\<close> \\
     @{method_def (HOL) ind_cases}\<open>\<^sup>*\<close> & : & \<open>method\<close> \\
     @{command_def (HOL) "inductive_cases"}\<open>\<^sup>*\<close> & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     @@{method (HOL) case_tac} @{syntax goal_spec}? @{syntax term} rule?
     ;
     @@{method (HOL) induct_tac} @{syntax goal_spec}? (@{syntax insts} * @'and') rule?
     ;
     @@{method (HOL) ind_cases} (@{syntax prop}+) @{syntax for_fixes}
     ;
     @@{command (HOL) inductive_cases} (@{syntax thmdecl}? (@{syntax prop}+) + @'and')
     ;
     rule: 'rule' ':' @{syntax thm}
   \<close>
 
   \<^descr> @{method (HOL) case_tac} and @{method (HOL) induct_tac} admit to reason
   about inductive types. Rules are selected according to the declarations by
   the @{attribute cases} and @{attribute induct} attributes, cf.\
   \secref{sec:cases-induct}. The @{command (HOL) datatype} package already
   takes care of this.
 
   These unstructured tactics feature both goal addressing and dynamic
   instantiation. Note that named rule cases are \<^emph>\<open>not\<close> provided as would be by
   the proper @{method cases} and @{method induct} proof methods (see
   \secref{sec:cases-induct}). Unlike the @{method induct} method, @{method
   induct_tac} does not handle structured rule statements, only the compact
   object-logic conclusion of the subgoal being addressed.
 
   \<^descr> @{method (HOL) ind_cases} and @{command (HOL) "inductive_cases"} provide
   an interface to the internal \<^ML_text>\<open>mk_cases\<close> operation. Rules are
   simplified in an unrestricted forward manner.
 
   While @{method (HOL) ind_cases} is a proof method to apply the result
   immediately as elimination rules, @{command (HOL) "inductive_cases"}
   provides case split theorems at the theory level for later use. The
   @{keyword "for"} argument of the @{method (HOL) ind_cases} method allows to
   specify a list of variables that should be generalized before applying the
   resulting rule.
 \<close>
 
 
 section \<open>Adhoc tuples\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{attribute_def (HOL) split_format}\<open>\<^sup>*\<close> & : & \<open>attribute\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     @@{attribute (HOL) split_format} ('(' 'complete' ')')?
   \<close>
 
   \<^descr> @{attribute (HOL) split_format}\ \<open>(complete)\<close> causes arguments in function
   applications to be represented canonically according to their tuple type
   structure.
 
   Note that this operation tends to invent funny names for new local
   parameters introduced.
 \<close>
 
 
 chapter \<open>Executable code \label{ch:export-code}\<close>
 
 text \<open>
   For validation purposes, it is often useful to \<^emph>\<open>execute\<close> specifications. In
   principle, execution could be simulated by Isabelle's inference kernel, i.e.
   by a combination of resolution and simplification. Unfortunately, this
   approach is rather inefficient. A more efficient way of executing
   specifications is to translate them into a functional programming language
   such as ML.
 
   Isabelle provides a generic framework to support code generation from
   executable specifications. Isabelle/HOL instantiates these mechanisms in a
   way that is amenable to end-user applications. Code can be generated for
   functional programs (including overloading using type classes) targeting SML
-  @{cite SML}, OCaml @{cite OCaml}, Haskell @{cite "haskell-revised-report"}
-  and Scala @{cite "scala-overview-tech-report"}. Conceptually, code
+  \<^cite>\<open>SML\<close>, OCaml \<^cite>\<open>OCaml\<close>, Haskell \<^cite>\<open>"haskell-revised-report"\<close>
+  and Scala \<^cite>\<open>"scala-overview-tech-report"\<close>. Conceptually, code
   generation is split up in three steps: \<^emph>\<open>selection\<close> of code theorems,
   \<^emph>\<open>translation\<close> into an abstract executable view and \<^emph>\<open>serialization\<close> to a
   specific \<^emph>\<open>target language\<close>. Inductive specifications can be executed using
-  the predicate compiler which operates within HOL. See @{cite
-  "isabelle-codegen"} for an introduction.
+  the predicate compiler which operates within HOL. See \<^cite>\<open>"isabelle-codegen"\<close> for an introduction.
 
   \begin{matharray}{rcl}
     @{command_def (HOL) "export_code"}\<open>\<^sup>*\<close> & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
     @{attribute_def (HOL) code} & : & \<open>attribute\<close> \\
     @{command_def (HOL) "code_datatype"} & : & \<open>theory \<rightarrow> theory\<close> \\
     @{command_def (HOL) "print_codesetup"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
     @{attribute_def (HOL) code_unfold} & : & \<open>attribute\<close> \\
     @{attribute_def (HOL) code_post} & : & \<open>attribute\<close> \\
     @{attribute_def (HOL) code_abbrev} & : & \<open>attribute\<close> \\
     @{command_def (HOL) "print_codeproc"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
     @{command_def (HOL) "code_thms"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
     @{command_def (HOL) "code_deps"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
     @{command_def (HOL) "code_reserved"} & : & \<open>theory \<rightarrow> theory\<close> \\
     @{command_def (HOL) "code_printing"} & : & \<open>theory \<rightarrow> theory\<close> \\
     @{command_def (HOL) "code_identifier"} & : & \<open>theory \<rightarrow> theory\<close> \\
     @{command_def (HOL) "code_monad"} & : & \<open>theory \<rightarrow> theory\<close> \\
     @{command_def (HOL) "code_reflect"} & : & \<open>theory \<rightarrow> theory\<close> \\
     @{command_def (HOL) "code_pred"} & : & \<open>theory \<rightarrow> proof(prove)\<close> \\
     @{attribute_def (HOL) code_timing} & : & \<open>attribute\<close> \\
     @{attribute_def (HOL) code_simp_trace} & : & \<open>attribute\<close> \\
     @{attribute_def (HOL) code_runtime_trace} & : & \<open>attribute\<close>
   \end{matharray}
 
   \<^rail>\<open>
     @@{command (HOL) export_code} @'open'? \<newline> (const_expr+) (export_target*)
     ;
     export_target:
       @'in' target (@'module_name' @{syntax name})? \<newline>
       (@'file_prefix' @{syntax path})? ('(' args ')')?
     ;
     target: 'SML' | 'OCaml' | 'Haskell' | 'Scala' | 'Eval'
     ;
     const_expr: (const | 'name._' | '_')
     ;
     const: @{syntax term}
     ;
     type_constructor: @{syntax name}
     ;
     class: @{syntax name}
     ;
     path: @{syntax embedded}
     ;
     @@{attribute (HOL) code} ('equation' | 'nbe' | 'abstype' | 'abstract'
       | 'del' | 'drop:' (const+) | 'abort:' (const+))?
     ;
     @@{command (HOL) code_datatype} (const+)
     ;
     @@{attribute (HOL) code_unfold} 'del'?
     ;
     @@{attribute (HOL) code_post} 'del'?
     ;
     @@{attribute (HOL) code_abbrev} 'del'?
     ;
     @@{command (HOL) code_thms} (const_expr+)
     ;
     @@{command (HOL) code_deps} (const_expr+)
     ;
     @@{command (HOL) code_reserved} target (@{syntax string}+)
     ;
     symbol_const: @'constant' const
     ;
     symbol_type_constructor: @'type_constructor' type_constructor
     ;
     symbol_class: @'type_class' class
     ;
     symbol_class_relation: @'class_relation' class ('<' | '\<subseteq>') class
     ;
     symbol_class_instance: @'class_instance' type_constructor @'::' class
     ;
     symbol_module: @'code_module' name
     ;
     syntax: @{syntax string} | (@'infix' | @'infixl' | @'infixr')
       @{syntax nat} @{syntax string}
     ;
     printing_const: symbol_const ('\<rightharpoonup>' | '=>') \<newline>
       ('(' target ')' syntax ? + @'and')
     ;
     printing_type_constructor: symbol_type_constructor ('\<rightharpoonup>' | '=>') \<newline>
       ('(' target ')' syntax ? + @'and')
     ;
     printing_class: symbol_class ('\<rightharpoonup>' | '=>') \<newline>
       ('(' target ')' @{syntax string} ? + @'and')
     ;
     printing_class_relation: symbol_class_relation ('\<rightharpoonup>' | '=>') \<newline>
       ('(' target ')' @{syntax string} ? + @'and')
     ;
     printing_class_instance: symbol_class_instance ('\<rightharpoonup>'| '=>') \<newline>
       ('(' target ')' '-' ? + @'and')
     ;
     printing_module: symbol_module ('\<rightharpoonup>' | '=>') \<newline>
       ('(' target ')' (@{syntax string} for_symbol?)? + @'and')
     ;
     for_symbol:
       @'for'
         ((symbol_const | symbol_typeconstructor |
           symbol_class | symbol_class_relation | symbol_class_instance)+)
     ;
     @@{command (HOL) code_printing} ((printing_const | printing_type_constructor
       | printing_class | printing_class_relation | printing_class_instance
       | printing_module) + '|')
     ;
     @@{command (HOL) code_identifier} ((symbol_const | symbol_type_constructor
       | symbol_class | symbol_class_relation | symbol_class_instance
       | symbol_module ) ('\<rightharpoonup>' | '=>') \<newline>
       ('(' target ')' @{syntax string} ? + @'and') + '|')
     ;
     @@{command (HOL) code_monad} const const target
     ;
     @@{command (HOL) code_reflect} @{syntax string} \<newline>
       (@'datatypes' (@{syntax string} '=' ('_' | (@{syntax string} + '|') + @'and')))? \<newline>
       (@'functions' (@{syntax string} +))? (@'file_prefix' @{syntax path})?
     ;
     @@{command (HOL) code_pred} \<newline> ('(' @'modes' ':' modedecl ')')? \<newline> const
     ;
     modedecl: (modes | ((const ':' modes) \<newline>
       (@'and' ((const ':' modes @'and')+))?))
     ;
     modes: mode @'as' const
   \<close>
 
   \<^descr> @{command (HOL) "export_code"} generates code for a given list of
   constants in the specified target language(s). If no serialization
   instruction is given, only abstract code is generated internally.
 
   Constants may be specified by giving them literally, referring to all
   executable constants within a certain theory by giving \<open>name._\<close>, or
   referring to \<^emph>\<open>all\<close> executable constants currently available by giving \<open>_\<close>.
 
   By default, exported identifiers are minimized per module. This can be
   suppressed by prepending @{keyword "open"} before the list of constants.
 
   By default, for each involved theory one corresponding name space module is
   generated. Alternatively, a module name may be specified after the @{keyword
   "module_name"} keyword; then \<^emph>\<open>all\<close> code is placed in this module.
 
   Generated code is output as logical files within the theory context, as well
   as session exports that can be retrieved using @{tool_ref export}, or @{tool
   build} with option \<^verbatim>\<open>-e\<close> and suitable \isakeyword{export\_files}
   specifications in the session \<^verbatim>\<open>ROOT\<close> entry. All files have a common
   directory prefix: the long theory name plus ``\<^verbatim>\<open>code\<close>''. The actual file
   name is determined by the target language together with an optional
   \<^theory_text>\<open>file_prefix\<close> (the default is ``\<^verbatim>\<open>export\<close>'' with a consecutive number
   within the current theory). For \<open>SML\<close>, \<open>OCaml\<close> and \<open>Scala\<close>, the file prefix
   becomes a plain file with extension (e.g.\ ``\<^verbatim>\<open>.ML\<close>'' for SML). For
   \<open>Haskell\<close> the file prefix becomes a directory that is populated with a
   separate file for each module (with extension ``\<^verbatim>\<open>.hs\<close>'').
 
   Serializers take an optional list of arguments in parentheses.
 
       \<^item> For \<^emph>\<open>Haskell\<close> a module name prefix may be given using the ``\<open>root:\<close>''
       argument; ``\<open>string_classes\<close>'' adds a ``\<^verbatim>\<open>deriving (Read, Show)\<close>'' clause 
       to each appropriate datatype declaration.
 
       \<^item> For \<^emph>\<open>Scala\<close>, ``\<open>case_insensitive\<close>'' avoids name clashes on
       case-insensitive file systems.
 
   \<^descr> @{attribute (HOL) code} declares code equations for code generation.
 
   Variant \<open>code equation\<close> declares a conventional equation as code equation.
 
   Variants \<open>code abstype\<close> and \<open>code abstract\<close> declare abstract datatype
   certificates or code equations on abstract datatype representations
   respectively.
 
   Vanilla \<open>code\<close> falls back to \<open>code equation\<close> or \<open>code abstract\<close>
   depending on the syntactic shape of the underlying equation.
 
   Variant \<open>code del\<close> deselects a code equation for code generation.
 
   Variant \<open>code nbe\<close> accepts also non-left-linear equations for
   \<^emph>\<open>normalization by evaluation\<close> only.
 
   Variants \<open>code drop:\<close> and \<open>code abort:\<close> take a list of constants as arguments
   and drop all code equations declared for them. In the case of \<open>abort\<close>,
   these constants if needed are implemented by program abort
   (exception).
 
   Packages declaring code equations usually provide a reasonable default
   setup.
 
   \<^descr> @{command (HOL) "code_datatype"} specifies a constructor set for a logical
   type.
 
   \<^descr> @{command (HOL) "print_codesetup"} gives an overview on selected code
   equations and code generator datatypes.
 
   \<^descr> @{attribute (HOL) code_unfold} declares (or with option ``\<open>del\<close>'' removes)
   theorems which during preprocessing are applied as rewrite rules to any code
   equation or evaluation input.
 
   \<^descr> @{attribute (HOL) code_post} declares (or with option ``\<open>del\<close>'' removes)
   theorems which are applied as rewrite rules to any result of an evaluation.
 
   \<^descr> @{attribute (HOL) code_abbrev} declares (or with option ``\<open>del\<close>'' removes)
   equations which are applied as rewrite rules to any result of an evaluation
   and symmetrically during preprocessing to any code equation or evaluation
   input.
 
   \<^descr> @{command (HOL) "print_codeproc"} prints the setup of the code generator
   preprocessor.
 
   \<^descr> @{command (HOL) "code_thms"} prints a list of theorems representing the
   corresponding program containing all given constants after preprocessing.
 
   \<^descr> @{command (HOL) "code_deps"} visualizes dependencies of theorems
   representing the corresponding program containing all given constants after
   preprocessing.
 
   \<^descr> @{command (HOL) "code_reserved"} declares a list of names as reserved for
   a given target, preventing it to be shadowed by any generated code.
 
   \<^descr> @{command (HOL) "code_printing"} associates a series of symbols
   (constants, type constructors, classes, class relations, instances, module
   names) with target-specific serializations; omitting a serialization deletes
   an existing serialization.
 
   \<^descr> @{command (HOL) "code_monad"} provides an auxiliary mechanism to generate
   monadic code for Haskell.
 
   \<^descr> @{command (HOL) "code_identifier"} associates a a series of symbols
   (constants, type constructors, classes, class relations, instances, module
   names) with target-specific hints how these symbols shall be named. These
   hints gain precedence over names for symbols with no hints at all.
   Conflicting hints are subject to name disambiguation. \<^emph>\<open>Warning:\<close> It is at
   the discretion of the user to ensure that name prefixes of identifiers in
   compound statements like type classes or datatypes are still the same.
 
   \<^descr> @{command (HOL) "code_reflect"} without a ``\<^theory_text>\<open>file_prefix\<close>'' argument
   compiles code into the system runtime environment and modifies the code
   generator setup that future invocations of system runtime code generation
   referring to one of the ``\<open>datatypes\<close>'' or ``\<open>functions\<close>'' entities use
   these precompiled entities. With a ``\<^theory_text>\<open>file_prefix\<close>'' argument, the
   corresponding code is generated/exported to the specified file (as for
   \<^theory_text>\<open>export_code\<close>) without modifying the code generator setup.
 
   \<^descr> @{command (HOL) "code_pred"} creates code equations for a predicate given
   a set of introduction rules. Optional mode annotations determine which
   arguments are supposed to be input or output. If alternative introduction
   rules are declared, one must prove a corresponding elimination rule.
 
   \<^descr> @{attribute (HOL) "code_timing"} scrapes timing samples from different
   stages of the code generator.
 
   \<^descr> @{attribute (HOL) "code_simp_trace"} traces the simplifier when it is
   used with code equations.
 
   \<^descr> @{attribute (HOL) "code_runtime_trace"} traces ML code generated
   dynamically for execution.
 \<close>
 
 end
diff --git a/src/Doc/Isar_Ref/Inner_Syntax.thy b/src/Doc/Isar_Ref/Inner_Syntax.thy
--- a/src/Doc/Isar_Ref/Inner_Syntax.thy
+++ b/src/Doc/Isar_Ref/Inner_Syntax.thy
@@ -1,1531 +1,1530 @@
 (*:maxLineLen=78:*)
 
 theory Inner_Syntax
   imports Main Base
 begin
 
 chapter \<open>Inner syntax --- the term language \label{ch:inner-syntax}\<close>
 
 text \<open>
   The inner syntax of Isabelle provides concrete notation for the main
   entities of the logical framework, notably \<open>\<lambda>\<close>-terms with types and type
   classes. Applications may either extend existing syntactic categories by
   additional notation, or define new sub-languages that are linked to the
   standard term language via some explicit markers. For example \<^verbatim>\<open>FOO\<close>~\<open>foo\<close>
   could embed the syntax corresponding for some user-defined nonterminal \<open>foo\<close>
   --- within the bounds of the given lexical syntax of Isabelle/Pure.
 
   The most basic way to specify concrete syntax for logical entities works via
   mixfix annotations (\secref{sec:mixfix}), which may be usually given as part
   of the original declaration or via explicit notation commands later on
   (\secref{sec:notation}). This already covers many needs of concrete syntax
   without having to understand the full complexity of inner syntax layers.
 
   Further details of the syntax engine involves the classical distinction of
   lexical language versus context-free grammar (see \secref{sec:pure-syntax}),
   and various mechanisms for \<^emph>\<open>syntax transformations\<close> (see
   \secref{sec:syntax-transformations}).
 \<close>
 
 
 section \<open>Printing logical entities\<close>
 
 subsection \<open>Diagnostic commands \label{sec:print-diag}\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{command_def "typ"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
     @{command_def "term"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
     @{command_def "prop"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
     @{command_def "thm"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
     @{command_def "prf"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
     @{command_def "full_prf"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
     @{command_def "print_state"}\<open>\<^sup>*\<close> & : & \<open>any \<rightarrow>\<close> \\
   \end{matharray}
 
   These diagnostic commands assist interactive development by printing
   internal logical entities in a human-readable fashion.
 
   \<^rail>\<open>
     @@{command typ} @{syntax modes}? @{syntax type} ('::' @{syntax sort})?
     ;
     @@{command term} @{syntax modes}? @{syntax term}
     ;
     @@{command prop} @{syntax modes}? @{syntax prop}
     ;
     @@{command thm} @{syntax modes}? @{syntax thms}
     ;
     ( @@{command prf} | @@{command full_prf} ) @{syntax modes}? @{syntax thms}?
     ;
     @@{command print_state} @{syntax modes}?
     ;
     @{syntax_def modes}: '(' (@{syntax name} + ) ')'
   \<close>
 
   \<^descr> @{command "typ"}~\<open>\<tau>\<close> reads and prints a type expression according to the
   current context.
 
   \<^descr> @{command "typ"}~\<open>\<tau> :: s\<close> uses type-inference to determine the most
   general way to make \<open>\<tau>\<close> conform to sort \<open>s\<close>. For concrete \<open>\<tau>\<close> this checks if
   the type belongs to that sort. Dummy type parameters ``\<open>_\<close>'' (underscore)
   are assigned to fresh type variables with most general sorts, according the
   the principles of type-inference.
 
     \<^descr> @{command "term"}~\<open>t\<close> and @{command "prop"}~\<open>\<phi>\<close> read, type-check and
     print terms or propositions according to the current theory or proof
     context; the inferred type of \<open>t\<close> is output as well. Note that these
     commands are also useful in inspecting the current environment of term
     abbreviations.
 
     \<^descr> @{command "thm"}~\<open>a\<^sub>1 \<dots> a\<^sub>n\<close> retrieves theorems from the current theory
     or proof context. Note that any attributes included in the theorem
     specifications are applied to a temporary context derived from the current
     theory or proof; the result is discarded, i.e.\ attributes involved in
     \<open>a\<^sub>1, \<dots>, a\<^sub>n\<close> do not have any permanent effect.
 
     \<^descr> @{command "prf"} displays the (compact) proof term of the current proof
     state (if present), or of the given theorems. Note that this requires an
     underlying logic image with proof terms enabled, e.g. \<open>HOL-Proofs\<close>.
 
     \<^descr> @{command "full_prf"} is like @{command "prf"}, but displays the full
     proof term, i.e.\ also displays information omitted in the compact proof
     term, which is denoted by ``\<open>_\<close>'' placeholders there.
 
     \<^descr> @{command "print_state"} prints the current proof state (if present),
     including current facts and goals.
 
   All of the diagnostic commands above admit a list of \<open>modes\<close> to be
   specified, which is appended to the current print mode; see also
   \secref{sec:print-modes}. Thus the output behavior may be modified according
   particular print mode features. For example, @{command
   "print_state"}~\<open>(latex)\<close> prints the current proof state with mathematical
   symbols and special characters represented in {\LaTeX} source, according to
-  the Isabelle style @{cite "isabelle-system"}.
+  the Isabelle style \<^cite>\<open>"isabelle-system"\<close>.
 
   Note that antiquotations (cf.\ \secref{sec:antiq}) provide a more systematic
   way to include formal items into the printed text document.
 \<close>
 
 
 subsection \<open>Details of printed content\<close>
 
 text \<open>
   \begin{tabular}{rcll}
     @{attribute_def show_markup} & : & \<open>attribute\<close> \\
     @{attribute_def show_types} & : & \<open>attribute\<close> & default \<open>false\<close> \\
     @{attribute_def show_sorts} & : & \<open>attribute\<close> & default \<open>false\<close> \\
     @{attribute_def show_consts} & : & \<open>attribute\<close> & default \<open>false\<close> \\
     @{attribute_def show_abbrevs} & : & \<open>attribute\<close> & default \<open>true\<close> \\
     @{attribute_def show_brackets} & : & \<open>attribute\<close> & default \<open>false\<close> \\
     @{attribute_def names_long} & : & \<open>attribute\<close> & default \<open>false\<close> \\
     @{attribute_def names_short} & : & \<open>attribute\<close> & default \<open>false\<close> \\
     @{attribute_def names_unique} & : & \<open>attribute\<close> & default \<open>true\<close> \\
     @{attribute_def eta_contract} & : & \<open>attribute\<close> & default \<open>true\<close> \\
     @{attribute_def goals_limit} & : & \<open>attribute\<close> & default \<open>10\<close> \\
     @{attribute_def show_main_goal} & : & \<open>attribute\<close> & default \<open>false\<close> \\
     @{attribute_def show_hyps} & : & \<open>attribute\<close> & default \<open>false\<close> \\
     @{attribute_def show_tags} & : & \<open>attribute\<close> & default \<open>false\<close> \\
     @{attribute_def show_question_marks} & : & \<open>attribute\<close> & default \<open>true\<close> \\
   \end{tabular}
   \<^medskip>
 
   These configuration options control the detail of information that is
   displayed for types, terms, theorems, goals etc. See also
   \secref{sec:config}.
 
   \<^descr> @{attribute show_markup} controls direct inlining of markup into the
   printed representation of formal entities --- notably type and sort
   constraints. This enables Prover IDE users to retrieve that information via
   tooltips or popups while hovering with the mouse over the output window, for
   example. Consequently, this option is enabled by default for Isabelle/jEdit.
 
   \<^descr> @{attribute show_types} and @{attribute show_sorts} control printing of
   type constraints for term variables, and sort constraints for type
   variables. By default, neither of these are shown in output. If @{attribute
   show_sorts} is enabled, types are always shown as well. In Isabelle/jEdit,
   manual setting of these options is normally not required thanks to
   @{attribute show_markup} above.
 
   Note that displaying types and sorts may explain why a polymorphic inference
   rule fails to resolve with some goal, or why a rewrite rule does not apply
   as expected.
 
   \<^descr> @{attribute show_consts} controls printing of types of constants when
   displaying a goal state.
 
   Note that the output can be enormous, because polymorphic constants often
   occur at several different type instances.
 
   \<^descr> @{attribute show_abbrevs} controls folding of constant abbreviations.
 
   \<^descr> @{attribute show_brackets} controls bracketing in pretty printed output.
   If enabled, all sub-expressions of the pretty printing tree will be
   parenthesized, even if this produces malformed term syntax! This crude way
   of showing the internal structure of pretty printed entities may
   occasionally help to diagnose problems with operator priorities, for
   example.
 
   \<^descr> @{attribute names_long}, @{attribute names_short}, and @{attribute
   names_unique} control the way of printing fully qualified internal names in
   external form. See also \secref{sec:antiq} for the document antiquotation
   options of the same names.
 
   \<^descr> @{attribute eta_contract} controls \<open>\<eta>\<close>-contracted printing of terms.
 
   The \<open>\<eta>\<close>-contraction law asserts \<^prop>\<open>(\<lambda>x. f x) \<equiv> f\<close>, provided \<open>x\<close> is not
   free in \<open>f\<close>. It asserts \<^emph>\<open>extensionality\<close> of functions: \<^prop>\<open>f \<equiv> g\<close> if
   \<^prop>\<open>f x \<equiv> g x\<close> for all \<open>x\<close>. Higher-order unification frequently puts
   terms into a fully \<open>\<eta>\<close>-expanded form. For example, if \<open>F\<close> has type \<open>(\<tau> \<Rightarrow> \<tau>)
   \<Rightarrow> \<tau>\<close> then its expanded form is \<^term>\<open>\<lambda>h. F (\<lambda>x. h x)\<close>.
 
   Enabling @{attribute eta_contract} makes Isabelle perform \<open>\<eta>\<close>-contractions
   before printing, so that \<^term>\<open>\<lambda>h. F (\<lambda>x. h x)\<close> appears simply as \<open>F\<close>.
 
   Note that the distinction between a term and its \<open>\<eta>\<close>-expanded form
   occasionally matters. While higher-order resolution and rewriting operate
   modulo \<open>\<alpha>\<beta>\<eta>\<close>-conversion, some other tools might look at terms more
   discretely.
 
   \<^descr> @{attribute goals_limit} controls the maximum number of subgoals to be
   printed.
 
   \<^descr> @{attribute show_main_goal} controls whether the main result to be proven
   should be displayed. This information might be relevant for schematic goals,
   to inspect the current claim that has been synthesized so far.
 
   \<^descr> @{attribute show_hyps} controls printing of implicit hypotheses of local
   facts. Normally, only those hypotheses are displayed that are \<^emph>\<open>not\<close> covered
   by the assumptions of the current context: this situation indicates a fault
   in some tool being used.
 
   By enabling @{attribute show_hyps}, output of \<^emph>\<open>all\<close> hypotheses can be
   enforced, which is occasionally useful for diagnostic purposes.
 
   \<^descr> @{attribute show_tags} controls printing of extra annotations within
   theorems, such as internal position information, or the case names being
   attached by the attribute @{attribute case_names}.
 
   Note that the @{attribute tagged} and @{attribute untagged} attributes
   provide low-level access to the collection of tags associated with a
   theorem.
 
   \<^descr> @{attribute show_question_marks} controls printing of question marks for
   schematic variables, such as \<open>?x\<close>. Only the leading question mark is
   affected, the remaining text is unchanged (including proper markup for
   schematic variables that might be relevant for user interfaces).
 \<close>
 
 
 subsection \<open>Alternative print modes \label{sec:print-modes}\<close>
 
 text \<open>
   \begin{mldecls}
     @{define_ML print_mode_value: "unit -> string list"} \\
     @{define_ML Print_Mode.with_modes: "string list -> ('a -> 'b) -> 'a -> 'b"} \\
   \end{mldecls}
 
   The \<^emph>\<open>print mode\<close> facility allows to modify various operations for printing.
   Commands like @{command typ}, @{command term}, @{command thm} (see
   \secref{sec:print-diag}) take additional print modes as optional argument.
   The underlying ML operations are as follows.
 
     \<^descr> \<^ML>\<open>print_mode_value ()\<close> yields the list of currently active print
     mode names. This should be understood as symbolic representation of
     certain individual features for printing (with precedence from left to
     right).
 
     \<^descr> \<^ML>\<open>Print_Mode.with_modes\<close>~\<open>modes f x\<close> evaluates \<open>f x\<close> in an execution
     context where the print mode is prepended by the given \<open>modes\<close>. This
     provides a thread-safe way to augment print modes. It is also monotonic in
     the set of mode names: it retains the default print mode that certain
     user-interfaces might have installed for their proper functioning!
 
   \<^medskip>
   The pretty printer for inner syntax maintains alternative mixfix productions
   for any print mode name invented by the user, say in commands like @{command
   notation} or @{command abbreviation}. Mode names can be arbitrary, but the
   following ones have a specific meaning by convention:
 
     \<^item> \<^verbatim>\<open>""\<close> (the empty string): default mode; implicitly active as last
     element in the list of modes.
 
     \<^item> \<^verbatim>\<open>input\<close>: dummy print mode that is never active; may be used to specify
     notation that is only available for input.
 
     \<^item> \<^verbatim>\<open>internal\<close> dummy print mode that is never active; used internally in
     Isabelle/Pure.
 
     \<^item> \<^verbatim>\<open>ASCII\<close>: prefer ASCII art over mathematical symbols.
 
     \<^item> \<^verbatim>\<open>latex\<close>: additional mode that is active in {\LaTeX} document
     preparation of Isabelle theory sources; allows to provide alternative
     output notation.
 \<close>
 
 
 section \<open>Mixfix annotations \label{sec:mixfix}\<close>
 
 text \<open>
   Mixfix annotations specify concrete \<^emph>\<open>inner syntax\<close> of Isabelle types and
   terms. Locally fixed parameters in toplevel theorem statements, locale and
   class specifications also admit mixfix annotations in a fairly uniform
   manner. A mixfix annotation describes the concrete syntax, the translation
   to abstract syntax, and the pretty printing. Special case annotations
   provide a simple means of specifying infix operators and binders.
 
-  Isabelle mixfix syntax is inspired by {\OBJ} @{cite OBJ}. It allows to
+  Isabelle mixfix syntax is inspired by {\OBJ} \<^cite>\<open>OBJ\<close>. It allows to
   specify any context-free priority grammar, which is more general than the
   fixity declarations of ML and Prolog.
 
   \<^rail>\<open>
     @{syntax_def mixfix}: '('
       (@{syntax template} prios? @{syntax nat}? |
         (@'infix' | @'infixl' | @'infixr') @{syntax template} @{syntax nat} |
         @'binder' @{syntax template} prio? @{syntax nat} |
         @'structure') ')'
     ;
     @{syntax template}: (string | cartouche)
     ;
     prios: '[' (@{syntax nat} + ',') ']'
     ;
     prio: '[' @{syntax nat} ']'
   \<close>
 
   The mixfix \<open>template\<close> may include literal text, spacing, blocks, and
   arguments (denoted by ``\<open>_\<close>''); the special symbol ``\<^verbatim>\<open>\<index>\<close>'' (printed as
   ``\<open>\<index>\<close>'') represents an index argument that specifies an implicit @{keyword
   "structure"} reference (see also \secref{sec:locale}). Only locally fixed
   variables may be declared as @{keyword "structure"}.
 
   Infix and binder declarations provide common abbreviations for particular
   mixfix declarations. So in practice, mixfix templates mostly degenerate to
   literal text for concrete syntax, such as ``\<^verbatim>\<open>++\<close>'' for an infix symbol.
 \<close>
 
 
 subsection \<open>The general mixfix form\<close>
 
 text \<open>
   In full generality, mixfix declarations work as follows. Suppose a constant
   \<open>c :: \<tau>\<^sub>1 \<Rightarrow> \<dots> \<tau>\<^sub>n \<Rightarrow> \<tau>\<close> is annotated by \<open>(mixfix [p\<^sub>1, \<dots>, p\<^sub>n] p)\<close>, where
   \<open>mixfix\<close> is a string \<open>d\<^sub>0 _ d\<^sub>1 _ \<dots> _ d\<^sub>n\<close> consisting of delimiters that
   surround argument positions as indicated by underscores.
 
   Altogether this determines a production for a context-free priority grammar,
   where for each argument \<open>i\<close> the syntactic category is determined by \<open>\<tau>\<^sub>i\<close>
   (with priority \<open>p\<^sub>i\<close>), and the result category is determined from \<open>\<tau>\<close> (with
   priority \<open>p\<close>). Priority specifications are optional, with default 0 for
   arguments and 1000 for the result.\<^footnote>\<open>Omitting priorities is prone to
   syntactic ambiguities unless the delimiter tokens determine fully bracketed
   notation, as in \<open>if _ then _ else _ fi\<close>.\<close>
 
   Since \<open>\<tau>\<close> may be again a function type, the constant type scheme may have
   more argument positions than the mixfix pattern. Printing a nested
   application \<open>c t\<^sub>1 \<dots> t\<^sub>m\<close> for \<open>m > n\<close> works by attaching concrete notation
   only to the innermost part, essentially by printing \<open>(c t\<^sub>1 \<dots> t\<^sub>n) \<dots> t\<^sub>m\<close>
   instead. If a term has fewer arguments than specified in the mixfix
   template, the concrete syntax is ignored.
 
   \<^medskip>
   A mixfix template may also contain additional directives for pretty
   printing, notably spaces, blocks, and breaks. The general template format is
   a sequence over any of the following entities.
 
   \<^descr> \<open>d\<close> is a delimiter, namely a non-empty sequence delimiter items of the
   following form:
     \<^enum> a control symbol followed by a cartouche
     \<^enum> a single symbol, excluding the following special characters:
       \<^medskip>
       \begin{tabular}{ll}
         \<^verbatim>\<open>'\<close> & single quote \\
         \<^verbatim>\<open>_\<close> & underscore \\
         \<open>\<index>\<close> & index symbol \\
         \<^verbatim>\<open>(\<close> & open parenthesis \\
         \<^verbatim>\<open>)\<close> & close parenthesis \\
         \<^verbatim>\<open>/\<close> & slash \\
         \<open>\<open> \<close>\<close> & cartouche delimiters \\
       \end{tabular}
       \<^medskip>
 
   \<^descr> \<^verbatim>\<open>'\<close> escapes the special meaning of these meta-characters, producing a
   literal version of the following character, unless that is a blank.
 
   A single quote followed by a blank separates delimiters, without affecting
   printing, but input tokens may have additional white space here.
 
   \<^descr> \<^verbatim>\<open>_\<close> is an argument position, which stands for a certain syntactic
   category in the underlying grammar.
 
   \<^descr> \<open>\<index>\<close> is an indexed argument position; this is the place where implicit
   structure arguments can be attached.
 
   \<^descr> \<open>s\<close> is a non-empty sequence of spaces for printing. This and the following
   specifications do not affect parsing at all.
 
   \<^descr> \<^verbatim>\<open>(\<close>\<open>n\<close> opens a pretty printing block. The optional natural number
   specifies the block indentation, i.e. how much spaces to add when a line
   break occurs within the block. The default indentation is 0.
 
   \<^descr> \<^verbatim>\<open>(\<close>\<open>\<open>properties\<close>\<close> opens a pretty printing block, with properties
   specified within the given text cartouche. The syntax and semantics of
   the category @{syntax_ref mixfix_properties} is described below.
 
   \<^descr> \<^verbatim>\<open>)\<close> closes a pretty printing block.
 
   \<^descr> \<^verbatim>\<open>//\<close> forces a line break.
 
   \<^descr> \<^verbatim>\<open>/\<close>\<open>s\<close> allows a line break. Here \<open>s\<close> stands for the string of spaces
   (zero or more) right after the slash. These spaces are printed if the break
   is \<^emph>\<open>not\<close> taken.
 
 
   \<^medskip>
   Block properties allow more control over the details of pretty-printed
   output. The concrete syntax is defined as follows.
 
   \<^rail>\<open>
     @{syntax_def "mixfix_properties"}: (entry *)
     ;
     entry: atom ('=' atom)?
     ;
     atom: @{syntax short_ident} | @{syntax int} | @{syntax float} | @{syntax cartouche}
   \<close>
 
   Each @{syntax entry} is a name-value pair: if the value is omitted, it
   defaults to \<^verbatim>\<open>true\<close> (intended for Boolean properties). The following
   standard block properties are supported:
 
     \<^item> \<open>indent\<close> (natural number): the block indentation --- the same as for the
     simple syntax without block properties.
 
     \<^item> \<open>consistent\<close> (Boolean): this block has consistent breaks (if one break
     is taken, all breaks are taken).
 
     \<^item> \<open>unbreakable\<close> (Boolean): all possible breaks of the block are disabled
     (turned into spaces).
 
     \<^item> \<open>markup\<close> (string): the optional name of the markup node. If this is
     provided, all remaining properties are turned into its XML attributes.
     This allows to specify free-form PIDE markup, e.g.\ for specialized
     output.
 
   \<^medskip>
   Note that the general idea of pretty printing with blocks and breaks is
-  described in @{cite "paulson-ml2"}; it goes back to @{cite "Oppen:1980"}.
+  described in \<^cite>\<open>"paulson-ml2"\<close>; it goes back to \<^cite>\<open>"Oppen:1980"\<close>.
 \<close>
 
 
 subsection \<open>Infixes\<close>
 
 text \<open>
   Infix operators are specified by convenient short forms that abbreviate
   general mixfix annotations as follows:
 
   \begin{center}
   \begin{tabular}{lll}
 
   \<^verbatim>\<open>(\<close>@{keyword_def "infix"}~\<^verbatim>\<open>"\<close>\<open>sy\<close>\<^verbatim>\<open>"\<close> \<open>p\<close>\<^verbatim>\<open>)\<close>
   & \<open>\<mapsto>\<close> &
   \<^verbatim>\<open>("(_\<close>~\<open>sy\<close>\<^verbatim>\<open>/ _)" [\<close>\<open>p + 1\<close>\<^verbatim>\<open>,\<close>~\<open>p + 1\<close>\<^verbatim>\<open>]\<close>~\<open>p\<close>\<^verbatim>\<open>)\<close> \\
   \<^verbatim>\<open>(\<close>@{keyword_def "infixl"}~\<^verbatim>\<open>"\<close>\<open>sy\<close>\<^verbatim>\<open>"\<close> \<open>p\<close>\<^verbatim>\<open>)\<close>
   & \<open>\<mapsto>\<close> &
   \<^verbatim>\<open>("(_\<close>~\<open>sy\<close>\<^verbatim>\<open>/ _)" [\<close>\<open>p\<close>\<^verbatim>\<open>,\<close>~\<open>p + 1\<close>\<^verbatim>\<open>]\<close>~\<open>p\<close>\<^verbatim>\<open>)\<close> \\
   \<^verbatim>\<open>(\<close>@{keyword_def "infixr"}~\<^verbatim>\<open>"\<close>\<open>sy\<close>\<^verbatim>\<open>"\<close>~\<open>p\<close>\<^verbatim>\<open>)\<close>
   & \<open>\<mapsto>\<close> &
   \<^verbatim>\<open>("(_\<close>~\<open>sy\<close>\<^verbatim>\<open>/ _)" [\<close>\<open>p + 1\<close>\<^verbatim>\<open>,\<close>~\<open>p\<close>\<^verbatim>\<open>]\<close>~\<open>p\<close>\<^verbatim>\<open>)\<close> \\
 
   \end{tabular}
   \end{center}
 
   The mixfix template \<^verbatim>\<open>"(_\<close>~\<open>sy\<close>\<^verbatim>\<open>/ _)"\<close> specifies two argument positions;
   the delimiter is preceded by a space and followed by a space or line break;
   the entire phrase is a pretty printing block.
 
   The alternative notation \<^verbatim>\<open>(\<close>\<open>sy\<close>\<^verbatim>\<open>)\<close> is introduced in addition. Thus any
   infix operator may be written in prefix form (as in Haskell), independently of
   the number of arguments.
 \<close>
 
 
 subsection \<open>Binders\<close>
 
 text \<open>
   A \<^emph>\<open>binder\<close> is a variable-binding construct such as a quantifier. The idea
   to formalize \<open>\<forall>x. b\<close> as \<open>All (\<lambda>x. b)\<close> for \<open>All :: ('a \<Rightarrow> bool) \<Rightarrow> bool\<close>
-  already goes back to @{cite church40}. Isabelle declarations of certain
+  already goes back to \<^cite>\<open>church40\<close>. Isabelle declarations of certain
   higher-order operators may be annotated with @{keyword_def "binder"}
   annotations as follows:
 
   \begin{center}
   \<open>c ::\<close>~\<^verbatim>\<open>"\<close>\<open>(\<tau>\<^sub>1 \<Rightarrow> \<tau>\<^sub>2) \<Rightarrow> \<tau>\<^sub>3\<close>\<^verbatim>\<open>"  (\<close>@{keyword "binder"}~\<^verbatim>\<open>"\<close>\<open>sy\<close>\<^verbatim>\<open>" [\<close>\<open>p\<close>\<^verbatim>\<open>]\<close>~\<open>q\<close>\<^verbatim>\<open>)\<close>
   \end{center}
 
   This introduces concrete binder syntax \<open>sy x. b\<close>, where \<open>x\<close> is a bound
   variable of type \<open>\<tau>\<^sub>1\<close>, the body \<open>b\<close> has type \<open>\<tau>\<^sub>2\<close> and the whole term has
   type \<open>\<tau>\<^sub>3\<close>. The optional integer \<open>p\<close> specifies the syntactic priority of the
   body; the default is \<open>q\<close>, which is also the priority of the whole construct.
 
   Internally, the binder syntax is expanded to something like this:
   \begin{center}
   \<open>c_binder ::\<close>~\<^verbatim>\<open>"\<close>\<open>idts \<Rightarrow> \<tau>\<^sub>2 \<Rightarrow> \<tau>\<^sub>3\<close>\<^verbatim>\<open>"  ("(3\<close>\<open>sy\<close>\<^verbatim>\<open>_./ _)" [0,\<close>~\<open>p\<close>\<^verbatim>\<open>]\<close>~\<open>q\<close>\<^verbatim>\<open>)\<close>
   \end{center}
 
   Here @{syntax (inner) idts} is the nonterminal symbol for a list of
   identifiers with optional type constraints (see also
   \secref{sec:pure-grammar}). The mixfix template \<^verbatim>\<open>"(3\<close>\<open>sy\<close>\<^verbatim>\<open>_./ _)"\<close> defines
   argument positions for the bound identifiers and the body, separated by a
   dot with optional line break; the entire phrase is a pretty printing block
   of indentation level 3. Note that there is no extra space after \<open>sy\<close>, so it
   needs to be included user specification if the binder syntax ends with a
   token that may be continued by an identifier token at the start of @{syntax
   (inner) idts}.
 
   Furthermore, a syntax translation to transforms \<open>c_binder x\<^sub>1 \<dots> x\<^sub>n b\<close> into
   iterated application \<open>c (\<lambda>x\<^sub>1. \<dots> c (\<lambda>x\<^sub>n. b)\<dots>)\<close>. This works in both
   directions, for parsing and printing.
 \<close>
 
 
 section \<open>Explicit notation \label{sec:notation}\<close>
 
 text \<open>
   \begin{matharray}{rcll}
     @{command_def "type_notation"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
     @{command_def "no_type_notation"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
     @{command_def "notation"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
     @{command_def "no_notation"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
     @{command_def "write"} & : & \<open>proof(state) \<rightarrow> proof(state)\<close> \\
   \end{matharray}
 
   Commands that introduce new logical entities (terms or types) usually allow
   to provide mixfix annotations on the spot, which is convenient for default
   notation. Nonetheless, the syntax may be modified later on by declarations
   for explicit notation. This allows to add or delete mixfix annotations for
   of existing logical entities within the current context.
 
   \<^rail>\<open>
     (@@{command type_notation} | @@{command no_type_notation}) @{syntax mode}? \<newline>
       (@{syntax name} @{syntax mixfix} + @'and')
     ;
     (@@{command notation} | @@{command no_notation}) @{syntax mode}? \<newline>
       (@{syntax name} @{syntax mixfix} + @'and')
     ;
     @@{command write} @{syntax mode}? (@{syntax name} @{syntax mixfix} + @'and')
   \<close>
 
   \<^descr> @{command "type_notation"}~\<open>c (mx)\<close> associates mixfix syntax with an
   existing type constructor. The arity of the constructor is retrieved from
   the context.
 
   \<^descr> @{command "no_type_notation"} is similar to @{command "type_notation"},
   but removes the specified syntax annotation from the present context.
 
   \<^descr> @{command "notation"}~\<open>c (mx)\<close> associates mixfix syntax with an existing
   constant or fixed variable. The type declaration of the given entity is
   retrieved from the context.
 
   \<^descr> @{command "no_notation"} is similar to @{command "notation"}, but removes
   the specified syntax annotation from the present context.
 
   \<^descr> @{command "write"} is similar to @{command "notation"}, but works within
   an Isar proof body.
 \<close>
 
 
 section \<open>The Pure syntax \label{sec:pure-syntax}\<close>
 
 subsection \<open>Lexical matters \label{sec:inner-lex}\<close>
 
 text \<open>
   The inner lexical syntax vaguely resembles the outer one
   (\secref{sec:outer-lex}), but some details are different. There are two main
   categories of inner syntax tokens:
 
   \<^enum> \<^emph>\<open>delimiters\<close> --- the literal tokens occurring in productions of the given
   priority grammar (cf.\ \secref{sec:priority-grammar});
 
   \<^enum> \<^emph>\<open>named tokens\<close> --- various categories of identifiers etc.
 
 
   Delimiters override named tokens and may thus render certain identifiers
   inaccessible. Sometimes the logical context admits alternative ways to refer
   to the same entity, potentially via qualified names.
 
   \<^medskip>
   The categories for named tokens are defined once and for all as follows,
   reusing some categories of the outer token syntax (\secref{sec:outer-lex}).
 
   \begin{center}
   \begin{supertabular}{rcl}
     @{syntax_def (inner) id} & = & @{syntax_ref short_ident} \\
     @{syntax_def (inner) longid} & = & @{syntax_ref long_ident} \\
     @{syntax_def (inner) var} & = & @{syntax_ref var} \\
     @{syntax_def (inner) tid} & = & @{syntax_ref type_ident} \\
     @{syntax_def (inner) tvar} & = & @{syntax_ref type_var} \\
     @{syntax_def (inner) num_token} & = & @{syntax_ref nat} \\
     @{syntax_def (inner) float_token} & = & @{syntax_ref nat}\<^verbatim>\<open>.\<close>@{syntax_ref nat} \\
     @{syntax_def (inner) str_token} & = & \<^verbatim>\<open>''\<close> \<open>\<dots>\<close> \<^verbatim>\<open>''\<close> \\
     @{syntax_def (inner) string_token} & = & \<^verbatim>\<open>"\<close> \<open>\<dots>\<close> \<^verbatim>\<open>"\<close> \\
     @{syntax_def (inner) cartouche} & = & @{verbatim "\<open>"} \<open>\<dots>\<close> @{verbatim "\<close>"} \\
   \end{supertabular}
   \end{center}
 
   The token categories @{syntax (inner) num_token}, @{syntax (inner)
   float_token}, @{syntax (inner) str_token}, @{syntax (inner) string_token},
   and @{syntax (inner) cartouche} are not used in Pure. Object-logics may
   implement numerals and string literals by adding appropriate syntax
   declarations, together with some translation functions (e.g.\ see
   \<^file>\<open>~~/src/HOL/Tools/string_syntax.ML\<close>).
 
   The derived categories @{syntax_def (inner) num_const}, and @{syntax_def
   (inner) float_const}, provide robust access to the respective tokens: the
   syntax tree holds a syntactic constant instead of a free variable.
 
   Formal document comments (\secref{sec:comments}) may be also used within the
   inner syntax.
 \<close>
 
 
 subsection \<open>Priority grammars \label{sec:priority-grammar}\<close>
 
 text \<open>
   A context-free grammar consists of a set of \<^emph>\<open>terminal symbols\<close>, a set of
   \<^emph>\<open>nonterminal symbols\<close> and a set of \<^emph>\<open>productions\<close>. Productions have the
   form \<open>A = \<gamma>\<close>, where \<open>A\<close> is a nonterminal and \<open>\<gamma>\<close> is a string of terminals
   and nonterminals. One designated nonterminal is called the \<^emph>\<open>root symbol\<close>.
   The language defined by the grammar consists of all strings of terminals
   that can be derived from the root symbol by applying productions as rewrite
   rules.
 
   The standard Isabelle parser for inner syntax uses a \<^emph>\<open>priority grammar\<close>.
   Each nonterminal is decorated by an integer priority: \<open>A\<^sup>(\<^sup>p\<^sup>)\<close>. In a
   derivation, \<open>A\<^sup>(\<^sup>p\<^sup>)\<close> may be rewritten using a production \<open>A\<^sup>(\<^sup>q\<^sup>) = \<gamma>\<close> only
   if \<open>p \<le> q\<close>. Any priority grammar can be translated into a normal
   context-free grammar by introducing new nonterminals and productions.
 
   \<^medskip>
   Formally, a set of context free productions \<open>G\<close> induces a derivation
   relation \<open>\<longrightarrow>\<^sub>G\<close> as follows. Let \<open>\<alpha>\<close> and \<open>\<beta>\<close> denote strings of terminal or
   nonterminal symbols. Then \<open>\<alpha> A\<^sup>(\<^sup>p\<^sup>) \<beta> \<longrightarrow>\<^sub>G \<alpha> \<gamma> \<beta>\<close> holds if and only if \<open>G\<close>
   contains some production \<open>A\<^sup>(\<^sup>q\<^sup>) = \<gamma>\<close> for \<open>p \<le> q\<close>.
 
   \<^medskip>
   The following grammar for arithmetic expressions demonstrates how binding
   power and associativity of operators can be enforced by priorities.
 
   \begin{center}
   \begin{tabular}{rclr}
   \<open>A\<^sup>(\<^sup>1\<^sup>0\<^sup>0\<^sup>0\<^sup>)\<close> & \<open>=\<close> & \<^verbatim>\<open>(\<close> \<open>A\<^sup>(\<^sup>0\<^sup>)\<close> \<^verbatim>\<open>)\<close> \\
   \<open>A\<^sup>(\<^sup>1\<^sup>0\<^sup>0\<^sup>0\<^sup>)\<close> & \<open>=\<close> & \<^verbatim>\<open>0\<close> \\
   \<open>A\<^sup>(\<^sup>0\<^sup>)\<close> & \<open>=\<close> & \<open>A\<^sup>(\<^sup>0\<^sup>)\<close> \<^verbatim>\<open>+\<close> \<open>A\<^sup>(\<^sup>1\<^sup>)\<close> \\
   \<open>A\<^sup>(\<^sup>2\<^sup>)\<close> & \<open>=\<close> & \<open>A\<^sup>(\<^sup>3\<^sup>)\<close> \<^verbatim>\<open>*\<close> \<open>A\<^sup>(\<^sup>2\<^sup>)\<close> \\
   \<open>A\<^sup>(\<^sup>3\<^sup>)\<close> & \<open>=\<close> & \<^verbatim>\<open>-\<close> \<open>A\<^sup>(\<^sup>3\<^sup>)\<close> \\
   \end{tabular}
   \end{center}
   The choice of priorities determines that \<^verbatim>\<open>-\<close> binds tighter than \<^verbatim>\<open>*\<close>, which
   binds tighter than \<^verbatim>\<open>+\<close>. Furthermore \<^verbatim>\<open>+\<close> associates to the left and \<^verbatim>\<open>*\<close> to
   the right.
 
   \<^medskip>
   For clarity, grammars obey these conventions:
 
     \<^item> All priorities must lie between 0 and 1000.
 
     \<^item> Priority 0 on the right-hand side and priority 1000 on the left-hand
     side may be omitted.
 
     \<^item> The production \<open>A\<^sup>(\<^sup>p\<^sup>) = \<alpha>\<close> is written as \<open>A = \<alpha> (p)\<close>, i.e.\ the
     priority of the left-hand side actually appears in a column on the far
     right.
 
     \<^item> Alternatives are separated by \<open>|\<close>.
 
     \<^item> Repetition is indicated by dots \<open>(\<dots>)\<close> in an informal but obvious way.
 
   Using these conventions, the example grammar specification above
   takes the form:
   \begin{center}
   \begin{tabular}{rclc}
     \<open>A\<close> & \<open>=\<close> & \<^verbatim>\<open>(\<close> \<open>A\<close> \<^verbatim>\<open>)\<close> \\
               & \<open>|\<close> & \<^verbatim>\<open>0\<close> & \qquad\qquad \\
               & \<open>|\<close> & \<open>A\<close> \<^verbatim>\<open>+\<close> \<open>A\<^sup>(\<^sup>1\<^sup>)\<close> & \<open>(0)\<close> \\
               & \<open>|\<close> & \<open>A\<^sup>(\<^sup>3\<^sup>)\<close> \<^verbatim>\<open>*\<close> \<open>A\<^sup>(\<^sup>2\<^sup>)\<close> & \<open>(2)\<close> \\
               & \<open>|\<close> & \<^verbatim>\<open>-\<close> \<open>A\<^sup>(\<^sup>3\<^sup>)\<close> & \<open>(3)\<close> \\
   \end{tabular}
   \end{center}
 \<close>
 
 
 subsection \<open>The Pure grammar \label{sec:pure-grammar}\<close>
 
 text \<open>
   The priority grammar of the \<open>Pure\<close> theory is defined approximately like
   this:
 
   \begin{center}
   \begin{supertabular}{rclr}
 
   @{syntax_def (inner) any} & = & \<open>prop  |  logic\<close> \\\\
 
   @{syntax_def (inner) prop} & = & \<^verbatim>\<open>(\<close> \<open>prop\<close> \<^verbatim>\<open>)\<close> \\
     & \<open>|\<close> & \<open>prop\<^sup>(\<^sup>4\<^sup>)\<close> \<^verbatim>\<open>::\<close> \<open>type\<close> & \<open>(3)\<close> \\
     & \<open>|\<close> & \<open>any\<^sup>(\<^sup>3\<^sup>)\<close> \<^verbatim>\<open>==\<close> \<open>any\<^sup>(\<^sup>3\<^sup>)\<close> & \<open>(2)\<close> \\
     & \<open>|\<close> & \<open>any\<^sup>(\<^sup>3\<^sup>)\<close> \<open>\<equiv>\<close> \<open>any\<^sup>(\<^sup>3\<^sup>)\<close> & \<open>(2)\<close> \\
     & \<open>|\<close> & \<open>prop\<^sup>(\<^sup>3\<^sup>)\<close> \<^verbatim>\<open>&&&\<close> \<open>prop\<^sup>(\<^sup>2\<^sup>)\<close> & \<open>(2)\<close> \\
     & \<open>|\<close> & \<open>prop\<^sup>(\<^sup>2\<^sup>)\<close> \<^verbatim>\<open>==>\<close> \<open>prop\<^sup>(\<^sup>1\<^sup>)\<close> & \<open>(1)\<close> \\
     & \<open>|\<close> & \<open>prop\<^sup>(\<^sup>2\<^sup>)\<close> \<open>\<Longrightarrow>\<close> \<open>prop\<^sup>(\<^sup>1\<^sup>)\<close> & \<open>(1)\<close> \\
     & \<open>|\<close> & \<^verbatim>\<open>[|\<close> \<open>prop\<close> \<^verbatim>\<open>;\<close> \<open>\<dots>\<close> \<^verbatim>\<open>;\<close> \<open>prop\<close> \<^verbatim>\<open>|]\<close> \<^verbatim>\<open>==>\<close> \<open>prop\<^sup>(\<^sup>1\<^sup>)\<close> & \<open>(1)\<close> \\
     & \<open>|\<close> & \<open>\<lbrakk>\<close> \<open>prop\<close> \<^verbatim>\<open>;\<close> \<open>\<dots>\<close> \<^verbatim>\<open>;\<close> \<open>prop\<close> \<open>\<rbrakk>\<close> \<open>\<Longrightarrow>\<close> \<open>prop\<^sup>(\<^sup>1\<^sup>)\<close> & \<open>(1)\<close> \\
     & \<open>|\<close> & \<^verbatim>\<open>!!\<close> \<open>idts\<close> \<^verbatim>\<open>.\<close> \<open>prop\<close> & \<open>(0)\<close> \\
     & \<open>|\<close> & \<open>\<And>\<close> \<open>idts\<close> \<^verbatim>\<open>.\<close> \<open>prop\<close> & \<open>(0)\<close> \\
     & \<open>|\<close> & \<^verbatim>\<open>OFCLASS\<close> \<^verbatim>\<open>(\<close> \<open>type\<close> \<^verbatim>\<open>,\<close> \<open>logic\<close> \<^verbatim>\<open>)\<close> \\
     & \<open>|\<close> & \<^verbatim>\<open>SORT_CONSTRAINT\<close> \<^verbatim>\<open>(\<close> \<open>type\<close> \<^verbatim>\<open>)\<close> \\
     & \<open>|\<close> & \<^verbatim>\<open>TERM\<close> \<open>logic\<close> \\
     & \<open>|\<close> & \<^verbatim>\<open>PROP\<close> \<open>aprop\<close> \\\\
 
   @{syntax_def (inner) aprop} & = & \<^verbatim>\<open>(\<close> \<open>aprop\<close> \<^verbatim>\<open>)\<close> \\
     & \<open>|\<close> & \<open>id  |  longid  |  var  |\<close>~~\<^verbatim>\<open>_\<close>~~\<open>|\<close>~~\<^verbatim>\<open>...\<close> \\
     & \<open>|\<close> & \<^verbatim>\<open>CONST\<close> \<open>id  |\<close>~~\<^verbatim>\<open>CONST\<close> \<open>longid\<close> \\
     & \<open>|\<close> & \<^verbatim>\<open>XCONST\<close> \<open>id  |\<close>~~\<^verbatim>\<open>XCONST\<close> \<open>longid\<close> \\
     & \<open>|\<close> & \<open>logic\<^sup>(\<^sup>1\<^sup>0\<^sup>0\<^sup>0\<^sup>)  any\<^sup>(\<^sup>1\<^sup>0\<^sup>0\<^sup>0\<^sup>) \<dots> any\<^sup>(\<^sup>1\<^sup>0\<^sup>0\<^sup>0\<^sup>)\<close> & \<open>(999)\<close> \\\\
 
   @{syntax_def (inner) logic} & = & \<^verbatim>\<open>(\<close> \<open>logic\<close> \<^verbatim>\<open>)\<close> \\
     & \<open>|\<close> & \<open>logic\<^sup>(\<^sup>4\<^sup>)\<close> \<^verbatim>\<open>::\<close> \<open>type\<close> & \<open>(3)\<close> \\
     & \<open>|\<close> & \<open>id  |  longid  |  var  |\<close>~~\<^verbatim>\<open>_\<close>~~\<open>|\<close>~~\<^verbatim>\<open>...\<close> \\
     & \<open>|\<close> & \<^verbatim>\<open>CONST\<close> \<open>id  |\<close>~~\<^verbatim>\<open>CONST\<close> \<open>longid\<close> \\
     & \<open>|\<close> & \<^verbatim>\<open>XCONST\<close> \<open>id  |\<close>~~\<^verbatim>\<open>XCONST\<close> \<open>longid\<close> \\
     & \<open>|\<close> & \<open>logic\<^sup>(\<^sup>1\<^sup>0\<^sup>0\<^sup>0\<^sup>)  any\<^sup>(\<^sup>1\<^sup>0\<^sup>0\<^sup>0\<^sup>) \<dots> any\<^sup>(\<^sup>1\<^sup>0\<^sup>0\<^sup>0\<^sup>)\<close> & \<open>(999)\<close> \\
     & \<open>|\<close> & \<^verbatim>\<open>%\<close> \<open>pttrns\<close> \<^verbatim>\<open>.\<close> \<open>any\<^sup>(\<^sup>3\<^sup>)\<close> & \<open>(3)\<close> \\
     & \<open>|\<close> & \<open>\<lambda>\<close> \<open>pttrns\<close> \<^verbatim>\<open>.\<close> \<open>any\<^sup>(\<^sup>3\<^sup>)\<close> & \<open>(3)\<close> \\
     & \<open>|\<close> & \<^verbatim>\<open>(==)\<close>~~\<open>|\<close>~~\<^verbatim>\<open>(\<close>\<open>\<equiv>\<close>\<^verbatim>\<open>)\<close>~~\<open>|\<close>~~\<^verbatim>\<open>(&&&)\<close> \\
     & \<open>|\<close> & \<^verbatim>\<open>(==>)\<close>~~\<open>|\<close>~~\<^verbatim>\<open>(\<close>\<open>\<Longrightarrow>\<close>\<^verbatim>\<open>)\<close> \\
     & \<open>|\<close> & \<^verbatim>\<open>TYPE\<close> \<^verbatim>\<open>(\<close> \<open>type\<close> \<^verbatim>\<open>)\<close> \\\\
 
   @{syntax_def (inner) idt} & = & \<^verbatim>\<open>(\<close> \<open>idt\<close> \<^verbatim>\<open>)\<close>~~\<open>|  id  |\<close>~~\<^verbatim>\<open>_\<close> \\
     & \<open>|\<close> & \<open>id\<close> \<^verbatim>\<open>::\<close> \<open>type\<close> & \<open>(0)\<close> \\
     & \<open>|\<close> & \<^verbatim>\<open>_\<close> \<^verbatim>\<open>::\<close> \<open>type\<close> & \<open>(0)\<close> \\\\
 
   @{syntax_def (inner) index} & = & \<^verbatim>\<open>\<^bsub>\<close> \<open>logic\<^sup>(\<^sup>0\<^sup>)\<close> \<^verbatim>\<open>\<^esub>\<close>~~\<open>|  |  \<index>\<close> \\\\
 
   @{syntax_def (inner) idts} & = & \<open>idt  |  idt\<^sup>(\<^sup>1\<^sup>) idts\<close> & \<open>(0)\<close> \\\\
 
   @{syntax_def (inner) pttrn} & = & \<open>idt\<close> \\\\
 
   @{syntax_def (inner) pttrns} & = & \<open>pttrn  |  pttrn\<^sup>(\<^sup>1\<^sup>) pttrns\<close> & \<open>(0)\<close> \\\\
 
   @{syntax_def (inner) type} & = & \<^verbatim>\<open>(\<close> \<open>type\<close> \<^verbatim>\<open>)\<close> \\
     & \<open>|\<close> & \<open>tid  |  tvar  |\<close>~~\<^verbatim>\<open>_\<close> \\
     & \<open>|\<close> & \<open>tid\<close> \<^verbatim>\<open>::\<close> \<open>sort  |  tvar\<close>~~\<^verbatim>\<open>::\<close> \<open>sort  |\<close>~~\<^verbatim>\<open>_\<close> \<^verbatim>\<open>::\<close> \<open>sort\<close> \\
     & \<open>|\<close> & \<open>type_name  |  type\<^sup>(\<^sup>1\<^sup>0\<^sup>0\<^sup>0\<^sup>) type_name\<close> \\
     & \<open>|\<close> & \<^verbatim>\<open>(\<close> \<open>type\<close> \<^verbatim>\<open>,\<close> \<open>\<dots>\<close> \<^verbatim>\<open>,\<close> \<open>type\<close> \<^verbatim>\<open>)\<close> \<open>type_name\<close> \\
     & \<open>|\<close> & \<open>type\<^sup>(\<^sup>1\<^sup>)\<close> \<^verbatim>\<open>=>\<close> \<open>type\<close> & \<open>(0)\<close> \\
     & \<open>|\<close> & \<open>type\<^sup>(\<^sup>1\<^sup>)\<close> \<open>\<Rightarrow>\<close> \<open>type\<close> & \<open>(0)\<close> \\
     & \<open>|\<close> & \<^verbatim>\<open>[\<close> \<open>type\<close> \<^verbatim>\<open>,\<close> \<open>\<dots>\<close> \<^verbatim>\<open>,\<close> \<open>type\<close> \<^verbatim>\<open>]\<close> \<^verbatim>\<open>=>\<close> \<open>type\<close> & \<open>(0)\<close> \\
     & \<open>|\<close> & \<^verbatim>\<open>[\<close> \<open>type\<close> \<^verbatim>\<open>,\<close> \<open>\<dots>\<close> \<^verbatim>\<open>,\<close> \<open>type\<close> \<^verbatim>\<open>]\<close> \<open>\<Rightarrow>\<close> \<open>type\<close> & \<open>(0)\<close> \\
   @{syntax_def (inner) type_name} & = & \<open>id  |  longid\<close> \\\\
 
   @{syntax_def (inner) sort} & = & @{syntax class_name}~~\<open>|\<close>~~\<^verbatim>\<open>_\<close>~~\<open>|\<close>~~\<^verbatim>\<open>{}\<close> \\
     & \<open>|\<close> & \<^verbatim>\<open>{\<close> @{syntax class_name} \<^verbatim>\<open>,\<close> \<open>\<dots>\<close> \<^verbatim>\<open>,\<close> @{syntax class_name} \<^verbatim>\<open>}\<close> \\
   @{syntax_def (inner) class_name} & = & \<open>id  |  longid\<close> \\
   \end{supertabular}
   \end{center}
 
   \<^medskip>
   Here literal terminals are printed \<^verbatim>\<open>verbatim\<close>; see also
   \secref{sec:inner-lex} for further token categories of the inner syntax. The
   meaning of the nonterminals defined by the above grammar is as follows:
 
   \<^descr> @{syntax_ref (inner) any} denotes any term.
 
   \<^descr> @{syntax_ref (inner) prop} denotes meta-level propositions, which are
   terms of type \<^typ>\<open>prop\<close>. The syntax of such formulae of the meta-logic is
   carefully distinguished from usual conventions for object-logics. In
   particular, plain \<open>\<lambda>\<close>-term notation is \<^emph>\<open>not\<close> recognized as @{syntax (inner)
   prop}.
 
   \<^descr> @{syntax_ref (inner) aprop} denotes atomic propositions, which are
   embedded into regular @{syntax (inner) prop} by means of an explicit \<^verbatim>\<open>PROP\<close>
   token.
 
   Terms of type \<^typ>\<open>prop\<close> with non-constant head, e.g.\ a plain variable,
   are printed in this form. Constants that yield type \<^typ>\<open>prop\<close> are expected
   to provide their own concrete syntax; otherwise the printed version will
   appear like @{syntax (inner) logic} and cannot be parsed again as @{syntax
   (inner) prop}.
 
   \<^descr> @{syntax_ref (inner) logic} denotes arbitrary terms of a logical type,
   excluding type \<^typ>\<open>prop\<close>. This is the main syntactic category of
   object-logic entities, covering plain \<open>\<lambda>\<close>-term notation (variables,
   abstraction, application), plus anything defined by the user.
 
   When specifying notation for logical entities, all logical types (excluding
   \<^typ>\<open>prop\<close>) are \<^emph>\<open>collapsed\<close> to this single category of @{syntax (inner)
   logic}.
 
   \<^descr> @{syntax_ref (inner) index} denotes an optional index term for indexed
   syntax. If omitted, it refers to the first @{keyword_ref "structure"}
   variable in the context. The special dummy ``\<open>\<index>\<close>'' serves as pattern
   variable in mixfix annotations that introduce indexed notation.
 
   \<^descr> @{syntax_ref (inner) idt} denotes identifiers, possibly constrained by
   types.
 
   \<^descr> @{syntax_ref (inner) idts} denotes a sequence of @{syntax_ref (inner)
   idt}. This is the most basic category for variables in iterated binders,
   such as \<open>\<lambda>\<close> or \<open>\<And>\<close>.
 
   \<^descr> @{syntax_ref (inner) pttrn} and @{syntax_ref (inner) pttrns} denote
   patterns for abstraction, cases bindings etc. In Pure, these categories
   start as a merely copy of @{syntax (inner) idt} and @{syntax (inner) idts},
   respectively. Object-logics may add additional productions for binding
   forms.
 
   \<^descr> @{syntax_ref (inner) type} denotes types of the meta-logic.
 
   \<^descr> @{syntax_ref (inner) sort} denotes meta-level sorts.
 
 
   Here are some further explanations of certain syntax features.
 
   \<^item> In @{syntax (inner) idts}, note that \<open>x :: nat y\<close> is parsed as \<open>x :: (nat
   y)\<close>, treating \<open>y\<close> like a type constructor applied to \<open>nat\<close>. To avoid this
   interpretation, write \<open>(x :: nat) y\<close> with explicit parentheses.
 
   \<^item> Similarly, \<open>x :: nat y :: nat\<close> is parsed as \<open>x :: (nat y :: nat)\<close>. The
   correct form is \<open>(x :: nat) (y :: nat)\<close>, or \<open>(x :: nat) y :: nat\<close> if \<open>y\<close> is
   last in the sequence of identifiers.
 
   \<^item> Type constraints for terms bind very weakly. For example, \<open>x < y :: nat\<close>
   is normally parsed as \<open>(x < y) :: nat\<close>, unless \<open><\<close> has a very low priority,
   in which case the input is likely to be ambiguous. The correct form is \<open>x <
   (y :: nat)\<close>.
 
   \<^item> Dummy variables (written as underscore) may occur in different
   roles.
 
     \<^descr> A sort ``\<open>_\<close>'' refers to a vacuous constraint for type variables, which
     is effectively ignored in type-inference.
 
     \<^descr> A type ``\<open>_\<close>'' or ``\<open>_ :: sort\<close>'' acts like an anonymous inference
     parameter, which is filled-in according to the most general type produced
     by the type-checking phase.
 
     \<^descr> A bound ``\<open>_\<close>'' refers to a vacuous abstraction, where the body does not
     refer to the binding introduced here. As in the term \<^term>\<open>\<lambda>x _. x\<close>,
     which is \<open>\<alpha>\<close>-equivalent to \<open>\<lambda>x y. x\<close>.
 
     \<^descr> A free ``\<open>_\<close>'' refers to an implicit outer binding. Higher definitional
     packages usually allow forms like \<open>f x _ = x\<close>.
 
     \<^descr> A schematic ``\<open>_\<close>'' (within a term pattern, see \secref{sec:term-decls})
     refers to an anonymous variable that is implicitly abstracted over its
     context of locally bound variables. For example, this allows pattern
     matching of \<open>{x. f x = g x}\<close> against \<open>{x. _ = _}\<close>, or even \<open>{_. _ = _}\<close> by
     using both bound and schematic dummies.
 
   \<^descr> The three literal dots ``\<^verbatim>\<open>...\<close>'' may be also written as ellipsis symbol
   \<^verbatim>\<open>\<dots>\<close>. In both cases this refers to a special schematic variable, which is
   bound in the context. This special term abbreviation works nicely with
   calculational reasoning (\secref{sec:calculation}).
 
   \<^descr> \<^verbatim>\<open>CONST\<close> ensures that the given identifier is treated as constant term,
   and passed through the parse tree in fully internalized form. This is
   particularly relevant for translation rules (\secref{sec:syn-trans}),
   notably on the RHS.
 
   \<^descr> \<^verbatim>\<open>XCONST\<close> is similar to \<^verbatim>\<open>CONST\<close>, but retains the constant name as given.
   This is only relevant to translation rules (\secref{sec:syn-trans}), notably
   on the LHS.
 \<close>
 
 
 subsection \<open>Inspecting the syntax\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{command_def "print_syntax"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
   \end{matharray}
 
   \<^descr> @{command "print_syntax"} prints the inner syntax of the current context.
   The output can be quite large; the most important sections are explained
   below.
 
     \<^descr> \<open>lexicon\<close> lists the delimiters of the inner token language; see
     \secref{sec:inner-lex}.
 
     \<^descr> \<open>productions\<close> lists the productions of the underlying priority grammar;
     see \secref{sec:priority-grammar}.
 
     Many productions have an extra \<open>\<dots> \<^bold>\<Rightarrow> name\<close>. These names later become the
     heads of parse trees; they also guide the pretty printer.
 
     Productions without such parse tree names are called \<^emph>\<open>copy productions\<close>.
     Their right-hand side must have exactly one nonterminal symbol (or named
     token). The parser does not create a new parse tree node for copy
     productions, but simply returns the parse tree of the right-hand symbol.
 
     If the right-hand side of a copy production consists of a single
     nonterminal without any delimiters, then it is called a \<^emph>\<open>chain
     production\<close>. Chain productions act as abbreviations: conceptually, they
     are removed from the grammar by adding new productions. Priority
     information attached to chain productions is ignored.
 
     \<^descr> \<open>print modes\<close> lists the alternative print modes provided by this
     grammar; see \secref{sec:print-modes}.
 
     \<^descr> \<open>parse_rules\<close> and \<open>print_rules\<close> relate to syntax translations (macros);
     see \secref{sec:syn-trans}.
 
     \<^descr> \<open>parse_ast_translation\<close> and \<open>print_ast_translation\<close> list sets of
     constants that invoke translation functions for abstract syntax trees,
     which are only required in very special situations; see
     \secref{sec:tr-funs}.
 
     \<^descr> \<open>parse_translation\<close> and \<open>print_translation\<close> list the sets of constants
     that invoke regular translation functions; see \secref{sec:tr-funs}.
 \<close>
 
 
 subsection \<open>Ambiguity of parsed expressions\<close>
 
 text \<open>
   \begin{tabular}{rcll}
     @{attribute_def syntax_ambiguity_warning} & : & \<open>attribute\<close> & default \<open>true\<close> \\
     @{attribute_def syntax_ambiguity_limit} & : & \<open>attribute\<close> & default \<open>10\<close> \\
   \end{tabular}
 
   Depending on the grammar and the given input, parsing may be ambiguous.
   Isabelle lets the Earley parser enumerate all possible parse trees, and then
   tries to make the best out of the situation. Terms that cannot be
   type-checked are filtered out, which often leads to a unique result in the
   end. Unlike regular type reconstruction, which is applied to the whole
   collection of input terms simultaneously, the filtering stage only treats
   each given term in isolation. Filtering is also not attempted for individual
   types or raw ASTs (as required for @{command translations}).
 
   Certain warning or error messages are printed, depending on the situation
   and the given configuration options. Parsing ultimately fails, if multiple
   results remain after the filtering phase.
 
   \<^descr> @{attribute syntax_ambiguity_warning} controls output of explicit warning
   messages about syntax ambiguity.
 
   \<^descr> @{attribute syntax_ambiguity_limit} determines the number of resulting
   parse trees that are shown as part of the printed message in case of an
   ambiguity.
 \<close>
 
 
 section \<open>Syntax transformations \label{sec:syntax-transformations}\<close>
 
 text \<open>
   The inner syntax engine of Isabelle provides separate mechanisms to
   transform parse trees either via rewrite systems on first-order ASTs
   (\secref{sec:syn-trans}), or ML functions on ASTs or syntactic \<open>\<lambda>\<close>-terms
   (\secref{sec:tr-funs}). This works both for parsing and printing, as
   outlined in \figref{fig:parse-print}.
 
   \begin{figure}[htbp]
   \begin{center}
   \begin{tabular}{cl}
   string          & \\
   \<open>\<down>\<close>     & lexer + parser \\
   parse tree      & \\
   \<open>\<down>\<close>     & parse AST translation \\
   AST             & \\
   \<open>\<down>\<close>     & AST rewriting (macros) \\
   AST             & \\
   \<open>\<down>\<close>     & parse translation \\
   --- pre-term ---    & \\
   \<open>\<down>\<close>     & print translation \\
   AST             & \\
   \<open>\<down>\<close>     & AST rewriting (macros) \\
   AST             & \\
   \<open>\<down>\<close>     & print AST translation \\
   string          &
   \end{tabular}
   \end{center}
   \caption{Parsing and printing with translations}\label{fig:parse-print}
   \end{figure}
 
   These intermediate syntax tree formats eventually lead to a pre-term with
   all names and binding scopes resolved, but most type information still
   missing. Explicit type constraints might be given by the user, or implicit
   position information by the system --- both need to be passed-through
   carefully by syntax transformations.
 
   Pre-terms are further processed by the so-called \<^emph>\<open>check\<close> and \<^emph>\<open>uncheck\<close>
-  phases that are intertwined with type-inference (see also @{cite
-  "isabelle-implementation"}). The latter allows to operate on higher-order
+  phases that are intertwined with type-inference (see also \<^cite>\<open>"isabelle-implementation"\<close>). The latter allows to operate on higher-order
   abstract syntax with proper binding and type information already available.
 
   As a rule of thumb, anything that manipulates bindings of variables or
   constants needs to be implemented as syntax transformation (see below).
   Anything else is better done via check/uncheck: a prominent example
   application is the @{command abbreviation} concept of Isabelle/Pure.
 \<close>
 
 
 subsection \<open>Abstract syntax trees \label{sec:ast}\<close>
 
 text \<open>
   The ML datatype \<^ML_type>\<open>Ast.ast\<close> explicitly represents the intermediate
   AST format that is used for syntax rewriting (\secref{sec:syn-trans}). It is
   defined in ML as follows:
   @{verbatim [display]
 \<open>datatype ast =
   Constant of string |
   Variable of string |
   Appl of ast list\<close>}
 
   An AST is either an atom (constant or variable) or a list of (at least two)
   subtrees. Occasional diagnostic output of ASTs uses notation that resembles
   S-expression of LISP. Constant atoms are shown as quoted strings, variable
   atoms as non-quoted strings and applications as a parenthesized list of
   subtrees. For example, the AST
   @{ML [display] \<open>Ast.Appl [Ast.Constant "_abs", Ast.Variable "x", Ast.Variable "t"]\<close>}
   is pretty-printed as \<^verbatim>\<open>("_abs" x t)\<close>. Note that \<^verbatim>\<open>()\<close> and \<^verbatim>\<open>(x)\<close> are
   excluded as ASTs, because they have too few subtrees.
 
   \<^medskip>
   AST application is merely a pro-forma mechanism to indicate certain
   syntactic structures. Thus \<^verbatim>\<open>(c a b)\<close> could mean either term application or
   type application, depending on the syntactic context.
 
   Nested application like \<^verbatim>\<open>(("_abs" x t) u)\<close> is also possible, but ASTs are
   definitely first-order: the syntax constant \<^verbatim>\<open>"_abs"\<close> does not bind the \<^verbatim>\<open>x\<close>
   in any way. Proper bindings are introduced in later stages of the term
   syntax, where \<^verbatim>\<open>("_abs" x t)\<close> becomes an \<^ML>\<open>Abs\<close> node and occurrences of
   \<^verbatim>\<open>x\<close> in \<^verbatim>\<open>t\<close> are replaced by bound variables (represented as de-Bruijn
   indices).
 \<close>
 
 
 subsubsection \<open>AST constants versus variables\<close>
 
 text \<open>
   Depending on the situation --- input syntax, output syntax, translation
   patterns --- the distinction of atomic ASTs as \<^ML>\<open>Ast.Constant\<close> versus
   \<^ML>\<open>Ast.Variable\<close> serves slightly different purposes.
 
   Input syntax of a term such as \<open>f a b = c\<close> does not yet indicate the scopes
   of atomic entities \<open>f, a, b, c\<close>: they could be global constants or local
   variables, even bound ones depending on the context of the term. \<^ML>\<open>Ast.Variable\<close> leaves this choice still open: later syntax layers (or
   translation functions) may capture such a variable to determine its role
   specifically, to make it a constant, bound variable, free variable etc. In
   contrast, syntax translations that introduce already known constants would
   rather do it via \<^ML>\<open>Ast.Constant\<close> to prevent accidental re-interpretation
   later on.
 
   Output syntax turns term constants into \<^ML>\<open>Ast.Constant\<close> and variables
   (free or schematic) into \<^ML>\<open>Ast.Variable\<close>. This information is precise
   when printing fully formal \<open>\<lambda>\<close>-terms.
 
   \<^medskip>
   AST translation patterns (\secref{sec:syn-trans}) that represent terms
   cannot distinguish constants and variables syntactically. Explicit
   indication of \<open>CONST c\<close> inside the term language is required, unless \<open>c\<close> is
   known as special \<^emph>\<open>syntax constant\<close> (see also @{command syntax}). It is also
   possible to use @{command syntax} declarations (without mixfix annotation)
   to enforce that certain unqualified names are always treated as constant
   within the syntax machinery.
 
   The situation is simpler for ASTs that represent types or sorts, since the
   concrete syntax already distinguishes type variables from type constants
   (constructors). So \<open>('a, 'b) foo\<close> corresponds to an AST application of some
   constant for \<open>foo\<close> and variable arguments for \<open>'a\<close> and \<open>'b\<close>. Note that the
   postfix application is merely a feature of the concrete syntax, while in the
   AST the constructor occurs in head position.
 \<close>
 
 
 subsubsection \<open>Authentic syntax names\<close>
 
 text \<open>
   Naming constant entities within ASTs is another delicate issue. Unqualified
   names are resolved in the name space tables in the last stage of parsing,
   after all translations have been applied. Since syntax transformations do
   not know about this later name resolution, there can be surprises in
   boundary cases.
 
   \<^emph>\<open>Authentic syntax names\<close> for \<^ML>\<open>Ast.Constant\<close> avoid this problem: the
   fully-qualified constant name with a special prefix for its formal category
   (\<open>class\<close>, \<open>type\<close>, \<open>const\<close>, \<open>fixed\<close>) represents the information faithfully
   within the untyped AST format. Accidental overlap with free or bound
   variables is excluded as well. Authentic syntax names work implicitly in the
   following situations:
 
     \<^item> Input of term constants (or fixed variables) that are introduced by
     concrete syntax via @{command notation}: the correspondence of a
     particular grammar production to some known term entity is preserved.
 
     \<^item> Input of type constants (constructors) and type classes --- thanks to
     explicit syntactic distinction independently on the context.
 
     \<^item> Output of term constants, type constants, type classes --- this
     information is already available from the internal term to be printed.
 
   In other words, syntax transformations that operate on input terms written
   as prefix applications are difficult to make robust. Luckily, this case
   rarely occurs in practice, because syntax forms to be translated usually
   correspond to some concrete notation.
 \<close>
 
 
 subsection \<open>Raw syntax and translations \label{sec:syn-trans}\<close>
 
 text \<open>
   \begin{tabular}{rcll}
     @{command_def "nonterminal"} & : & \<open>theory \<rightarrow> theory\<close> \\
     @{command_def "syntax"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
     @{command_def "no_syntax"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
     @{command_def "translations"} & : & \<open>theory \<rightarrow> theory\<close> \\
     @{command_def "no_translations"} & : & \<open>theory \<rightarrow> theory\<close> \\
     @{attribute_def syntax_ast_trace} & : & \<open>attribute\<close> & default \<open>false\<close> \\
     @{attribute_def syntax_ast_stats} & : & \<open>attribute\<close> & default \<open>false\<close> \\
   \end{tabular}
   \<^medskip>
 
   Unlike mixfix notation for existing formal entities (\secref{sec:notation}),
   raw syntax declarations provide full access to the priority grammar of the
   inner syntax, without any sanity checks. This includes additional syntactic
   categories (via @{command nonterminal}) and free-form grammar productions
   (via @{command syntax}). Additional syntax translations (or macros, via
   @{command translations}) are required to turn resulting parse trees into
   proper representations of formal entities again.
 
   \<^rail>\<open>
     @@{command nonterminal} (@{syntax name} + @'and')
     ;
     (@@{command syntax} | @@{command no_syntax}) @{syntax mode}? (constdecl +)
     ;
     (@@{command translations} | @@{command no_translations})
       (transpat ('==' | '=>' | '<=' | '\<rightleftharpoons>' | '\<rightharpoonup>' | '\<leftharpoondown>') transpat +)
     ;
 
     constdecl: @{syntax name} '::' @{syntax type} @{syntax mixfix}?
     ;
     mode: ('(' ( @{syntax name} | @'output' | @{syntax name} @'output' ) ')')
     ;
     transpat: ('(' @{syntax name} ')')? @{syntax string}
   \<close>
 
   \<^descr> @{command "nonterminal"}~\<open>c\<close> declares a type constructor \<open>c\<close> (without
   arguments) to act as purely syntactic type: a nonterminal symbol of the
   inner syntax.
 
   \<^descr> @{command "syntax"}~\<open>(mode) c :: \<sigma> (mx)\<close> augments the priority grammar and
   the pretty printer table for the given print mode (default \<^verbatim>\<open>""\<close>). An
   optional keyword @{keyword_ref "output"} means that only the pretty printer
   table is affected.
 
   Following \secref{sec:mixfix}, the mixfix annotation \<open>mx = template ps q\<close>
   together with type \<open>\<sigma> = \<tau>\<^sub>1 \<Rightarrow> \<dots> \<tau>\<^sub>n \<Rightarrow> \<tau>\<close> and specify a grammar production.
   The \<open>template\<close> contains delimiter tokens that surround \<open>n\<close> argument
   positions (\<^verbatim>\<open>_\<close>). The latter correspond to nonterminal symbols \<open>A\<^sub>i\<close> derived
   from the argument types \<open>\<tau>\<^sub>i\<close> as follows:
 
     \<^item> \<open>prop\<close> if \<open>\<tau>\<^sub>i = prop\<close>
 
     \<^item> \<open>logic\<close> if \<open>\<tau>\<^sub>i = (\<dots>)\<kappa>\<close> for logical type constructor \<open>\<kappa> \<noteq> prop\<close>
 
     \<^item> \<open>any\<close> if \<open>\<tau>\<^sub>i = \<alpha>\<close> for type variables
 
     \<^item> \<open>\<kappa>\<close> if \<open>\<tau>\<^sub>i = \<kappa>\<close> for nonterminal \<open>\<kappa>\<close> (syntactic type constructor)
 
   Each \<open>A\<^sub>i\<close> is decorated by priority \<open>p\<^sub>i\<close> from the given list \<open>ps\<close>; missing
   priorities default to 0.
 
   The resulting nonterminal of the production is determined similarly from
   type \<open>\<tau>\<close>, with priority \<open>q\<close> and default 1000.
 
   \<^medskip>
   Parsing via this production produces parse trees \<open>t\<^sub>1, \<dots>, t\<^sub>n\<close> for the
   argument slots. The resulting parse tree is composed as \<open>c t\<^sub>1 \<dots> t\<^sub>n\<close>, by
   using the syntax constant \<open>c\<close> of the syntax declaration.
 
   Such syntactic constants are invented on the spot, without formal check
   wrt.\ existing declarations. It is conventional to use plain identifiers
   prefixed by a single underscore (e.g.\ \<open>_foobar\<close>). Names should be chosen
   with care, to avoid clashes with other syntax declarations.
 
   \<^medskip>
   The special case of copy production is specified by \<open>c =\<close>~\<^verbatim>\<open>""\<close> (empty
   string). It means that the resulting parse tree \<open>t\<close> is copied directly,
   without any further decoration.
 
   \<^descr> @{command "no_syntax"}~\<open>(mode) decls\<close> removes grammar declarations (and
   translations) resulting from \<open>decls\<close>, which are interpreted in the same
   manner as for @{command "syntax"} above.
 
   \<^descr> @{command "translations"}~\<open>rules\<close> specifies syntactic translation rules
   (i.e.\ macros) as first-order rewrite rules on ASTs (\secref{sec:ast}). The
   theory context maintains two independent lists translation rules: parse
   rules (\<^verbatim>\<open>=>\<close> or \<open>\<rightharpoonup>\<close>) and print rules (\<^verbatim>\<open><=\<close> or \<open>\<leftharpoondown>\<close>). For convenience, both
   can be specified simultaneously as parse~/ print rules (\<^verbatim>\<open>==\<close> or \<open>\<rightleftharpoons>\<close>).
 
   Translation patterns may be prefixed by the syntactic category to be used
   for parsing; the default is \<open>logic\<close> which means that regular term syntax is
   used. Both sides of the syntax translation rule undergo parsing and parse
   AST translations \secref{sec:tr-funs}, in order to perform some fundamental
   normalization like \<open>\<lambda>x y. b \<leadsto> \<lambda>x. \<lambda>y. b\<close>, but other AST translation rules
   are \<^emph>\<open>not\<close> applied recursively here.
 
   When processing AST patterns, the inner syntax lexer runs in a different
   mode that allows identifiers to start with underscore. This accommodates the
   usual naming convention for auxiliary syntax constants --- those that do not
   have a logical counter part --- by allowing to specify arbitrary AST
   applications within the term syntax, independently of the corresponding
   concrete syntax.
 
   Atomic ASTs are distinguished as \<^ML>\<open>Ast.Constant\<close> versus \<^ML>\<open>Ast.Variable\<close> as follows: a qualified name or syntax constant declared via
   @{command syntax}, or parse tree head of concrete notation becomes \<^ML>\<open>Ast.Constant\<close>, anything else \<^ML>\<open>Ast.Variable\<close>. Note that \<open>CONST\<close> and
   \<open>XCONST\<close> within the term language (\secref{sec:pure-grammar}) allow to
   enforce treatment as constants.
 
   AST rewrite rules \<open>(lhs, rhs)\<close> need to obey the following side-conditions:
 
     \<^item> Rules must be left linear: \<open>lhs\<close> must not contain repeated
     variables.\<^footnote>\<open>The deeper reason for this is that AST equality is not
     well-defined: different occurrences of the ``same'' AST could be decorated
     differently by accidental type-constraints or source position information,
     for example.\<close>
 
     \<^item> Every variable in \<open>rhs\<close> must also occur in \<open>lhs\<close>.
 
   \<^descr> @{command "no_translations"}~\<open>rules\<close> removes syntactic translation rules,
   which are interpreted in the same manner as for @{command "translations"}
   above.
 
   \<^descr> @{attribute syntax_ast_trace} and @{attribute syntax_ast_stats} control
   diagnostic output in the AST normalization process, when translation rules
   are applied to concrete input or output.
 
 
   Raw syntax and translations provides a slightly more low-level access to the
   grammar and the form of resulting parse trees. It is often possible to avoid
   this untyped macro mechanism, and use type-safe @{command abbreviation} or
   @{command notation} instead. Some important situations where @{command
   syntax} and @{command translations} are really need are as follows:
 
   \<^item> Iterated replacement via recursive @{command translations}. For example,
   consider list enumeration \<^term>\<open>[a, b, c, d]\<close> as defined in theory
   \<^theory>\<open>HOL.List\<close>.
 
   \<^item> Change of binding status of variables: anything beyond the built-in
   @{keyword "binder"} mixfix annotation requires explicit syntax translations.
   For example, consider the set comprehension syntax \<^term>\<open>{x. P}\<close> as
   defined in theory \<^theory>\<open>HOL.Set\<close>.
 \<close>
 
 
 subsubsection \<open>Applying translation rules\<close>
 
 text \<open>
   As a term is being parsed or printed, an AST is generated as an intermediate
   form according to \figref{fig:parse-print}. The AST is normalized by
   applying translation rules in the manner of a first-order term rewriting
   system. We first examine how a single rule is applied.
 
   Let \<open>t\<close> be the abstract syntax tree to be normalized and \<open>(lhs, rhs)\<close> some
   translation rule. A subtree \<open>u\<close> of \<open>t\<close> is called \<^emph>\<open>redex\<close> if it is an
   instance of \<open>lhs\<close>; in this case the pattern \<open>lhs\<close> is said to match the
   object \<open>u\<close>. A redex matched by \<open>lhs\<close> may be replaced by the corresponding
   instance of \<open>rhs\<close>, thus \<^emph>\<open>rewriting\<close> the AST \<open>t\<close>. Matching requires some
   notion of \<^emph>\<open>place-holders\<close> in rule patterns: \<^ML>\<open>Ast.Variable\<close> serves this
   purpose.
 
   More precisely, the matching of the object \<open>u\<close> against the pattern \<open>lhs\<close> is
   performed as follows:
 
     \<^item> Objects of the form \<^ML>\<open>Ast.Variable\<close>~\<open>x\<close> or \<^ML>\<open>Ast.Constant\<close>~\<open>x\<close> are
     matched by pattern \<^ML>\<open>Ast.Constant\<close>~\<open>x\<close>. Thus all atomic ASTs in the
     object are treated as (potential) constants, and a successful match makes
     them actual constants even before name space resolution (see also
     \secref{sec:ast}).
 
     \<^item> Object \<open>u\<close> is matched by pattern \<^ML>\<open>Ast.Variable\<close>~\<open>x\<close>, binding \<open>x\<close> to
     \<open>u\<close>.
 
     \<^item> Object \<^ML>\<open>Ast.Appl\<close>~\<open>us\<close> is matched by \<^ML>\<open>Ast.Appl\<close>~\<open>ts\<close> if \<open>us\<close> and
     \<open>ts\<close> have the same length and each corresponding subtree matches.
 
     \<^item> In every other case, matching fails.
 
   A successful match yields a substitution that is applied to \<open>rhs\<close>,
   generating the instance that replaces \<open>u\<close>.
 
   Normalizing an AST involves repeatedly applying translation rules until none
   are applicable. This works yoyo-like: top-down, bottom-up, top-down, etc. At
   each subtree position, rules are chosen in order of appearance in the theory
   definitions.
 
   The configuration options @{attribute syntax_ast_trace} and @{attribute
   syntax_ast_stats} might help to understand this process and diagnose
   problems.
 
   \begin{warn}
   If syntax translation rules work incorrectly, the output of @{command_ref
   print_syntax} with its \<^emph>\<open>rules\<close> sections reveals the actual internal forms
   of AST pattern, without potentially confusing concrete syntax. Recall that
   AST constants appear as quoted strings and variables without quotes.
   \end{warn}
 
   \begin{warn}
   If @{attribute_ref eta_contract} is set to \<open>true\<close>, terms will be
   \<open>\<eta>\<close>-contracted \<^emph>\<open>before\<close> the AST rewriter sees them. Thus some abstraction
   nodes needed for print rules to match may vanish. For example, \<open>Ball A (\<lambda>x.
   P x)\<close> would contract to \<open>Ball A P\<close> and the standard print rule would fail to
   apply. This problem can be avoided by hand-written ML translation functions
   (see also \secref{sec:tr-funs}), which is in fact the same mechanism used in
   built-in @{keyword "binder"} declarations.
   \end{warn}
 \<close>
 
 
 subsection \<open>Syntax translation functions \label{sec:tr-funs}\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{command_def "parse_ast_translation"} & : & \<open>theory \<rightarrow> theory\<close> \\
     @{command_def "parse_translation"} & : & \<open>theory \<rightarrow> theory\<close> \\
     @{command_def "print_translation"} & : & \<open>theory \<rightarrow> theory\<close> \\
     @{command_def "typed_print_translation"} & : & \<open>theory \<rightarrow> theory\<close> \\
     @{command_def "print_ast_translation"} & : & \<open>theory \<rightarrow> theory\<close> \\
     @{ML_antiquotation_def "class_syntax"} & : & \<open>ML antiquotation\<close> \\
     @{ML_antiquotation_def "type_syntax"} & : & \<open>ML antiquotation\<close> \\
     @{ML_antiquotation_def "const_syntax"} & : & \<open>ML antiquotation\<close> \\
     @{ML_antiquotation_def "syntax_const"} & : & \<open>ML antiquotation\<close> \\
   \end{matharray}
 
   Syntax translation functions written in ML admit almost arbitrary
   manipulations of inner syntax, at the expense of some complexity and
   obscurity in the implementation.
 
   \<^rail>\<open>
   ( @@{command parse_ast_translation} | @@{command parse_translation} |
     @@{command print_translation} | @@{command typed_print_translation} |
     @@{command print_ast_translation}) @{syntax text}
   ;
   (@@{ML_antiquotation class_syntax} |
    @@{ML_antiquotation type_syntax} |
    @@{ML_antiquotation const_syntax} |
    @@{ML_antiquotation syntax_const}) embedded
   \<close>
 
   \<^descr> @{command parse_translation} etc. declare syntax translation functions to
   the theory. Any of these commands have a single @{syntax text} argument that
   refers to an ML expression of appropriate type as follows:
 
   \<^medskip>
   {\footnotesize
   \begin{tabular}{l}
   @{command parse_ast_translation} : \\
   \quad \<^ML_type>\<open>(string * (Proof.context -> Ast.ast list -> Ast.ast)) list\<close> \\
   @{command parse_translation} : \\
   \quad \<^ML_type>\<open>(string * (Proof.context -> term list -> term)) list\<close> \\
   @{command print_translation} : \\
   \quad \<^ML_type>\<open>(string * (Proof.context -> term list -> term)) list\<close> \\
   @{command typed_print_translation} : \\
   \quad \<^ML_type>\<open>(string * (Proof.context -> typ -> term list -> term)) list\<close> \\
   @{command print_ast_translation} : \\
   \quad \<^ML_type>\<open>(string * (Proof.context -> Ast.ast list -> Ast.ast)) list\<close> \\
   \end{tabular}}
   \<^medskip>
 
   The argument list consists of \<open>(c, tr)\<close> pairs, where \<open>c\<close> is the syntax name
   of the formal entity involved, and \<open>tr\<close> a function that translates a syntax
   form \<open>c args\<close> into \<open>tr ctxt args\<close> (depending on the context). The
   Isabelle/ML naming convention for parse translations is \<open>c_tr\<close> and for print
   translations \<open>c_tr'\<close>.
 
   The @{command_ref print_syntax} command displays the sets of names
   associated with the translation functions of a theory under
   \<open>parse_ast_translation\<close> etc.
 
   \<^descr> \<open>@{class_syntax c}\<close>, \<open>@{type_syntax c}\<close>, \<open>@{const_syntax c}\<close> inline the
   authentic syntax name of the given formal entities into the ML source. This
   is the fully-qualified logical name prefixed by a special marker to indicate
   its kind: thus different logical name spaces are properly distinguished
   within parse trees.
 
   \<^descr> \<open>@{const_syntax c}\<close> inlines the name \<open>c\<close> of the given syntax constant,
   having checked that it has been declared via some @{command syntax} commands
   within the theory context. Note that the usual naming convention makes
   syntax constants start with underscore, to reduce the chance of accidental
   clashes with other names occurring in parse trees (unqualified constants
   etc.).
 \<close>
 
 
 subsubsection \<open>The translation strategy\<close>
 
 text \<open>
   The different kinds of translation functions are invoked during the
   transformations between parse trees, ASTs and syntactic terms (cf.\
   \figref{fig:parse-print}). Whenever a combination of the form \<open>c x\<^sub>1 \<dots> x\<^sub>n\<close>
   is encountered, and a translation function \<open>f\<close> of appropriate kind is
   declared for \<open>c\<close>, the result is produced by evaluation of \<open>f [x\<^sub>1, \<dots>, x\<^sub>n]\<close>
   in ML.
 
   For AST translations, the arguments \<open>x\<^sub>1, \<dots>, x\<^sub>n\<close> are ASTs. A combination
   has the form \<^ML>\<open>Ast.Constant\<close>~\<open>c\<close> or \<^ML>\<open>Ast.Appl\<close>~\<open>[\<close>\<^ML>\<open>Ast.Constant\<close>~\<open>c, x\<^sub>1, \<dots>, x\<^sub>n]\<close>. For term translations, the arguments are
   terms and a combination has the form \<^ML>\<open>Const\<close>~\<open>(c, \<tau>)\<close> or \<^ML>\<open>Const\<close>~\<open>(c, \<tau>) $ x\<^sub>1 $ \<dots> $ x\<^sub>n\<close>. Terms allow more sophisticated
   transformations than ASTs do, typically involving abstractions and bound
   variables. \<^emph>\<open>Typed\<close> print translations may even peek at the type \<open>\<tau>\<close> of the
   constant they are invoked on, although some information might have been
   suppressed for term output already.
 
   Regardless of whether they act on ASTs or terms, translation functions
   called during the parsing process differ from those for printing in their
   overall behaviour:
 
     \<^descr>[Parse translations] are applied bottom-up. The arguments are already in
     translated form. The translations must not fail; exceptions trigger an
     error message. There may be at most one function associated with any
     syntactic name.
 
     \<^descr>[Print translations] are applied top-down. They are supplied with
     arguments that are partly still in internal form. The result again
     undergoes translation; therefore a print translation should not introduce
     as head the very constant that invoked it. The function may raise
     exception \<^ML>\<open>Match\<close> to indicate failure; in this event it has no effect.
     Multiple functions associated with some syntactic name are tried in the
     order of declaration in the theory.
 
   Only constant atoms --- constructor \<^ML>\<open>Ast.Constant\<close> for ASTs and \<^ML>\<open>Const\<close> for terms --- can invoke translation functions. This means that parse
   translations can only be associated with parse tree heads of concrete
   syntax, or syntactic constants introduced via other translations. For plain
   identifiers within the term language, the status of constant versus variable
   is not yet know during parsing. This is in contrast to print translations,
   where constants are explicitly known from the given term in its fully
   internal form.
 \<close>
 
 
 subsection \<open>Built-in syntax transformations\<close>
 
 text \<open>
   Here are some further details of the main syntax transformation phases of
   \figref{fig:parse-print}.
 \<close>
 
 
 subsubsection \<open>Transforming parse trees to ASTs\<close>
 
 text \<open>
   The parse tree is the raw output of the parser. It is transformed into an
   AST according to some basic scheme that may be augmented by AST translation
   functions as explained in \secref{sec:tr-funs}.
 
   The parse tree is constructed by nesting the right-hand sides of the
   productions used to recognize the input. Such parse trees are simply lists
   of tokens and constituent parse trees, the latter representing the
   nonterminals of the productions. Ignoring AST translation functions, parse
   trees are transformed to ASTs by stripping out delimiters and copy
   productions, while retaining some source position information from input
   tokens.
 
   The Pure syntax provides predefined AST translations to make the basic
   \<open>\<lambda>\<close>-term structure more apparent within the (first-order) AST
   representation, and thus facilitate the use of @{command translations} (see
   also \secref{sec:syn-trans}). This covers ordinary term application, type
   application, nested abstraction, iterated meta implications and function
   types. The effect is illustrated on some representative input strings is as
   follows:
 
   \begin{center}
   \begin{tabular}{ll}
   input source & AST \\
   \hline
   \<open>f x y z\<close> & \<^verbatim>\<open>(f x y z)\<close> \\
   \<open>'a ty\<close> & \<^verbatim>\<open>(ty 'a)\<close> \\
   \<open>('a, 'b)ty\<close> & \<^verbatim>\<open>(ty 'a 'b)\<close> \\
   \<open>\<lambda>x y z. t\<close> & \<^verbatim>\<open>("_abs" x ("_abs" y ("_abs" z t)))\<close> \\
   \<open>\<lambda>x :: 'a. t\<close> & \<^verbatim>\<open>("_abs" ("_constrain" x 'a) t)\<close> \\
   \<open>\<lbrakk>P; Q; R\<rbrakk> \<Longrightarrow> S\<close> & \<^verbatim>\<open>("Pure.imp" P ("Pure.imp" Q ("Pure.imp" R S)))\<close> \\
    \<open>['a, 'b, 'c] \<Rightarrow> 'd\<close> & \<^verbatim>\<open>("fun" 'a ("fun" 'b ("fun" 'c 'd)))\<close> \\
   \end{tabular}
   \end{center}
 
   Note that type and sort constraints may occur in further places ---
   translations need to be ready to cope with them. The built-in syntax
   transformation from parse trees to ASTs insert additional constraints that
   represent source positions.
 \<close>
 
 
 subsubsection \<open>Transforming ASTs to terms\<close>
 
 text \<open>
   After application of macros (\secref{sec:syn-trans}), the AST is transformed
   into a term. This term still lacks proper type information, but it might
   contain some constraints consisting of applications with head \<^verbatim>\<open>_constrain\<close>,
   where the second argument is a type encoded as a pre-term within the syntax.
   Type inference later introduces correct types, or indicates type errors in
   the input.
 
   Ignoring parse translations, ASTs are transformed to terms by mapping AST
   constants to term constants, AST variables to term variables or constants
   (according to the name space), and AST applications to iterated term
   applications.
 
   The outcome is still a first-order term. Proper abstractions and bound
   variables are introduced by parse translations associated with certain
   syntax constants. Thus \<^verbatim>\<open>("_abs" x x)\<close> eventually becomes a de-Bruijn term
   \<^verbatim>\<open>Abs ("x", _, Bound 0)\<close>.
 \<close>
 
 
 subsubsection \<open>Printing of terms\<close>
 
 text \<open>
   The output phase is essentially the inverse of the input phase. Terms are
   translated via abstract syntax trees into pretty-printed text.
 
   Ignoring print translations, the transformation maps term constants,
   variables and applications to the corresponding constructs on ASTs.
   Abstractions are mapped to applications of the special constant \<^verbatim>\<open>_abs\<close> as
   seen before. Type constraints are represented via special \<^verbatim>\<open>_constrain\<close>
   forms, according to various policies of type annotation determined
   elsewhere. Sort constraints of type variables are handled in a similar
   fashion.
 
   After application of macros (\secref{sec:syn-trans}), the AST is finally
   pretty-printed. The built-in print AST translations reverse the
   corresponding parse AST translations.
 
   \<^medskip>
   For the actual printing process, the priority grammar
   (\secref{sec:priority-grammar}) plays a vital role: productions are used as
   templates for pretty printing, with argument slots stemming from
   nonterminals, and syntactic sugar stemming from literal tokens.
 
   Each AST application with constant head \<open>c\<close> and arguments \<open>t\<^sub>1\<close>, \dots,
   \<open>t\<^sub>n\<close> (for \<open>n = 0\<close> the AST is just the constant \<open>c\<close> itself) is printed
   according to the first grammar production of result name \<open>c\<close>. The required
   syntax priority of the argument slot is given by its nonterminal \<open>A\<^sup>(\<^sup>p\<^sup>)\<close>.
   The argument \<open>t\<^sub>i\<close> that corresponds to the position of \<open>A\<^sup>(\<^sup>p\<^sup>)\<close> is printed
   recursively, and then put in parentheses \<^emph>\<open>if\<close> its priority \<open>p\<close> requires
   this. The resulting output is concatenated with the syntactic sugar
   according to the grammar production.
 
   If an AST application \<open>(c x\<^sub>1 \<dots> x\<^sub>m)\<close> has more arguments than the
   corresponding production, it is first split into \<open>((c x\<^sub>1 \<dots> x\<^sub>n) x\<^sub>n\<^sub>+\<^sub>1 \<dots>
   x\<^sub>m)\<close> and then printed recursively as above.
 
   Applications with too few arguments or with non-constant head or without a
   corresponding production are printed in prefix-form like \<open>f t\<^sub>1 \<dots> t\<^sub>n\<close> for
   terms.
 
   Multiple productions associated with some name \<open>c\<close> are tried in order of
   appearance within the grammar. An occurrence of some AST variable \<open>x\<close> is
   printed as \<open>x\<close> outright.
 
   \<^medskip>
   White space is \<^emph>\<open>not\<close> inserted automatically. If blanks (or breaks) are
   required to separate tokens, they need to be specified in the mixfix
   declaration (\secref{sec:mixfix}).
 \<close>
 
 end
diff --git a/src/Doc/Isar_Ref/Outer_Syntax.thy b/src/Doc/Isar_Ref/Outer_Syntax.thy
--- a/src/Doc/Isar_Ref/Outer_Syntax.thy
+++ b/src/Doc/Isar_Ref/Outer_Syntax.thy
@@ -1,606 +1,605 @@
 (*:maxLineLen=78:*)
 
 theory Outer_Syntax
   imports Main Base
 begin
 
 chapter \<open>Outer syntax --- the theory language \label{ch:outer-syntax}\<close>
 
 text \<open>
   The rather generic framework of Isabelle/Isar syntax emerges from three main
   syntactic categories: \<^emph>\<open>commands\<close> of the top-level Isar engine (covering
   theory and proof elements), \<^emph>\<open>methods\<close> for general goal refinements
   (analogous to traditional ``tactics''), and \<^emph>\<open>attributes\<close> for operations on
   facts (within a certain context). Subsequently we give a reference of basic
   syntactic entities underlying Isabelle/Isar syntax in a bottom-up manner.
   Concrete theory and proof language elements will be introduced later on.
 
   \<^medskip>
   In order to get started with writing well-formed Isabelle/Isar documents,
   the most important aspect to be noted is the difference of \<^emph>\<open>inner\<close> versus
   \<^emph>\<open>outer\<close> syntax. Inner syntax is that of Isabelle types and terms of the
   logic, while outer syntax is that of Isabelle/Isar theory sources
   (specifications and proofs). As a general rule, inner syntax entities may
   occur only as \<^emph>\<open>atomic entities\<close> within outer syntax. For example, the
   string \<^verbatim>\<open>"x + y"\<close> and identifier \<^verbatim>\<open>z\<close> are legal term specifications within a
   theory, while \<^verbatim>\<open>x + y\<close> without quotes is not.
 
   Printed theory documents usually omit quotes to gain readability (this is a
-  matter of {\LaTeX} macro setup, say via \<^verbatim>\<open>\isabellestyle\<close>, see also @{cite
-  "isabelle-system"}). Experienced users of Isabelle/Isar may easily
+  matter of {\LaTeX} macro setup, say via \<^verbatim>\<open>\isabellestyle\<close>, see also \<^cite>\<open>"isabelle-system"\<close>). Experienced users of Isabelle/Isar may easily
   reconstruct the lost technical information, while mere readers need not care
   about quotes at all.
 \<close>
 
 
 section \<open>Commands\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{command_def "print_commands"}\<open>\<^sup>*\<close> & : & \<open>any \<rightarrow>\<close> \\
     @{command_def "help"}\<open>\<^sup>*\<close> & : & \<open>any \<rightarrow>\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     @@{command help} (@{syntax name} * )
   \<close>
 
   \<^descr> @{command "print_commands"} prints all outer syntax keywords
   and commands.
 
   \<^descr> @{command "help"}~\<open>pats\<close> retrieves outer syntax
   commands according to the specified name patterns.
 \<close>
 
 
 subsubsection \<open>Examples\<close>
 
 text \<open>
   Some common diagnostic commands are retrieved like this (according to usual
   naming conventions):
 \<close>
 
 help "print"
 help "find"
 
 
 section \<open>Lexical matters \label{sec:outer-lex}\<close>
 
 text \<open>
   The outer lexical syntax consists of three main categories of syntax tokens:
 
     \<^enum> \<^emph>\<open>major keywords\<close> --- the command names that are available
     in the present logic session;
 
     \<^enum> \<^emph>\<open>minor keywords\<close> --- additional literal tokens required
     by the syntax of commands;
 
     \<^enum> \<^emph>\<open>named tokens\<close> --- various categories of identifiers etc.
 
   Major keywords and minor keywords are guaranteed to be disjoint. This helps
   user-interfaces to determine the overall structure of a theory text, without
   knowing the full details of command syntax. Internally, there is some
   additional information about the kind of major keywords, which approximates
   the command type (theory command, proof command etc.).
 
   Keywords override named tokens. For example, the presence of a command
   called \<^verbatim>\<open>term\<close> inhibits the identifier \<^verbatim>\<open>term\<close>, but the string \<^verbatim>\<open>"term"\<close> can
   be used instead. By convention, the outer syntax always allows quoted
   strings in addition to identifiers, wherever a named entity is expected.
 
   When tokenizing a given input sequence, the lexer repeatedly takes the
   longest prefix of the input that forms a valid token. Spaces, tabs, newlines
   and formfeeds between tokens serve as explicit separators.
 
   \<^medskip>
   The categories for named tokens are defined once and for all as follows.
 
   \begin{center}
   \begin{supertabular}{rcl}
     @{syntax_def short_ident} & = & \<open>letter (subscript\<^sup>? quasiletter)\<^sup>*\<close> \\
     @{syntax_def long_ident} & = & \<open>short_ident(\<close>\<^verbatim>\<open>.\<close>\<open>short_ident)\<^sup>+\<close> \\
     @{syntax_def sym_ident} & = & \<open>sym\<^sup>+  |\<close>~~\<^verbatim>\<open>\\<close>\<^verbatim>\<open><\<close>\<open>short_ident\<close>\<^verbatim>\<open>>\<close> \\
     @{syntax_def nat} & = & \<open>digit\<^sup>+\<close> \\
     @{syntax_def float} & = & @{syntax_ref nat}\<^verbatim>\<open>.\<close>@{syntax_ref nat}~~\<open>|\<close>~~\<^verbatim>\<open>-\<close>@{syntax_ref nat}\<^verbatim>\<open>.\<close>@{syntax_ref nat} \\
     @{syntax_def term_var} & = & \<^verbatim>\<open>?\<close>\<open>short_ident  |\<close>~~\<^verbatim>\<open>?\<close>\<open>short_ident\<close>\<^verbatim>\<open>.\<close>\<open>nat\<close> \\
     @{syntax_def type_ident} & = & \<^verbatim>\<open>'\<close>\<open>short_ident\<close> \\
     @{syntax_def type_var} & = & \<^verbatim>\<open>?\<close>\<open>type_ident  |\<close>~~\<^verbatim>\<open>?\<close>\<open>type_ident\<close>\<^verbatim>\<open>.\<close>\<open>nat\<close> \\
     @{syntax_def string} & = & \<^verbatim>\<open>"\<close> \<open>\<dots>\<close> \<^verbatim>\<open>"\<close> \\
     @{syntax_def altstring} & = & \<^verbatim>\<open>`\<close> \<open>\<dots>\<close> \<^verbatim>\<open>`\<close> \\
     @{syntax_def cartouche} & = & @{verbatim "\<open>"} \<open>\<dots>\<close> @{verbatim "\<close>"} \\
     @{syntax_def verbatim} & = & \<^verbatim>\<open>{*\<close> \<open>\<dots>\<close> \<^verbatim>\<open>*}\<close> \\[1ex]
 
     \<open>letter\<close> & = & \<open>latin  |\<close>~~\<^verbatim>\<open>\\<close>\<^verbatim>\<open><\<close>\<open>latin\<close>\<^verbatim>\<open>>\<close>~~\<open>|\<close>~~\<^verbatim>\<open>\\<close>\<^verbatim>\<open><\<close>\<open>latin latin\<close>\<^verbatim>\<open>>\<close>~~\<open>|  greek  |\<close> \\
     \<open>subscript\<close> & = & \<^verbatim>\<open>\<^sub>\<close> \\
     \<open>quasiletter\<close> & = & \<open>letter  |  digit  |\<close>~~\<^verbatim>\<open>_\<close>~~\<open>|\<close>~~\<^verbatim>\<open>'\<close> \\
     \<open>latin\<close> & = & \<^verbatim>\<open>a\<close>~~\<open>| \<dots> |\<close>~~\<^verbatim>\<open>z\<close>~~\<open>|\<close>~~\<^verbatim>\<open>A\<close>~~\<open>|  \<dots> |\<close>~~\<^verbatim>\<open>Z\<close> \\
     \<open>digit\<close> & = & \<^verbatim>\<open>0\<close>~~\<open>|  \<dots> |\<close>~~\<^verbatim>\<open>9\<close> \\
     \<open>sym\<close> & = & \<^verbatim>\<open>!\<close>~~\<open>|\<close>~~\<^verbatim>\<open>#\<close>~~\<open>|\<close>~~\<^verbatim>\<open>$\<close>~~\<open>|\<close>~~\<^verbatim>\<open>%\<close>~~\<open>|\<close>~~\<^verbatim>\<open>&\<close>~~\<open>|\<close>~~\<^verbatim>\<open>*\<close>~~\<open>|\<close>~~\<^verbatim>\<open>+\<close>~~\<open>|\<close>~~\<^verbatim>\<open>-\<close>~~\<open>|\<close>~~\<^verbatim>\<open>/\<close>~~\<open>|\<close> \\
     & & \<^verbatim>\<open><\<close>~~\<open>|\<close>~~\<^verbatim>\<open>=\<close>~~\<open>|\<close>~~\<^verbatim>\<open>>\<close>~~\<open>|\<close>~~\<^verbatim>\<open>?\<close>~~\<open>|\<close>~~\<^verbatim>\<open>@\<close>~~\<open>|\<close>~~\<^verbatim>\<open>^\<close>~~\<open>|\<close>~~\<^verbatim>\<open>_\<close>~~\<open>|\<close>~~\<^verbatim>\<open>|\<close>~~\<open>|\<close>~~\<^verbatim>\<open>~\<close> \\
     \<open>greek\<close> & = & \<^verbatim>\<open>\<alpha>\<close>~~\<open>|\<close>~~\<^verbatim>\<open>\<beta>\<close>~~\<open>|\<close>~~\<^verbatim>\<open>\<gamma>\<close>~~\<open>|\<close>~~\<^verbatim>\<open>\<delta>\<close>~~\<open>|\<close> \\
           &   & \<^verbatim>\<open>\<epsilon>\<close>~~\<open>|\<close>~~\<^verbatim>\<open>\<zeta>\<close>~~\<open>|\<close>~~\<^verbatim>\<open>\<eta>\<close>~~\<open>|\<close>~~\<^verbatim>\<open>\<theta>\<close>~~\<open>|\<close> \\
           &   & \<^verbatim>\<open>\<iota>\<close>~~\<open>|\<close>~~\<^verbatim>\<open>\<kappa>\<close>~~\<open>|\<close>~~\<^verbatim>\<open>\<mu>\<close>~~\<open>|\<close>~~\<^verbatim>\<open>\<nu>\<close>~~\<open>|\<close> \\
           &   & \<^verbatim>\<open>\<xi>\<close>~~\<open>|\<close>~~\<^verbatim>\<open>\<pi>\<close>~~\<open>|\<close>~~\<^verbatim>\<open>\<rho>\<close>~~\<open>|\<close>~~\<^verbatim>\<open>\<sigma>\<close>~~\<open>|\<close>~~\<^verbatim>\<open>\<tau>\<close>~~\<open>|\<close> \\
           &   & \<^verbatim>\<open>\<upsilon>\<close>~~\<open>|\<close>~~\<^verbatim>\<open>\<phi>\<close>~~\<open>|\<close>~~\<^verbatim>\<open>\<chi>\<close>~~\<open>|\<close>~~\<^verbatim>\<open>\<psi>\<close>~~\<open>|\<close> \\
           &   & \<^verbatim>\<open>\<omega>\<close>~~\<open>|\<close>~~\<^verbatim>\<open>\<Gamma>\<close>~~\<open>|\<close>~~\<^verbatim>\<open>\<Delta>\<close>~~\<open>|\<close>~~\<^verbatim>\<open>\<Theta>\<close>~~\<open>|\<close> \\
           &   & \<^verbatim>\<open>\<Lambda>\<close>~~\<open>|\<close>~~\<^verbatim>\<open>\<Xi>\<close>~~\<open>|\<close>~~\<^verbatim>\<open>\<Pi>\<close>~~\<open>|\<close>~~\<^verbatim>\<open>\<Sigma>\<close>~~\<open>|\<close> \\
           &   & \<^verbatim>\<open>\<Upsilon>\<close>~~\<open>|\<close>~~\<^verbatim>\<open>\<Phi>\<close>~~\<open>|\<close>~~\<^verbatim>\<open>\<Psi>\<close>~~\<open>|\<close>~~\<^verbatim>\<open>\<Omega>\<close> \\
   \end{supertabular}
   \end{center}
 
   A @{syntax_ref term_var} or @{syntax_ref type_var} describes an unknown,
   which is internally a pair of base name and index (ML type \<^ML_type>\<open>indexname\<close>). These components are either separated by a dot as in \<open>?x.1\<close> or
   \<open>?x7.3\<close> or run together as in \<open>?x1\<close>. The latter form is possible if the base
   name does not end with digits. If the index is 0, it may be dropped
   altogether: \<open>?x\<close> and \<open>?x0\<close> and \<open>?x.0\<close> all refer to the same unknown, with
   basename \<open>x\<close> and index 0.
 
   The syntax of @{syntax_ref string} admits any characters, including
   newlines; ``\<^verbatim>\<open>"\<close>'' (double-quote) and ``\<^verbatim>\<open>\\<close>'' (backslash) need to be
   escaped by a backslash; arbitrary character codes may be specified as
   ``\<^verbatim>\<open>\\<close>\<open>ddd\<close>'', with three decimal digits. Alternative strings according to
   @{syntax_ref altstring} are analogous, using single back-quotes instead.
 
   The body of @{syntax_ref verbatim} may consist of any text not containing
   ``\<^verbatim>\<open>*}\<close>''; this allows to include quotes without further escapes, but there
   is no way to escape ``\<^verbatim>\<open>*}\<close>''. Cartouches do not have this limitation.
 
   A @{syntax_ref cartouche} consists of arbitrary text, with properly balanced
   blocks of ``@{verbatim "\<open>"}~\<open>\<dots>\<close>~@{verbatim "\<close>"}''. Note that the rendering
   of cartouche delimiters is usually like this: ``\<open>\<open> \<dots> \<close>\<close>''.
 
   Source comments take the form \<^verbatim>\<open>(*\<close>~\<open>\<dots>\<close>~\<^verbatim>\<open>*)\<close> and may be nested: the text is
   removed after lexical analysis of the input and thus not suitable for
   documentation. The Isar syntax also provides proper \<^emph>\<open>document comments\<close>
   that are considered as part of the text (see \secref{sec:comments}).
 
   Common mathematical symbols such as \<open>\<forall>\<close> are represented in Isabelle as \<^verbatim>\<open>\<forall>\<close>.
   There are infinitely many Isabelle symbols like this, although proper
   presentation is left to front-end tools such as {\LaTeX} or Isabelle/jEdit.
   A list of predefined Isabelle symbols that work well with these tools is
   given in \appref{app:symbols}. Note that \<^verbatim>\<open>\<lambda>\<close> does not belong to the
   \<open>letter\<close> category, since it is already used differently in the Pure term
   language.
 \<close>
 
 
 section \<open>Common syntax entities\<close>
 
 text \<open>
   We now introduce several basic syntactic entities, such as names, terms, and
   theorem specifications, which are factored out of the actual Isar language
   elements to be described later.
 \<close>
 
 
 subsection \<open>Names\<close>
 
 text \<open>
   Entity @{syntax name} usually refers to any name of types, constants,
   theorems etc.\ Quoted strings provide an escape for non-identifier names or
   those ruled out by outer syntax keywords (e.g.\ quoted \<^verbatim>\<open>"let"\<close>).
 
   \<^rail>\<open>
     @{syntax_def name}: @{syntax short_ident} | @{syntax long_ident} |
       @{syntax sym_ident} | @{syntax nat} | @{syntax string}
     ;
     @{syntax_def par_name}: '(' @{syntax name} ')'
   \<close>
 
   A @{syntax_def system_name} is like @{syntax name}, but it excludes
   white-space characters and needs to conform to file-name notation. Name
   components that are special on Windows (e.g.\ \<^verbatim>\<open>CON\<close>, \<^verbatim>\<open>PRN\<close>, \<^verbatim>\<open>AUX\<close>) are
   excluded on all platforms.
 \<close>
 
 
 subsection \<open>Numbers\<close>
 
 text \<open>
   The outer lexical syntax (\secref{sec:outer-lex}) admits natural numbers and
   floating point numbers. These are combined as @{syntax int} and @{syntax
   real} as follows.
 
   \<^rail>\<open>
     @{syntax_def int}: @{syntax nat} | '-' @{syntax nat}
     ;
     @{syntax_def real}: @{syntax float} | @{syntax int}
   \<close>
 
   Note that there is an overlap with the category @{syntax name}, which also
   includes @{syntax nat}.
 \<close>
 
 
 subsection \<open>Embedded content\<close>
 
 text \<open>
   Entity @{syntax embedded} refers to content of other languages: cartouches
   allow arbitrary nesting of sub-languages that respect the recursive
   balancing of cartouche delimiters. Quoted strings are possible as well, but
   require escaped quotes when nested. As a shortcut, tokens that appear as
   plain identifiers in the outer language may be used as inner language
   content without delimiters.
 
   \<^rail>\<open>
     @{syntax_def embedded}: @{syntax cartouche} | @{syntax string} |
       @{syntax short_ident} | @{syntax long_ident} | @{syntax sym_ident} |
       @{syntax term_var} | @{syntax type_ident} | @{syntax type_var} | @{syntax nat}
   \<close>
 \<close>
 
 
 subsection \<open>Document text\<close>
 
 text \<open>
   A chunk of document @{syntax text} is usually given as @{syntax cartouche}
   \<open>\<open>\<dots>\<close>\<close>. For convenience, any of the smaller text unit that conforms to
   @{syntax name} is admitted as well.
 
   \<^rail>\<open>
     @{syntax_def text}: @{syntax embedded}
   \<close>
 
   Typical uses are document markup commands, like \<^theory_text>\<open>chapter\<close>, \<^theory_text>\<open>section\<close> etc.
   (\secref{sec:markup}).
 \<close>
 
 
 subsection \<open>Document comments \label{sec:comments}\<close>
 
 text \<open>
   Formal comments are an integral part of the document, but are logically void
   and removed from the resulting theory or term content. The output of
   document preparation (\chref{ch:document-prep}) supports various styles,
   according to the following kinds of comments.
 
     \<^item> Marginal comment of the form \<^verbatim>\<open>\<comment>\<close>~\<open>\<open>text\<close>\<close> or \<open>\<comment>\<close>~\<open>\<open>text\<close>\<close>, usually with
     a single space between the comment symbol and the argument cartouche. The
     given argument is typeset as regular text, with formal antiquotations
     (\secref{sec:antiq}).
 
     \<^item> Canceled text of the form \<^verbatim>\<open>\<^cancel>\<close>\<open>\<open>text\<close>\<close> (no white space between the
     control symbol and the argument cartouche). The argument is typeset as
     formal Isabelle source and overlaid with a ``strike-through'' pattern,
     e.g. \<^theory_text>\<open>\<^cancel>\<open>bad\<close>\<close>.
 
     \<^item> Raw {\LaTeX} source of the form \<^verbatim>\<open>\<^latex>\<close>\<open>\<open>argument\<close>\<close> (no white space
     between the control symbol and the argument cartouche). This allows to
     augment the generated {\TeX} source arbitrarily, without any sanity
     checks!
 
   These formal comments work uniformly in outer syntax, inner syntax (term
   language), Isabelle/ML, and some other embedded languages of Isabelle.
 \<close>
 
 
 subsection \<open>Type classes, sorts and arities\<close>
 
 text \<open>
   Classes are specified by plain names. Sorts have a very simple inner syntax,
   which is either a single class name \<open>c\<close> or a list \<open>{c\<^sub>1, \<dots>, c\<^sub>n}\<close> referring
   to the intersection of these classes. The syntax of type arities is given
   directly at the outer level.
 
   \<^rail>\<open>
     @{syntax_def classdecl}: @{syntax name} (('<' | '\<subseteq>') (@{syntax name} + ','))?
     ;
     @{syntax_def sort}: @{syntax embedded}
     ;
     @{syntax_def arity}: ('(' (@{syntax sort} + ',') ')')? @{syntax sort}
   \<close>
 \<close>
 
 
 subsection \<open>Types and terms \label{sec:types-terms}\<close>
 
 text \<open>
   The actual inner Isabelle syntax, that of types and terms of the logic, is
   far too sophisticated in order to be modelled explicitly at the outer theory
   level. Basically, any such entity has to be quoted to turn it into a single
   token (the parsing and type-checking is performed internally later). For
   convenience, a slightly more liberal convention is adopted: quotes may be
   omitted for any type or term that is already atomic at the outer level. For
   example, one may just write \<^verbatim>\<open>x\<close> instead of quoted \<^verbatim>\<open>"x"\<close>. Note that
   symbolic identifiers (e.g.\ \<^verbatim>\<open>++\<close> or \<open>\<forall>\<close> are available as well, provided
   these have not been superseded by commands or other keywords already (such
   as \<^verbatim>\<open>=\<close> or \<^verbatim>\<open>+\<close>).
 
   \<^rail>\<open>
     @{syntax_def type}: @{syntax embedded}
     ;
     @{syntax_def term}: @{syntax embedded}
     ;
     @{syntax_def prop}: @{syntax embedded}
   \<close>
 
   Positional instantiations are specified as a sequence of terms, or the
   placeholder ``\<open>_\<close>'' (underscore), which means to skip a position.
 
   \<^rail>\<open>
     @{syntax_def inst}: '_' | @{syntax term}
     ;
     @{syntax_def insts}: (@{syntax inst} *)
   \<close>
 
   Named instantiations are specified as pairs of assignments \<open>v = t\<close>, which
   refer to schematic variables in some theorem that is instantiated. Both type
   and terms instantiations are admitted, and distinguished by the usual syntax
   of variable names.
 
   \<^rail>\<open>
     @{syntax_def named_inst}: variable '=' (type | term)
     ;
     @{syntax_def named_insts}: (named_inst @'and' +)
     ;
     variable: @{syntax name} | @{syntax term_var} | @{syntax type_ident} | @{syntax type_var}
   \<close>
 
   Type declarations and definitions usually refer to @{syntax typespec} on the
   left-hand side. This models basic type constructor application at the outer
   syntax level. Note that only plain postfix notation is available here, but
   no infixes.
 
   \<^rail>\<open>
     @{syntax_def typeargs}:
       (() | @{syntax type_ident} | '(' ( @{syntax type_ident} + ',' ) ')')
     ;
     @{syntax_def typeargs_sorts}:
       (() | (@{syntax type_ident} ('::' @{syntax sort})?) |
         '(' ( (@{syntax type_ident} ('::' @{syntax sort})?) + ',' ) ')')
     ;
     @{syntax_def typespec}: @{syntax typeargs} @{syntax name}
     ;
     @{syntax_def typespec_sorts}: @{syntax typeargs_sorts} @{syntax name}
   \<close>
 \<close>
 
 
 subsection \<open>Term patterns and declarations \label{sec:term-decls}\<close>
 
 text \<open>
   Wherever explicit propositions (or term fragments) occur in a proof text,
   casual binding of schematic term variables may be given specified via
   patterns of the form ``\<^theory_text>\<open>(is p\<^sub>1 \<dots> p\<^sub>n)\<close>''. This works both for @{syntax
   term} and @{syntax prop}.
 
   \<^rail>\<open>
     @{syntax_def term_pat}: '(' (@'is' @{syntax term} +) ')'
     ;
     @{syntax_def prop_pat}: '(' (@'is' @{syntax prop} +) ')'
   \<close>
 
   \<^medskip>
   Declarations of local variables \<open>x :: \<tau>\<close> and logical propositions \<open>a : \<phi>\<close>
   represent different views on the same principle of introducing a local
   scope. In practice, one may usually omit the typing of @{syntax vars} (due
   to type-inference), and the naming of propositions (due to implicit
   references of current facts). In any case, Isar proof elements usually admit
   to introduce multiple such items simultaneously.
 
   \<^rail>\<open>
     @{syntax_def vars}:
       (((@{syntax name} +) ('::' @{syntax type})? |
         @{syntax name} ('::' @{syntax type})? @{syntax mixfix}) + @'and')
     ;
     @{syntax_def props}: @{syntax thmdecl}? (@{syntax prop} @{syntax prop_pat}? +)
     ;
     @{syntax_def props'}: (@{syntax prop} @{syntax prop_pat}? +)
   \<close>
 
   The treatment of multiple declarations corresponds to the complementary
   focus of @{syntax vars} versus @{syntax props}. In ``\<open>x\<^sub>1 \<dots> x\<^sub>n :: \<tau>\<close>'' the
   typing refers to all variables, while in \<open>a: \<phi>\<^sub>1 \<dots> \<phi>\<^sub>n\<close> the naming refers to
   all propositions collectively. Isar language elements that refer to @{syntax
   vars} or @{syntax props} typically admit separate typings or namings via
   another level of iteration, with explicit @{keyword_ref "and"} separators;
   e.g.\ see @{command "fix"} and @{command "assume"} in
   \secref{sec:proof-context}.
 \<close>
 
 
 subsection \<open>Attributes and theorems \label{sec:syn-att}\<close>
 
 text \<open>
   Attributes have their own ``semi-inner'' syntax, in the sense that input
   conforming to @{syntax args} below is parsed by the attribute a second time.
   The attribute argument specifications may be any sequence of atomic entities
   (identifiers, strings etc.), or properly bracketed argument lists. Below
   @{syntax atom} refers to any atomic entity, including any @{syntax keyword}
   conforming to @{syntax sym_ident}.
 
   \<^rail>\<open>
     @{syntax_def atom}: @{syntax name} | @{syntax type_ident} |
       @{syntax type_var} | @{syntax term_var} | @{syntax nat} | @{syntax float} |
       @{syntax keyword} | @{syntax cartouche}
     ;
     arg: @{syntax atom} | '(' @{syntax args} ')' | '[' @{syntax args} ']'
     ;
     @{syntax_def args}: arg *
     ;
     @{syntax_def attributes}: '[' (@{syntax name} @{syntax args} * ',') ']'
   \<close>
 
   Theorem specifications come in several flavors: @{syntax axmdecl} and
   @{syntax thmdecl} usually refer to axioms, assumptions or results of goal
   statements, while @{syntax thmdef} collects lists of existing theorems.
   Existing theorems are given by @{syntax thm} and @{syntax thms}, the
   former requires an actual singleton result.
 
   There are three forms of theorem references:
 
     \<^enum> named facts \<open>a\<close>,
 
     \<^enum> selections from named facts \<open>a(i)\<close> or \<open>a(j - k)\<close>,
 
     \<^enum> literal fact propositions using token syntax @{syntax_ref altstring}
     \<^verbatim>\<open>`\<close>\<open>\<phi>\<close>\<^verbatim>\<open>`\<close> or @{syntax_ref cartouche}
     \<open>\<open>\<phi>\<close>\<close> (see also method @{method_ref fact}).
 
   Any kind of theorem specification may include lists of attributes both on
   the left and right hand sides; attributes are applied to any immediately
   preceding fact. If names are omitted, the theorems are not stored within the
   theorem database of the theory or proof context, but any given attributes
   are applied nonetheless.
 
   An extra pair of brackets around attributes (like ``\<open>[[simproc a]]\<close>'')
   abbreviates a theorem reference involving an internal dummy fact, which will
   be ignored later on. So only the effect of the attribute on the background
   context will persist. This form of in-place declarations is particularly
   useful with commands like @{command "declare"} and @{command "using"}.
 
   \<^rail>\<open>
     @{syntax_def axmdecl}: @{syntax name} @{syntax attributes}? ':'
     ;
     @{syntax_def thmbind}:
       @{syntax name} @{syntax attributes} | @{syntax name} | @{syntax attributes}
     ;
     @{syntax_def thmdecl}: thmbind ':'
     ;
     @{syntax_def thmdef}: thmbind '='
     ;
     @{syntax_def thm}:
       (@{syntax name} selection? | @{syntax altstring} | @{syntax cartouche})
         @{syntax attributes}? |
       '[' @{syntax attributes} ']'
     ;
     @{syntax_def thms}: @{syntax thm} +
     ;
     selection: '(' ((@{syntax nat} | @{syntax nat} '-' @{syntax nat}?) + ',') ')'
   \<close>
 \<close>
 
 
 subsection \<open>Structured specifications\<close>
 
 text \<open>
   Structured specifications use propositions with explicit notation for the
   ``eigen-context'' to describe rule structure: \<open>\<And>x. A x \<Longrightarrow> \<dots> \<Longrightarrow> B x\<close> is
   expressed as \<^theory_text>\<open>B x if A x and \<dots> for x\<close>. It is also possible to use dummy
   terms ``\<open>_\<close>'' (underscore) to refer to locally fixed variables anonymously.
 
   Multiple specifications are delimited by ``\<open>|\<close>'' to emphasize separate
   cases: each with its own scope of inferred types for free variables.
 
 
   \<^rail>\<open>
     @{syntax_def for_fixes}: (@'for' @{syntax vars})?
     ;
     @{syntax_def multi_specs}: (@{syntax structured_spec} + '|')
     ;
     @{syntax_def structured_spec}:
       @{syntax thmdecl}? @{syntax prop} @{syntax spec_prems} @{syntax for_fixes}
     ;
     @{syntax_def spec_prems}: (@'if' ((@{syntax prop}+) + @'and'))?
     ;
     @{syntax_def specification}: @{syntax vars} @'where' @{syntax multi_specs}
   \<close>
 \<close>
 
 
 section \<open>Diagnostic commands\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{command_def "print_theory"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
     @{command_def "print_definitions"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
     @{command_def "print_methods"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
     @{command_def "print_attributes"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
     @{command_def "print_theorems"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
     @{command_def "find_theorems"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
     @{command_def "find_consts"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
     @{command_def "thm_deps"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
     @{command_def "unused_thms"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
     @{command_def "print_facts"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
     @{command_def "print_term_bindings"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     (@@{command print_theory} |
       @@{command print_definitions} |
       @@{command print_methods} |
       @@{command print_attributes} |
       @@{command print_theorems} |
       @@{command print_facts}) ('!'?)
     ;
     @@{command find_theorems} ('(' @{syntax nat}? 'with_dups'? ')')? \<newline> (thm_criterion*)
     ;
     thm_criterion: ('-'?) ('name' ':' @{syntax name} | 'intro' | 'elim' | 'dest' |
       'solves' | 'simp' ':' @{syntax term} | @{syntax term})
     ;
     @@{command find_consts} (const_criterion*)
     ;
     const_criterion: ('-'?)
       ('name' ':' @{syntax name} | 'strict' ':' @{syntax type} | @{syntax type})
     ;
     @@{command thm_deps} @{syntax thmrefs}
     ;
     @@{command unused_thms} ((@{syntax name} +) '-' (@{syntax name} * ))?
   \<close>
 
   These commands print certain parts of the theory and proof context. Note
   that there are some further ones available, such as for the set of rules
   declared for simplifications.
 
   \<^descr> @{command "print_theory"} prints the main logical content of the
   background theory; the ``\<open>!\<close>'' option indicates extra verbosity.
 
   \<^descr> @{command "print_definitions"} prints dependencies of definitional
   specifications within the background theory, which may be constants
   (\secref{sec:term-definitions}, \secref{sec:overloading}) or types
   (\secref{sec:types-pure}, \secref{sec:hol-typedef}); the ``\<open>!\<close>'' option
   indicates extra verbosity.
 
   \<^descr> @{command "print_methods"} prints all proof methods available in the
   current theory context; the ``\<open>!\<close>'' option indicates extra verbosity.
 
   \<^descr> @{command "print_attributes"} prints all attributes available in the
   current theory context; the ``\<open>!\<close>'' option indicates extra verbosity.
 
   \<^descr> @{command "print_theorems"} prints theorems of the background theory
   resulting from the last command; the ``\<open>!\<close>'' option indicates extra
   verbosity.
 
   \<^descr> @{command "print_facts"} prints all local facts of the current context,
   both named and unnamed ones; the ``\<open>!\<close>'' option indicates extra verbosity.
 
   \<^descr> @{command "print_term_bindings"} prints all term bindings that are present
   in the context.
 
   \<^descr> @{command "find_theorems"}~\<open>criteria\<close> retrieves facts from the theory or
   proof context matching all of given search criteria. The criterion \<open>name: p\<close>
   selects all theorems whose fully qualified name matches pattern \<open>p\<close>, which
   may contain ``\<open>*\<close>'' wildcards. The criteria \<open>intro\<close>, \<open>elim\<close>, and \<open>dest\<close>
   select theorems that match the current goal as introduction, elimination or
   destruction rules, respectively. The criterion \<open>solves\<close> returns all rules
   that would directly solve the current goal. The criterion \<open>simp: t\<close> selects
   all rewrite rules whose left-hand side matches the given term. The criterion
   term \<open>t\<close> selects all theorems that contain the pattern \<open>t\<close> -- as usual,
   patterns may contain occurrences of the dummy ``\<open>_\<close>'', schematic variables,
   and type constraints.
 
   Criteria can be preceded by ``\<open>-\<close>'' to select theorems that do \<^emph>\<open>not\<close> match.
   Note that giving the empty list of criteria yields \<^emph>\<open>all\<close> currently known
   facts. An optional limit for the number of printed facts may be given; the
   default is 40. By default, duplicates are removed from the search result.
   Use \<open>with_dups\<close> to display duplicates.
 
   \<^descr> @{command "find_consts"}~\<open>criteria\<close> prints all constants whose type meets
   all of the given criteria. The criterion \<open>strict: ty\<close> is met by any type
   that matches the type pattern \<open>ty\<close>. Patterns may contain both the dummy type
   ``\<open>_\<close>'' and sort constraints. The criterion \<open>ty\<close> is similar, but it also
   matches against subtypes. The criterion \<open>name: p\<close> and the prefix ``\<open>-\<close>''
   function as described for @{command "find_theorems"}.
 
   \<^descr> @{command "thm_deps"}~\<open>thms\<close> prints immediate theorem dependencies, i.e.\
   the union of all theorems that are used directly to prove the argument
   facts, without going deeper into the dependency graph.
 
   \<^descr> @{command "unused_thms"}~\<open>A\<^sub>1 \<dots> A\<^sub>m - B\<^sub>1 \<dots> B\<^sub>n\<close> displays all theorems
   that are proved in theories \<open>B\<^sub>1 \<dots> B\<^sub>n\<close> or their parents but not in \<open>A\<^sub>1 \<dots>
   A\<^sub>m\<close> or their parents and that are never used. If \<open>n\<close> is \<open>0\<close>, the end of the
   range of theories defaults to the current theory. If no range is specified,
   only the unused theorems in the current theory are displayed.
 \<close>
 
 end
diff --git a/src/Doc/Isar_Ref/Preface.thy b/src/Doc/Isar_Ref/Preface.thy
--- a/src/Doc/Isar_Ref/Preface.thy
+++ b/src/Doc/Isar_Ref/Preface.thy
@@ -1,76 +1,76 @@
 (*:maxLineLen=78:*)
 
 theory Preface
   imports Main Base
 begin
 
 text \<open>
   The \<^emph>\<open>Isabelle\<close> system essentially provides a generic
   infrastructure for building deductive systems (programmed in
   Standard ML), with a special focus on interactive theorem proving in
   higher-order logics.  Many years ago, even end-users would refer to
   certain ML functions (goal commands, tactics, tacticals etc.) to
   pursue their everyday theorem proving tasks.
   
   In contrast \<^emph>\<open>Isar\<close> provides an interpreted language environment
   of its own, which has been specifically tailored for the needs of
   theory and proof development.  Compared to raw ML, the Isabelle/Isar
   top-level provides a more robust and comfortable development
   platform, with proper support for theory development graphs, managed
   transactions with unlimited undo etc.
 
   In its pioneering times, the Isabelle/Isar version of the
-  \<^emph>\<open>Proof~General\<close> user interface @{cite proofgeneral and
-  "Aspinall:TACAS:2000"} has contributed to the
+  \<^emph>\<open>Proof~General\<close> user interface \<^cite>\<open>proofgeneral and
+  "Aspinall:TACAS:2000"\<close> has contributed to the
   success of for interactive theory and proof development in this
   advanced theorem proving environment, even though it was somewhat
   biased towards old-style proof scripts.  The more recent
-  Isabelle/jEdit Prover IDE @{cite "Wenzel:2012"} emphasizes the
+  Isabelle/jEdit Prover IDE \<^cite>\<open>"Wenzel:2012"\<close> emphasizes the
   document-oriented approach of Isabelle/Isar again more explicitly.
 
   \<^medskip>
   Apart from the technical advances over bare-bones ML
   programming, the main purpose of the Isar language is to provide a
   conceptually different view on machine-checked proofs
-  @{cite "Wenzel:1999:TPHOL" and "Wenzel-PhD"}.  \<^emph>\<open>Isar\<close> stands for
+  \<^cite>\<open>"Wenzel:1999:TPHOL" and "Wenzel-PhD"\<close>.  \<^emph>\<open>Isar\<close> stands for
   \<^emph>\<open>Intelligible semi-automated reasoning\<close>.  Drawing from both the
   traditions of informal mathematical proof texts and high-level
   programming languages, Isar offers a versatile environment for
   structured formal proof documents.  Thus properly written Isar
   proofs become accessible to a broader audience than unstructured
   tactic scripts (which typically only provide operational information
   for the machine).  Writing human-readable proof texts certainly
   requires some additional efforts by the writer to achieve a good
   presentation, both of formal and informal parts of the text.  On the
   other hand, human-readable formal texts gain some value in their own
   right, independently of the mechanic proof-checking process.
 
   Despite its grand design of structured proof texts, Isar is able to
   assimilate the old tactical style as an ``improper'' sub-language.
   This provides an easy upgrade path for existing tactic scripts, as
   well as some means for interactive experimentation and debugging of
   structured proofs.  Isabelle/Isar supports a broad range of proof
   styles, both readable and unreadable ones.
 
   \<^medskip>
   The generic Isabelle/Isar framework (see
   \chref{ch:isar-framework}) works reasonably well for any Isabelle
   object-logic that conforms to the natural deduction view of the
   Isabelle/Pure framework.  Specific language elements introduced by
   Isabelle/HOL are described in \partref{part:hol}.  Although the main
   language elements are already provided by the Isabelle/Pure
   framework, examples given in the generic parts will usually refer to
   Isabelle/HOL.
 
   \<^medskip>
   Isar commands may be either \<^emph>\<open>proper\<close> document
   constructors, or \<^emph>\<open>improper commands\<close>.  Some proof methods and
   attributes introduced later are classified as improper as well.
   Improper Isar language elements, which are marked by ``\<open>\<^sup>*\<close>'' in the subsequent chapters; they are often helpful
   when developing proof documents, but their use is discouraged for
   the final human-readable outcome.  Typical examples are diagnostic
   commands that print terms or theorems according to the current
   context; other commands emulate old-style tactical theorem proving.
 \<close>
 
 end
diff --git a/src/Doc/Isar_Ref/Proof.thy b/src/Doc/Isar_Ref/Proof.thy
--- a/src/Doc/Isar_Ref/Proof.thy
+++ b/src/Doc/Isar_Ref/Proof.thy
@@ -1,1421 +1,1421 @@
 (*:maxLineLen=78:*)
 
 theory Proof
   imports Main Base
 begin
 
 chapter \<open>Proofs \label{ch:proofs}\<close>
 
 text \<open>
   Proof commands perform transitions of Isar/VM machine configurations, which
   are block-structured, consisting of a stack of nodes with three main
   components: logical proof context, current facts, and open goals. Isar/VM
   transitions are typed according to the following three different modes of
   operation:
 
     \<^descr> \<open>proof(prove)\<close> means that a new goal has just been stated that is now to
     be \<^emph>\<open>proven\<close>; the next command may refine it by some proof method, and
     enter a sub-proof to establish the actual result.
 
     \<^descr> \<open>proof(state)\<close> is like a nested theory mode: the context may be
     augmented by \<^emph>\<open>stating\<close> additional assumptions, intermediate results etc.
 
     \<^descr> \<open>proof(chain)\<close> is intermediate between \<open>proof(state)\<close> and
     \<open>proof(prove)\<close>: existing facts (i.e.\ the contents of the special
     @{fact_ref this} register) have been just picked up in order to be used
     when refining the goal claimed next.
 
   The proof mode indicator may be understood as an instruction to the writer,
   telling what kind of operation may be performed next. The corresponding
   typings of proof commands restricts the shape of well-formed proof texts to
   particular command sequences. So dynamic arrangements of commands eventually
   turn out as static texts of a certain structure.
 
   \Appref{ap:refcard} gives a simplified grammar of the (extensible) language
   emerging that way from the different types of proof commands. The main ideas
   of the overall Isar framework are explained in \chref{ch:isar-framework}.
 \<close>
 
 
 section \<open>Proof structure\<close>
 
 subsection \<open>Formal notepad\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{command_def "notepad"} & : & \<open>local_theory \<rightarrow> proof(state)\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     @@{command notepad} @'begin'
     ;
     @@{command end}
   \<close>
 
   \<^descr> @{command "notepad"}~@{keyword "begin"} opens a proof state without any
   goal statement. This allows to experiment with Isar, without producing any
   persistent result. The notepad is closed by @{command "end"}.
 \<close>
 
 
 subsection \<open>Blocks\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{command_def "next"} & : & \<open>proof(state) \<rightarrow> proof(state)\<close> \\
     @{command_def "{"} & : & \<open>proof(state) \<rightarrow> proof(state)\<close> \\
     @{command_def "}"} & : & \<open>proof(state) \<rightarrow> proof(state)\<close> \\
   \end{matharray}
 
   While Isar is inherently block-structured, opening and closing blocks is
   mostly handled rather casually, with little explicit user-intervention. Any
   local goal statement automatically opens \<^emph>\<open>two\<close> internal blocks, which are
   closed again when concluding the sub-proof (by @{command "qed"} etc.).
   Sections of different context within a sub-proof may be switched via
   @{command "next"}, which is just a single block-close followed by block-open
   again. The effect of @{command "next"} is to reset the local proof context;
   there is no goal focus involved here!
 
   For slightly more advanced applications, there are explicit block
   parentheses as well. These typically achieve a stronger forward style of
   reasoning.
 
   \<^descr> @{command "next"} switches to a fresh block within a sub-proof, resetting
   the local context to the initial one.
 
   \<^descr> @{command "{"} and @{command "}"} explicitly open and close blocks. Any
   current facts pass through ``@{command "{"}'' unchanged, while ``@{command
   "}"}'' causes any result to be \<^emph>\<open>exported\<close> into the enclosing context. Thus
   fixed variables are generalized, assumptions discharged, and local
   definitions unfolded (cf.\ \secref{sec:proof-context}). There is no
   difference of @{command "assume"} and @{command "presume"} in this mode of
   forward reasoning --- in contrast to plain backward reasoning with the
   result exported at @{command "show"} time.
 \<close>
 
 
 subsection \<open>Omitting proofs\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{command_def "oops"} & : & \<open>proof \<rightarrow> local_theory | theory\<close> \\
   \end{matharray}
 
   The @{command "oops"} command discontinues the current proof attempt, while
   considering the partial proof text as properly processed. This is
   conceptually quite different from ``faking'' actual proofs via @{command_ref
   "sorry"} (see \secref{sec:proof-steps}): @{command "oops"} does not observe
   the proof structure at all, but goes back right to the theory level.
   Furthermore, @{command "oops"} does not produce any result theorem --- there
   is no intended claim to be able to complete the proof in any way.
 
   A typical application of @{command "oops"} is to explain Isar proofs
   \<^emph>\<open>within\<close> the system itself, in conjunction with the document preparation
   tools of Isabelle described in \chref{ch:document-prep}. Thus partial or
   even wrong proof attempts can be discussed in a logically sound manner. Note
   that the Isabelle {\LaTeX} macros can be easily adapted to print something
   like ``\<open>\<dots>\<close>'' instead of the keyword ``@{command "oops"}''.
 \<close>
 
 
 section \<open>Statements\<close>
 
 subsection \<open>Context elements \label{sec:proof-context}\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{command_def "fix"} & : & \<open>proof(state) \<rightarrow> proof(state)\<close> \\
     @{command_def "assume"} & : & \<open>proof(state) \<rightarrow> proof(state)\<close> \\
     @{command_def "presume"} & : & \<open>proof(state) \<rightarrow> proof(state)\<close> \\
     @{command_def "define"} & : & \<open>proof(state) \<rightarrow> proof(state)\<close> \\
   \end{matharray}
 
   The logical proof context consists of fixed variables and assumptions. The
   former closely correspond to Skolem constants, or meta-level universal
   quantification as provided by the Isabelle/Pure logical framework.
   Introducing some \<^emph>\<open>arbitrary, but fixed\<close> variable via ``@{command
   "fix"}~\<open>x\<close>'' results in a local value that may be used in the subsequent
   proof as any other variable or constant. Furthermore, any result \<open>\<turnstile> \<phi>[x]\<close>
   exported from the context will be universally closed wrt.\ \<open>x\<close> at the
   outermost level: \<open>\<turnstile> \<And>x. \<phi>[x]\<close> (this is expressed in normal form using
   Isabelle's meta-variables).
 
   Similarly, introducing some assumption \<open>\<chi>\<close> has two effects. On the one hand,
   a local theorem is created that may be used as a fact in subsequent proof
   steps. On the other hand, any result \<open>\<chi> \<turnstile> \<phi>\<close> exported from the context
   becomes conditional wrt.\ the assumption: \<open>\<turnstile> \<chi> \<Longrightarrow> \<phi>\<close>. Thus, solving an
   enclosing goal using such a result would basically introduce a new subgoal
   stemming from the assumption. How this situation is handled depends on the
   version of assumption command used: while @{command "assume"} insists on
   solving the subgoal by unification with some premise of the goal, @{command
   "presume"} leaves the subgoal unchanged in order to be proved later by the
   user.
 
   Local definitions, introduced by ``\<^theory_text>\<open>define x where x = t\<close>'', are achieved
   by combining ``@{command "fix"}~\<open>x\<close>'' with another version of assumption
   that causes any hypothetical equation \<open>x \<equiv> t\<close> to be eliminated by the
   reflexivity rule. Thus, exporting some result \<open>x \<equiv> t \<turnstile> \<phi>[x]\<close> yields \<open>\<turnstile>
   \<phi>[t]\<close>.
 
   \<^rail>\<open>
     @@{command fix} @{syntax vars}
     ;
     (@@{command assume} | @@{command presume}) concl prems @{syntax for_fixes}
     ;
     concl: (@{syntax props} + @'and')
     ;
     prems: (@'if' (@{syntax props'} + @'and'))?
     ;
     @@{command define} @{syntax vars} @'where'
       (@{syntax props} + @'and') @{syntax for_fixes}
   \<close>
 
   \<^descr> @{command "fix"}~\<open>x\<close> introduces a local variable \<open>x\<close> that is \<^emph>\<open>arbitrary,
   but fixed\<close>.
 
   \<^descr> @{command "assume"}~\<open>a: \<phi>\<close> and @{command "presume"}~\<open>a: \<phi>\<close> introduce a
   local fact \<open>\<phi> \<turnstile> \<phi>\<close> by assumption. Subsequent results applied to an enclosing
   goal (e.g.\ by @{command_ref "show"}) are handled as follows: @{command
   "assume"} expects to be able to unify with existing premises in the goal,
   while @{command "presume"} leaves \<open>\<phi>\<close> as new subgoals.
 
   Several lists of assumptions may be given (separated by @{keyword_ref
   "and"}; the resulting list of current facts consists of all of these
   concatenated.
 
   A structured assumption like \<^theory_text>\<open>assume "B x" if "A x" for x\<close> is equivalent to
   \<^theory_text>\<open>assume "\<And>x. A x \<Longrightarrow> B x"\<close>, but vacuous quantification is avoided: a
   for-context only effects propositions according to actual use of variables.
 
   \<^descr> \<^theory_text>\<open>define x where "x = t"\<close> introduces a local (non-polymorphic) definition.
   In results that are exported from the context, \<open>x\<close> is replaced by \<open>t\<close>.
 
   Internally, equational assumptions are added to the context in Pure form,
   using \<open>x \<equiv> t\<close> instead of \<open>x = t\<close> or \<open>x \<longleftrightarrow> t\<close> from the object-logic. When
   exporting results from the context, \<open>x\<close> is generalized and the assumption
   discharged by reflexivity, causing the replacement by \<open>t\<close>.
 
   The default name for the definitional fact is \<open>x_def\<close>. Several simultaneous
   definitions may be given as well, with a collective default name.
 
   \<^medskip>
   It is also possible to abstract over local parameters as follows: \<^theory_text>\<open>define f
   :: "'a \<Rightarrow> 'b" where "f x = t" for x :: 'a\<close>.
 \<close>
 
 
 subsection \<open>Term abbreviations \label{sec:term-abbrev}\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{command_def "let"} & : & \<open>proof(state) \<rightarrow> proof(state)\<close> \\
     @{keyword_def "is"} & : & syntax \\
   \end{matharray}
 
   Abbreviations may be either bound by explicit @{command "let"}~\<open>p \<equiv> t\<close>
   statements, or by annotating assumptions or goal statements with a list of
   patterns ``\<^theory_text>\<open>(is p\<^sub>1 \<dots> p\<^sub>n)\<close>''. In both cases, higher-order matching is
   invoked to bind extra-logical term variables, which may be either named
   schematic variables of the form \<open>?x\<close>, or nameless dummies ``@{variable _}''
   (underscore). Note that in the @{command "let"} form the patterns occur on
   the left-hand side, while the @{keyword "is"} patterns are in postfix
   position.
 
   Polymorphism of term bindings is handled in Hindley-Milner style, similar to
   ML. Type variables referring to local assumptions or open goal statements
   are \<^emph>\<open>fixed\<close>, while those of finished results or bound by @{command "let"}
   may occur in \<^emph>\<open>arbitrary\<close> instances later. Even though actual polymorphism
   should be rarely used in practice, this mechanism is essential to achieve
   proper incremental type-inference, as the user proceeds to build up the Isar
   proof text from left to right.
 
   \<^medskip>
   Term abbreviations are quite different from local definitions as introduced
   via @{command "define"} (see \secref{sec:proof-context}). The latter are
   visible within the logic as actual equations, while abbreviations disappear
   during the input process just after type checking. Also note that @{command
   "define"} does not support polymorphism.
 
   \<^rail>\<open>
     @@{command let} ((@{syntax term} + @'and') '=' @{syntax term} + @'and')
   \<close>
 
   The syntax of @{keyword "is"} patterns follows @{syntax term_pat} or
   @{syntax prop_pat} (see \secref{sec:term-decls}).
 
     \<^descr> \<^theory_text>\<open>let p\<^sub>1 = t\<^sub>1 and \<dots> p\<^sub>n = t\<^sub>n\<close> binds any text variables in patterns
     \<open>p\<^sub>1, \<dots>, p\<^sub>n\<close> by simultaneous higher-order matching against terms \<open>t\<^sub>1, \<dots>,
     t\<^sub>n\<close>.
 
     \<^descr> \<^theory_text>\<open>(is p\<^sub>1 \<dots> p\<^sub>n)\<close> resembles @{command "let"}, but matches \<open>p\<^sub>1, \<dots>, p\<^sub>n\<close>
     against the preceding statement. Also note that @{keyword "is"} is not a
     separate command, but part of others (such as @{command "assume"},
     @{command "have"} etc.).
 
   Some \<^emph>\<open>implicit\<close> term abbreviations\index{term abbreviations} for goals and
   facts are available as well. For any open goal, @{variable_ref thesis}
   refers to its object-level statement, abstracted over any meta-level
   parameters (if present). Likewise, @{variable_ref this} is bound for fact
   statements resulting from assumptions or finished goals. In case @{variable
   this} refers to an object-logic statement that is an application \<open>f t\<close>, then
   \<open>t\<close> is bound to the special text variable ``@{variable "\<dots>"}'' (three dots).
   The canonical application of this convenience are calculational proofs (see
   \secref{sec:calculation}).
 \<close>
 
 
 subsection \<open>Facts and forward chaining \label{sec:proof-facts}\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{command_def "note"} & : & \<open>proof(state) \<rightarrow> proof(state)\<close> \\
     @{command_def "then"} & : & \<open>proof(state) \<rightarrow> proof(chain)\<close> \\
     @{command_def "from"} & : & \<open>proof(state) \<rightarrow> proof(chain)\<close> \\
     @{command_def "with"} & : & \<open>proof(state) \<rightarrow> proof(chain)\<close> \\
     @{command_def "using"} & : & \<open>proof(prove) \<rightarrow> proof(prove)\<close> \\
     @{command_def "unfolding"} & : & \<open>proof(prove) \<rightarrow> proof(prove)\<close> \\
     @{method_def "use"} & : & \<open>method\<close> \\
     @{fact_def "method_facts"} & : & \<open>fact\<close> \\
   \end{matharray}
 
   New facts are established either by assumption or proof of local statements.
   Any fact will usually be involved in further proofs, either as explicit
   arguments of proof methods, or when forward chaining towards the next goal
   via @{command "then"} (and variants); @{command "from"} and @{command
   "with"} are composite forms involving @{command "note"}. The @{command
   "using"} elements augments the collection of used facts \<^emph>\<open>after\<close> a goal has
   been stated. Note that the special theorem name @{fact_ref this} refers to
   the most recently established facts, but only \<^emph>\<open>before\<close> issuing a follow-up
   claim.
 
   \<^rail>\<open>
     @@{command note} (@{syntax thmdef}? @{syntax thms} + @'and')
     ;
     (@@{command from} | @@{command with} | @@{command using} | @@{command unfolding})
       (@{syntax thms} + @'and')
     ;
     @{method use} @{syntax thms} @'in' @{syntax method}
   \<close>
 
   \<^descr> @{command "note"}~\<open>a = b\<^sub>1 \<dots> b\<^sub>n\<close> recalls existing facts \<open>b\<^sub>1, \<dots>, b\<^sub>n\<close>,
   binding the result as \<open>a\<close>. Note that attributes may be involved as well,
   both on the left and right hand sides.
 
   \<^descr> @{command "then"} indicates forward chaining by the current facts in order
   to establish the goal to be claimed next. The initial proof method invoked
   to refine that will be offered the facts to do ``anything appropriate'' (see
   also \secref{sec:proof-steps}). For example, method @{method (Pure) rule}
   (see \secref{sec:pure-meth-att}) would typically do an elimination rather
   than an introduction. Automatic methods usually insert the facts into the
   goal state before operation. This provides a simple scheme to control
   relevance of facts in automated proof search.
 
   \<^descr> @{command "from"}~\<open>b\<close> abbreviates ``@{command "note"}~\<open>b\<close>~@{command
   "then"}''; thus @{command "then"} is equivalent to ``@{command
   "from"}~\<open>this\<close>''.
 
   \<^descr> @{command "with"}~\<open>b\<^sub>1 \<dots> b\<^sub>n\<close> abbreviates ``@{command "from"}~\<open>b\<^sub>1 \<dots> b\<^sub>n
   \<AND> this\<close>''; thus the forward chaining is from earlier facts together
   with the current ones.
 
   \<^descr> @{command "using"}~\<open>b\<^sub>1 \<dots> b\<^sub>n\<close> augments the facts to be used by a
   subsequent refinement step (such as @{command_ref "apply"} or @{command_ref
   "proof"}).
 
   \<^descr> @{command "unfolding"}~\<open>b\<^sub>1 \<dots> b\<^sub>n\<close> is structurally similar to @{command
   "using"}, but unfolds definitional equations \<open>b\<^sub>1 \<dots> b\<^sub>n\<close> throughout the goal
   state and facts. See also the proof method @{method_ref unfold}.
 
   \<^descr> \<^theory_text>\<open>(use b\<^sub>1 \<dots> b\<^sub>n in method)\<close> uses the facts in the given method
   expression. The facts provided by the proof state (via @{command "using"}
   etc.) are ignored, but it is possible to refer to @{fact method_facts}
   explicitly.
 
   \<^descr> @{fact method_facts} is a dynamic fact that refers to the currently used
   facts of the goal state.
 
 
   Forward chaining with an empty list of theorems is the same as not chaining
   at all. Thus ``@{command "from"}~\<open>nothing\<close>'' has no effect apart from
   entering \<open>prove(chain)\<close> mode, since @{fact_ref nothing} is bound to the
   empty list of theorems.
 
   Basic proof methods (such as @{method_ref (Pure) rule}) expect multiple
   facts to be given in their proper order, corresponding to a prefix of the
   premises of the rule involved. Note that positions may be easily skipped
   using something like @{command "from"}~\<open>_ \<AND> a \<AND> b\<close>, for example.
   This involves the trivial rule \<open>PROP \<psi> \<Longrightarrow> PROP \<psi>\<close>, which is bound in
   Isabelle/Pure as ``@{fact_ref "_"}'' (underscore).
 
   Automated methods (such as @{method simp} or @{method auto}) just insert any
   given facts before their usual operation. Depending on the kind of procedure
   involved, the order of facts is less significant here.
 \<close>
 
 
 subsection \<open>Goals \label{sec:goals}\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{command_def "lemma"} & : & \<open>local_theory \<rightarrow> proof(prove)\<close> \\
     @{command_def "theorem"} & : & \<open>local_theory \<rightarrow> proof(prove)\<close> \\
     @{command_def "corollary"} & : & \<open>local_theory \<rightarrow> proof(prove)\<close> \\
     @{command_def "proposition"} & : & \<open>local_theory \<rightarrow> proof(prove)\<close> \\
     @{command_def "schematic_goal"} & : & \<open>local_theory \<rightarrow> proof(prove)\<close> \\
     @{command_def "have"} & : & \<open>proof(state) | proof(chain) \<rightarrow> proof(prove)\<close> \\
     @{command_def "show"} & : & \<open>proof(state) | proof(chain) \<rightarrow> proof(prove)\<close> \\
     @{command_def "hence"} & : & \<open>proof(state) \<rightarrow> proof(prove)\<close> \\
     @{command_def "thus"} & : & \<open>proof(state) \<rightarrow> proof(prove)\<close> \\
     @{command_def "print_statement"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
   \end{matharray}
 
   From a theory context, proof mode is entered by an initial goal command such
   as @{command "lemma"}. Within a proof context, new claims may be introduced
   locally; there are variants to interact with the overall proof structure
   specifically, such as @{command have} or @{command show}.
 
   Goals may consist of multiple statements, resulting in a list of facts
   eventually. A pending multi-goal is internally represented as a meta-level
   conjunction (\<open>&&&\<close>), which is usually split into the corresponding number of
   sub-goals prior to an initial method application, via @{command_ref "proof"}
   (\secref{sec:proof-steps}) or @{command_ref "apply"}
   (\secref{sec:tactic-commands}). The @{method_ref induct} method covered in
   \secref{sec:cases-induct} acts on multiple claims simultaneously.
 
   Claims at the theory level may be either in short or long form. A short goal
   merely consists of several simultaneous propositions (often just one). A
   long goal includes an explicit context specification for the subsequent
   conclusion, involving local parameters and assumptions. Here the role of
   each part of the statement is explicitly marked by separate keywords (see
   also \secref{sec:locale}); the local assumptions being introduced here are
   available as @{fact_ref assms} in the proof. Moreover, there are two kinds
   of conclusions: @{element_def "shows"} states several simultaneous
   propositions (essentially a big conjunction), while @{element_def "obtains"}
   claims several simultaneous contexts --- essentially a big disjunction of
   eliminated parameters and assumptions (see \secref{sec:obtain}).
 
   \<^rail>\<open>
     (@@{command lemma} | @@{command theorem} | @@{command corollary} |
      @@{command proposition} | @@{command schematic_goal})
       (long_statement | short_statement)
     ;
     (@@{command have} | @@{command show} | @@{command hence} | @@{command thus})
       stmt cond_stmt @{syntax for_fixes}
     ;
     @@{command print_statement} @{syntax modes}? @{syntax thms}
     ;
 
     stmt: (@{syntax props} + @'and')
     ;
     cond_stmt: ((@'if' | @'when') stmt)?
     ;
     short_statement: stmt (@'if' stmt)? @{syntax for_fixes}
     ;
     long_statement: @{syntax thmdecl}? context conclusion
     ;
     context: (@{syntax_ref "includes"}?) (@{syntax context_elem} *)
     ;
     conclusion: @'shows' stmt | @'obtains' @{syntax obtain_clauses}
     ;
     @{syntax_def obtain_clauses}: (@{syntax par_name}? obtain_case + '|')
     ;
     @{syntax_def obtain_case}: @{syntax vars} @'where'
       (@{syntax thmdecl}? (@{syntax prop}+) + @'and')
   \<close>
 
   \<^descr> @{command "lemma"}~\<open>a: \<phi>\<close> enters proof mode with \<open>\<phi>\<close> as main goal,
   eventually resulting in some fact \<open>\<turnstile> \<phi>\<close> to be put back into the target
   context.
 
   A @{syntax long_statement} may build up an initial proof context for the
   subsequent claim, potentially including local definitions and syntax; see
   also @{syntax "includes"} in \secref{sec:bundle} and @{syntax context_elem}
   in \secref{sec:locale}.
 
   A @{syntax short_statement} consists of propositions as conclusion, with an
   option context of premises and parameters, via \<^verbatim>\<open>if\<close>/\<^verbatim>\<open>for\<close> in postfix
   notation, corresponding to \<^verbatim>\<open>assumes\<close>/\<^verbatim>\<open>fixes\<close> in the long prefix notation.
 
   Local premises (if present) are called ``\<open>assms\<close>'' for @{syntax
   long_statement}, and ``\<open>that\<close>'' for @{syntax short_statement}.
 
   \<^descr> @{command "theorem"}, @{command "corollary"}, and @{command "proposition"}
   are the same as @{command "lemma"}. The different command names merely serve
   as a formal comment in the theory source.
 
   \<^descr> @{command "schematic_goal"} is similar to @{command "theorem"}, but allows
   the statement to contain unbound schematic variables.
 
   Under normal circumstances, an Isar proof text needs to specify claims
   explicitly. Schematic goals are more like goals in Prolog, where certain
   results are synthesized in the course of reasoning. With schematic
   statements, the inherent compositionality of Isar proofs is lost, which also
   impacts performance, because proof checking is forced into sequential mode.
 
   \<^descr> @{command "have"}~\<open>a: \<phi>\<close> claims a local goal, eventually resulting in a
   fact within the current logical context. This operation is completely
   independent of any pending sub-goals of an enclosing goal statements, so
   @{command "have"} may be freely used for experimental exploration of
   potential results within a proof body.
 
   \<^descr> @{command "show"}~\<open>a: \<phi>\<close> is like @{command "have"}~\<open>a: \<phi>\<close> plus a second
   stage to refine some pending sub-goal for each one of the finished result,
   after having been exported into the corresponding context (at the head of
   the sub-proof of this @{command "show"} command).
 
   To accommodate interactive debugging, resulting rules are printed before
   being applied internally. Even more, interactive execution of @{command
   "show"} predicts potential failure and displays the resulting error as a
   warning beforehand. Watch out for the following message:
   @{verbatim [display] \<open>Local statement fails to refine any pending goal\<close>}
 
   \<^descr> @{command "hence"} expands to ``@{command "then"}~@{command "have"}'' and
   @{command "thus"} expands to ``@{command "then"}~@{command "show"}''. These
   conflations are left-over from early history of Isar. The expanded syntax is
   more orthogonal and improves readability and maintainability of proofs.
 
   \<^descr> @{command "print_statement"}~\<open>a\<close> prints facts from the current theory or
   proof context in long statement form, according to the syntax for @{command
   "lemma"} given above.
 
 
   Any goal statement causes some term abbreviations (such as @{variable_ref
   "?thesis"}) to be bound automatically, see also \secref{sec:term-abbrev}.
 
   Structured goal statements involving @{keyword_ref "if"} or @{keyword_ref
   "when"} define the special fact @{fact_ref that} to refer to these
   assumptions in the proof body. The user may provide separate names according
   to the syntax of the statement.
 \<close>
 
 
 section \<open>Calculational reasoning \label{sec:calculation}\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{command_def "also"} & : & \<open>proof(state) \<rightarrow> proof(state)\<close> \\
     @{command_def "finally"} & : & \<open>proof(state) \<rightarrow> proof(chain)\<close> \\
     @{command_def "moreover"} & : & \<open>proof(state) \<rightarrow> proof(state)\<close> \\
     @{command_def "ultimately"} & : & \<open>proof(state) \<rightarrow> proof(chain)\<close> \\
     @{command_def "print_trans_rules"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
     @{attribute trans} & : & \<open>attribute\<close> \\
     @{attribute sym} & : & \<open>attribute\<close> \\
     @{attribute symmetric} & : & \<open>attribute\<close> \\
   \end{matharray}
 
   Calculational proof is forward reasoning with implicit application of
   transitivity rules (such those of \<open>=\<close>, \<open>\<le>\<close>, \<open><\<close>). Isabelle/Isar maintains an
   auxiliary fact register @{fact_ref calculation} for accumulating results
   obtained by transitivity composed with the current result. Command @{command
   "also"} updates @{fact calculation} involving @{fact this}, while @{command
   "finally"} exhibits the final @{fact calculation} by forward chaining
   towards the next goal statement. Both commands require valid current facts,
   i.e.\ may occur only after commands that produce theorems such as @{command
   "assume"}, @{command "note"}, or some finished proof of @{command "have"},
   @{command "show"} etc. The @{command "moreover"} and @{command "ultimately"}
   commands are similar to @{command "also"} and @{command "finally"}, but only
   collect further results in @{fact calculation} without applying any rules
   yet.
 
   Also note that the implicit term abbreviation ``\<open>\<dots>\<close>'' has its canonical
   application with calculational proofs. It refers to the argument of the
   preceding statement. (The argument of a curried infix expression happens to
   be its right-hand side.)
 
   Isabelle/Isar calculations are implicitly subject to block structure in the
   sense that new threads of calculational reasoning are commenced for any new
   block (as opened by a local goal, for example). This means that, apart from
   being able to nest calculations, there is no separate \<^emph>\<open>begin-calculation\<close>
   command required.
 
   \<^medskip>
   The Isar calculation proof commands may be defined as follows:\<^footnote>\<open>We suppress
   internal bookkeeping such as proper handling of block-structure.\<close>
 
   \begin{matharray}{rcl}
     @{command "also"}\<open>\<^sub>0\<close> & \equiv & @{command "note"}~\<open>calculation = this\<close> \\
     @{command "also"}\<open>\<^sub>n\<^sub>+\<^sub>1\<close> & \equiv & @{command "note"}~\<open>calculation = trans [OF calculation this]\<close> \\[0.5ex]
     @{command "finally"} & \equiv & @{command "also"}~@{command "from"}~\<open>calculation\<close> \\[0.5ex]
     @{command "moreover"} & \equiv & @{command "note"}~\<open>calculation = calculation this\<close> \\
     @{command "ultimately"} & \equiv & @{command "moreover"}~@{command "from"}~\<open>calculation\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     (@@{command also} | @@{command finally}) ('(' @{syntax thms} ')')?
     ;
     @@{attribute trans} (() | 'add' | 'del')
   \<close>
 
   \<^descr> @{command "also"}~\<open>(a\<^sub>1 \<dots> a\<^sub>n)\<close> maintains the auxiliary @{fact
   calculation} register as follows. The first occurrence of @{command "also"}
   in some calculational thread initializes @{fact calculation} by @{fact
   this}. Any subsequent @{command "also"} on the same level of block-structure
   updates @{fact calculation} by some transitivity rule applied to @{fact
   calculation} and @{fact this} (in that order). Transitivity rules are picked
   from the current context, unless alternative rules are given as explicit
   arguments.
 
   \<^descr> @{command "finally"}~\<open>(a\<^sub>1 \<dots> a\<^sub>n)\<close> maintains @{fact calculation} in the
   same way as @{command "also"} and then concludes the current calculational
   thread. The final result is exhibited as fact for forward chaining towards
   the next goal. Basically, @{command "finally"} abbreviates @{command
   "also"}~@{command "from"}~@{fact calculation}. Typical idioms for concluding
   calculational proofs are ``@{command "finally"}~@{command
   "show"}~\<open>?thesis\<close>~@{command "."}'' and ``@{command "finally"}~@{command
   "have"}~\<open>\<phi>\<close>~@{command "."}''.
 
   \<^descr> @{command "moreover"} and @{command "ultimately"} are analogous to
   @{command "also"} and @{command "finally"}, but collect results only,
   without applying rules.
 
   \<^descr> @{command "print_trans_rules"} prints the list of transitivity rules (for
   calculational commands @{command "also"} and @{command "finally"}) and
   symmetry rules (for the @{attribute symmetric} operation and single step
   elimination patters) of the current context.
 
   \<^descr> @{attribute trans} declares theorems as transitivity rules.
 
   \<^descr> @{attribute sym} declares symmetry rules, as well as @{attribute
   "Pure.elim"}\<open>?\<close> rules.
 
   \<^descr> @{attribute symmetric} resolves a theorem with some rule declared as
   @{attribute sym} in the current context. For example, ``@{command
   "assume"}~\<open>[symmetric]: x = y\<close>'' produces a swapped fact derived from that
   assumption.
 
   In structured proof texts it is often more appropriate to use an explicit
   single-step elimination proof, such as ``@{command "assume"}~\<open>x =
   y\<close>~@{command "then"}~@{command "have"}~\<open>y = x\<close>~@{command ".."}''.
 \<close>
 
 
 section \<open>Refinement steps\<close>
 
 subsection \<open>Proof method expressions \label{sec:proof-meth}\<close>
 
 text \<open>
   Proof methods are either basic ones, or expressions composed of methods via
   ``\<^verbatim>\<open>,\<close>'' (sequential composition), ``\<^verbatim>\<open>;\<close>'' (structural composition),
   ``\<^verbatim>\<open>|\<close>'' (alternative choices), ``\<^verbatim>\<open>?\<close>'' (try), ``\<^verbatim>\<open>+\<close>'' (repeat at least
   once), ``\<^verbatim>\<open>[\<close>\<open>n\<close>\<^verbatim>\<open>]\<close>'' (restriction to first \<open>n\<close> subgoals). In practice,
   proof methods are usually just a comma separated list of @{syntax
   name}~@{syntax args} specifications. Note that parentheses may be dropped
   for single method specifications (with no arguments). The syntactic
   precedence of method combinators is \<^verbatim>\<open>|\<close> \<^verbatim>\<open>;\<close> \<^verbatim>\<open>,\<close> \<^verbatim>\<open>[]\<close> \<^verbatim>\<open>+\<close> \<^verbatim>\<open>?\<close> (from low
   to high).
 
   \<^rail>\<open>
     @{syntax_def method}:
       (@{syntax name} | '(' methods ')') (() | '?' | '+' | '[' @{syntax nat}? ']')
     ;
     methods: (@{syntax name} @{syntax args} | @{syntax method}) + (',' | ';' | '|')
   \<close>
 
   Regular Isar proof methods do \<^emph>\<open>not\<close> admit direct goal addressing, but refer
   to the first subgoal or to all subgoals uniformly. Nonetheless, the
   subsequent mechanisms allow to imitate the effect of subgoal addressing that
   is known from ML tactics.
 
   \<^medskip>
   Goal \<^emph>\<open>restriction\<close> means the proof state is wrapped-up in a way that
   certain subgoals are exposed, and other subgoals are ``parked'' elsewhere.
   Thus a proof method has no other chance than to operate on the subgoals that
   are presently exposed.
 
   Structural composition ``\<open>m\<^sub>1\<close>\<^verbatim>\<open>;\<close>~\<open>m\<^sub>2\<close>'' means that method \<open>m\<^sub>1\<close> is
   applied with restriction to the first subgoal, then \<open>m\<^sub>2\<close> is applied
   consecutively with restriction to each subgoal that has newly emerged due to
   \<open>m\<^sub>1\<close>. This is analogous to the tactic combinator \<^ML_infix>\<open>THEN_ALL_NEW\<close> in
-  Isabelle/ML, see also @{cite "isabelle-implementation"}. For example, \<open>(rule
+  Isabelle/ML, see also \<^cite>\<open>"isabelle-implementation"\<close>. For example, \<open>(rule
   r; blast)\<close> applies rule \<open>r\<close> and then solves all new subgoals by \<open>blast\<close>.
 
   Moreover, the explicit goal restriction operator ``\<open>[n]\<close>'' exposes only the
   first \<open>n\<close> subgoals (which need to exist), with default \<open>n = 1\<close>. For example,
   the method expression ``\<open>simp_all[3]\<close>'' simplifies the first three subgoals,
   while ``\<open>(rule r, simp_all)[]\<close>'' simplifies all new goals that emerge from
   applying rule \<open>r\<close> to the originally first one.
 
   \<^medskip>
   Improper methods, notably tactic emulations, offer low-level goal addressing
   as explicit argument to the individual tactic being involved. Here ``\<open>[!]\<close>''
   refers to all goals, and ``\<open>[n-]\<close>'' to all goals starting from \<open>n\<close>.
 
   \<^rail>\<open>
     @{syntax_def goal_spec}:
       '[' (@{syntax nat} '-' @{syntax nat} | @{syntax nat} '-' | @{syntax nat} | '!' ) ']'
   \<close>
 \<close>
 
 
 subsection \<open>Initial and terminal proof steps \label{sec:proof-steps}\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{command_def "proof"} & : & \<open>proof(prove) \<rightarrow> proof(state)\<close> \\
     @{command_def "qed"} & : & \<open>proof(state) \<rightarrow> proof(state) | local_theory | theory\<close> \\
     @{command_def "by"} & : & \<open>proof(prove) \<rightarrow> proof(state) | local_theory | theory\<close> \\
     @{command_def ".."} & : & \<open>proof(prove) \<rightarrow> proof(state) | local_theory | theory\<close> \\
     @{command_def "."} & : & \<open>proof(prove) \<rightarrow> proof(state) | local_theory | theory\<close> \\
     @{command_def "sorry"} & : & \<open>proof(prove) \<rightarrow> proof(state) | local_theory | theory\<close> \\
     @{method_def standard} & : & \<open>method\<close> \\
   \end{matharray}
 
   Arbitrary goal refinement via tactics is considered harmful. Structured
   proof composition in Isar admits proof methods to be invoked in two places
   only.
 
     \<^enum> An \<^emph>\<open>initial\<close> refinement step @{command_ref "proof"}~\<open>m\<^sub>1\<close> reduces a
     newly stated goal to a number of sub-goals that are to be solved later.
     Facts are passed to \<open>m\<^sub>1\<close> for forward chaining, if so indicated by
     \<open>proof(chain)\<close> mode.
 
     \<^enum> A \<^emph>\<open>terminal\<close> conclusion step @{command_ref "qed"}~\<open>m\<^sub>2\<close> is intended to
     solve remaining goals. No facts are passed to \<open>m\<^sub>2\<close>.
 
   The only other (proper) way to affect pending goals in a proof body is by
   @{command_ref "show"}, which involves an explicit statement of what is to be
   solved eventually. Thus we avoid the fundamental problem of unstructured
   tactic scripts that consist of numerous consecutive goal transformations,
   with invisible effects.
 
   \<^medskip>
   As a general rule of thumb for good proof style, initial proof methods
   should either solve the goal completely, or constitute some well-understood
   reduction to new sub-goals. Arbitrary automatic proof tools that are prone
   leave a large number of badly structured sub-goals are no help in continuing
   the proof document in an intelligible manner.
 
   Unless given explicitly by the user, the default initial method is @{method
   standard}, which subsumes at least @{method_ref (Pure) rule} or its
   classical variant @{method_ref (HOL) rule}. These methods apply a single
   standard elimination or introduction rule according to the topmost logical
   connective involved. There is no separate default terminal method. Any
   remaining goals are always solved by assumption in the very last step.
 
   \<^rail>\<open>
     @@{command proof} method?
     ;
     @@{command qed} method?
     ;
     @@{command "by"} method method?
     ;
     (@@{command "."} | @@{command ".."} | @@{command sorry})
   \<close>
 
   \<^descr> @{command "proof"}~\<open>m\<^sub>1\<close> refines the goal by proof method \<open>m\<^sub>1\<close>; facts for
   forward chaining are passed if so indicated by \<open>proof(chain)\<close> mode.
 
   \<^descr> @{command "qed"}~\<open>m\<^sub>2\<close> refines any remaining goals by proof method \<open>m\<^sub>2\<close>
   and concludes the sub-proof by assumption. If the goal had been \<open>show\<close>, some
   pending sub-goal is solved as well by the rule resulting from the result
   \<^emph>\<open>exported\<close> into the enclosing goal context. Thus \<open>qed\<close> may fail for two
   reasons: either \<open>m\<^sub>2\<close> fails, or the resulting rule does not fit to any
   pending goal\<^footnote>\<open>This includes any additional ``strong'' assumptions as
   introduced by @{command "assume"}.\<close> of the enclosing context. Debugging such
   a situation might involve temporarily changing @{command "show"} into
   @{command "have"}, or weakening the local context by replacing occurrences
   of @{command "assume"} by @{command "presume"}.
 
   \<^descr> @{command "by"}~\<open>m\<^sub>1 m\<^sub>2\<close> is a \<^emph>\<open>terminal proof\<close>\index{proof!terminal}; it
   abbreviates @{command "proof"}~\<open>m\<^sub>1\<close>~@{command "qed"}~\<open>m\<^sub>2\<close>, but with
   backtracking across both methods. Debugging an unsuccessful @{command
   "by"}~\<open>m\<^sub>1 m\<^sub>2\<close> command can be done by expanding its definition; in many
   cases @{command "proof"}~\<open>m\<^sub>1\<close> (or even \<open>apply\<close>~\<open>m\<^sub>1\<close>) is already sufficient
   to see the problem.
 
   \<^descr> ``@{command ".."}'' is a \<^emph>\<open>standard proof\<close>\index{proof!standard}; it
   abbreviates @{command "by"}~\<open>standard\<close>.
 
   \<^descr> ``@{command "."}'' is a \<^emph>\<open>trivial proof\<close>\index{proof!trivial}; it
   abbreviates @{command "by"}~\<open>this\<close>.
 
   \<^descr> @{command "sorry"} is a \<^emph>\<open>fake proof\<close>\index{proof!fake} pretending to
   solve the pending claim without further ado. This only works in interactive
   development, or if the @{attribute quick_and_dirty} is enabled. Facts
   emerging from fake proofs are not the real thing. Internally, the derivation
   object is tainted by an oracle invocation, which may be inspected via the
   command @{command "thm_oracles"} (\secref{sec:oracles}).
 
   The most important application of @{command "sorry"} is to support
   experimentation and top-down proof development.
 
   \<^descr> @{method standard} refers to the default refinement step of some Isar
   language elements (notably @{command proof} and ``@{command ".."}''). It is
   \<^emph>\<open>dynamically scoped\<close>, so the behaviour depends on the application
   environment.
 
   In Isabelle/Pure, @{method standard} performs elementary introduction~/
   elimination steps (@{method_ref (Pure) rule}), introduction of type classes
   (@{method_ref intro_classes}) and locales (@{method_ref intro_locales}).
 
   In Isabelle/HOL, @{method standard} also takes classical rules into account
   (cf.\ \secref{sec:classical}).
 \<close>
 
 
 subsection \<open>Fundamental methods and attributes \label{sec:pure-meth-att}\<close>
 
 text \<open>
   The following proof methods and attributes refer to basic logical operations
   of Isar. Further methods and attributes are provided by several generic and
   object-logic specific tools and packages (see \chref{ch:gen-tools} and
   \partref{part:hol}).
 
   \begin{matharray}{rcl}
     @{command_def "print_rules"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\[0.5ex]
     @{method_def "-"} & : & \<open>method\<close> \\
     @{method_def "goal_cases"} & : & \<open>method\<close> \\
     @{method_def "subproofs"} & : & \<open>method\<close> \\
     @{method_def "fact"} & : & \<open>method\<close> \\
     @{method_def "assumption"} & : & \<open>method\<close> \\
     @{method_def "this"} & : & \<open>method\<close> \\
     @{method_def (Pure) "rule"} & : & \<open>method\<close> \\
     @{attribute_def (Pure) "intro"} & : & \<open>attribute\<close> \\
     @{attribute_def (Pure) "elim"} & : & \<open>attribute\<close> \\
     @{attribute_def (Pure) "dest"} & : & \<open>attribute\<close> \\
     @{attribute_def (Pure) "rule"} & : & \<open>attribute\<close> \\[0.5ex]
     @{attribute_def "OF"} & : & \<open>attribute\<close> \\
     @{attribute_def "of"} & : & \<open>attribute\<close> \\
     @{attribute_def "where"} & : & \<open>attribute\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     @@{method goal_cases} (@{syntax name}*)
     ;
     @@{method subproofs} @{syntax method}
     ;
     @@{method fact} @{syntax thms}?
     ;
     @@{method (Pure) rule} @{syntax thms}?
     ;
     rulemod: ('intro' | 'elim' | 'dest')
       ((('!' | () | '?') @{syntax nat}?) | 'del') ':' @{syntax thms}
     ;
     (@@{attribute intro} | @@{attribute elim} | @@{attribute dest})
       ('!' | () | '?') @{syntax nat}?
     ;
     @@{attribute (Pure) rule} 'del'
     ;
     @@{attribute OF} @{syntax thms}
     ;
     @@{attribute of} @{syntax insts} ('concl' ':' @{syntax insts})? @{syntax for_fixes}
     ;
     @@{attribute "where"} @{syntax named_insts} @{syntax for_fixes}
   \<close>
 
   \<^descr> @{command "print_rules"} prints rules declared via attributes @{attribute
   (Pure) intro}, @{attribute (Pure) elim}, @{attribute (Pure) dest} of
   Isabelle/Pure.
 
   See also the analogous @{command "print_claset"} command for similar rule
   declarations of the classical reasoner (\secref{sec:classical}).
 
   \<^descr> ``@{method "-"}'' (minus) inserts the forward chaining facts as premises
   into the goal, and nothing else.
 
   Note that command @{command_ref "proof"} without any method actually
   performs a single reduction step using the @{method_ref (Pure) rule} method;
   thus a plain \<^emph>\<open>do-nothing\<close> proof step would be ``@{command "proof"}~\<open>-\<close>''
   rather than @{command "proof"} alone.
 
   \<^descr> @{method "goal_cases"}~\<open>a\<^sub>1 \<dots> a\<^sub>n\<close> turns the current subgoals into cases
   within the context (see also \secref{sec:cases-induct}). The specified case
   names are used if present; otherwise cases are numbered starting from 1.
 
   Invoking cases in the subsequent proof body via the @{command_ref case}
   command will @{command fix} goal parameters, @{command assume} goal
   premises, and @{command let} variable @{variable_ref ?case} refer to the
   conclusion.
 
   \<^descr> @{method "subproofs"}~\<open>m\<close> applies the method expression \<open>m\<close> consecutively
   to each subgoal, constructing individual subproofs internally (analogous to
   ``\<^theory_text>\<open>show goal by m\<close>'' for each subgoal of the proof state). Search
   alternatives of \<open>m\<close> are truncated: the method is forced to be deterministic.
   This method combinator impacts the internal construction of proof terms: it
   makes a cascade of let-expressions within the derivation tree and may thus
   improve scalability.
 
   \<^descr> @{method "fact"}~\<open>a\<^sub>1 \<dots> a\<^sub>n\<close> composes some fact from \<open>a\<^sub>1, \<dots>, a\<^sub>n\<close> (or
   implicitly from the current proof context) modulo unification of schematic
   type and term variables. The rule structure is not taken into account, i.e.\
   meta-level implication is considered atomic. This is the same principle
   underlying literal facts (cf.\ \secref{sec:syn-att}): ``@{command
   "have"}~\<open>\<phi>\<close>~@{command "by"}~\<open>fact\<close>'' is equivalent to ``@{command
   "note"}~\<^verbatim>\<open>`\<close>\<open>\<phi>\<close>\<^verbatim>\<open>`\<close>'' provided that \<open>\<turnstile> \<phi>\<close> is an instance of some known \<open>\<turnstile> \<phi>\<close>
   in the proof context.
 
   \<^descr> @{method assumption} solves some goal by a single assumption step. All
   given facts are guaranteed to participate in the refinement; this means
   there may be only 0 or 1 in the first place. Recall that @{command "qed"}
   (\secref{sec:proof-steps}) already concludes any remaining sub-goals by
   assumption, so structured proofs usually need not quote the @{method
   assumption} method at all.
 
   \<^descr> @{method this} applies all of the current facts directly as rules. Recall
   that ``@{command "."}'' (dot) abbreviates ``@{command "by"}~\<open>this\<close>''.
 
   \<^descr> @{method (Pure) rule}~\<open>a\<^sub>1 \<dots> a\<^sub>n\<close> applies some rule given as argument in
   backward manner; facts are used to reduce the rule before applying it to the
   goal. Thus @{method (Pure) rule} without facts is plain introduction, while
   with facts it becomes elimination.
 
   When no arguments are given, the @{method (Pure) rule} method tries to pick
   appropriate rules automatically, as declared in the current context using
   the @{attribute (Pure) intro}, @{attribute (Pure) elim}, @{attribute (Pure)
   dest} attributes (see below). This is included in the standard behaviour of
   @{command "proof"} and ``@{command ".."}'' (double-dot) steps (see
   \secref{sec:proof-steps}).
 
   \<^descr> @{attribute (Pure) intro}, @{attribute (Pure) elim}, and @{attribute
   (Pure) dest} declare introduction, elimination, and destruct rules, to be
   used with method @{method (Pure) rule}, and similar tools. Note that the
   latter will ignore rules declared with ``\<open>?\<close>'', while ``\<open>!\<close>'' are used most
   aggressively.
 
   The classical reasoner (see \secref{sec:classical}) introduces its own
   variants of these attributes; use qualified names to access the present
   versions of Isabelle/Pure, i.e.\ @{attribute (Pure) "Pure.intro"}.
 
   \<^descr> @{attribute (Pure) rule}~\<open>del\<close> undeclares introduction, elimination, or
   destruct rules.
 
   \<^descr> @{attribute OF}~\<open>a\<^sub>1 \<dots> a\<^sub>n\<close> applies some theorem to all of the given rules
   \<open>a\<^sub>1, \<dots>, a\<^sub>n\<close> in canonical right-to-left order, which means that premises
   stemming from the \<open>a\<^sub>i\<close> emerge in parallel in the result, without
   interfering with each other. In many practical situations, the \<open>a\<^sub>i\<close> do not
   have premises themselves, so \<open>rule [OF a\<^sub>1 \<dots> a\<^sub>n]\<close> can be actually read as
   functional application (modulo unification).
 
   Argument positions may be effectively skipped by using ``\<open>_\<close>'' (underscore),
   which refers to the propositional identity rule in the Pure theory.
 
   \<^descr> @{attribute of}~\<open>t\<^sub>1 \<dots> t\<^sub>n\<close> performs positional instantiation of term
   variables. The terms \<open>t\<^sub>1, \<dots>, t\<^sub>n\<close> are substituted for any schematic
   variables occurring in a theorem from left to right; ``\<open>_\<close>'' (underscore)
   indicates to skip a position. Arguments following a ``\<open>concl:\<close>''
   specification refer to positions of the conclusion of a rule.
 
   An optional context of local variables \<open>\<FOR> x\<^sub>1 \<dots> x\<^sub>m\<close> may be specified:
   the instantiated theorem is exported, and these variables become schematic
   (usually with some shifting of indices).
 
   \<^descr> @{attribute "where"}~\<open>x\<^sub>1 = t\<^sub>1 \<AND> \<dots> x\<^sub>n = t\<^sub>n\<close> performs named
   instantiation of schematic type and term variables occurring in a theorem.
   Schematic variables have to be specified on the left-hand side (e.g.\
   \<open>?x1.3\<close>). The question mark may be omitted if the variable name is a plain
   identifier without index. As type instantiations are inferred from term
   instantiations, explicit type instantiations are seldom necessary.
 
   An optional context of local variables \<open>\<FOR> x\<^sub>1 \<dots> x\<^sub>m\<close> may be specified
   as for @{attribute "of"} above.
 \<close>
 
 
 subsection \<open>Defining proof methods\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{command_def "method_setup"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     @@{command method_setup} @{syntax name} '=' @{syntax text} @{syntax text}?
   \<close>
 
   \<^descr> @{command "method_setup"}~\<open>name = text description\<close> defines a proof method
   in the current context. The given \<open>text\<close> has to be an ML expression of type
   \<^ML_type>\<open>(Proof.context -> Proof.method) context_parser\<close>, cf.\ basic
   parsers defined in structure \<^ML_structure>\<open>Args\<close> and \<^ML_structure>\<open>Attrib\<close>. There are also combinators like \<^ML>\<open>METHOD\<close> and \<^ML>\<open>SIMPLE_METHOD\<close> to turn certain tactic forms into official proof methods; the
   primed versions refer to tactics with explicit goal addressing.
 
   Here are some example method definitions:
 \<close>
 
 (*<*)experiment begin(*>*)
   method_setup my_method1 =
     \<open>Scan.succeed (K (SIMPLE_METHOD' (fn i: int => no_tac)))\<close>
     "my first method (without any arguments)"
 
   method_setup my_method2 =
     \<open>Scan.succeed (fn ctxt: Proof.context =>
       SIMPLE_METHOD' (fn i: int => no_tac))\<close>
     "my second method (with context)"
 
   method_setup my_method3 =
     \<open>Attrib.thms >> (fn thms: thm list => fn ctxt: Proof.context =>
       SIMPLE_METHOD' (fn i: int => no_tac))\<close>
     "my third method (with theorem arguments and context)"
 (*<*)end(*>*)
 
 
 section \<open>Proof by cases and induction \label{sec:cases-induct}\<close>
 
 subsection \<open>Rule contexts\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{command_def "case"} & : & \<open>proof(state) \<rightarrow> proof(state)\<close> \\
     @{command_def "print_cases"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
     @{attribute_def case_names} & : & \<open>attribute\<close> \\
     @{attribute_def case_conclusion} & : & \<open>attribute\<close> \\
     @{attribute_def params} & : & \<open>attribute\<close> \\
     @{attribute_def consumes} & : & \<open>attribute\<close> \\
   \end{matharray}
 
   The puristic way to build up Isar proof contexts is by explicit language
   elements like @{command "fix"}, @{command "assume"}, @{command "let"} (see
   \secref{sec:proof-context}). This is adequate for plain natural deduction,
   but easily becomes unwieldy in concrete verification tasks, which typically
   involve big induction rules with several cases.
 
   The @{command "case"} command provides a shorthand to refer to a local
   context symbolically: certain proof methods provide an environment of named
   ``cases'' of the form \<open>c: x\<^sub>1, \<dots>, x\<^sub>m, \<phi>\<^sub>1, \<dots>, \<phi>\<^sub>n\<close>; the effect of
   ``@{command "case"}~\<open>c\<close>'' is then equivalent to ``@{command "fix"}~\<open>x\<^sub>1 \<dots>
   x\<^sub>m\<close>~@{command "assume"}~\<open>c: \<phi>\<^sub>1 \<dots> \<phi>\<^sub>n\<close>''. Term bindings may be covered as
   well, notably @{variable ?case} for the main conclusion.
 
   By default, the ``terminology'' \<open>x\<^sub>1, \<dots>, x\<^sub>m\<close> of a case value is marked as
   hidden, i.e.\ there is no way to refer to such parameters in the subsequent
   proof text. After all, original rule parameters stem from somewhere outside
   of the current proof text. By using the explicit form ``@{command
   "case"}~\<open>(c y\<^sub>1 \<dots> y\<^sub>m)\<close>'' instead, the proof author is able to chose local
   names that fit nicely into the current context.
 
   \<^medskip>
   It is important to note that proper use of @{command "case"} does not
   provide means to peek at the current goal state, which is not directly
   observable in Isar! Nonetheless, goal refinement commands do provide named
   cases \<open>goal\<^sub>i\<close> for each subgoal \<open>i = 1, \<dots>, n\<close> of the resulting goal state.
   Using this extra feature requires great care, because some bits of the
   internal tactical machinery intrude the proof text. In particular, parameter
   names stemming from the left-over of automated reasoning tools are usually
   quite unpredictable.
 
   Under normal circumstances, the text of cases emerge from standard
   elimination or induction rules, which in turn are derived from previous
   theory specifications in a canonical way (say from @{command "inductive"}
   definitions).
 
   \<^medskip>
   Proper cases are only available if both the proof method and the rules
   involved support this. By using appropriate attributes, case names,
   conclusions, and parameters may be also declared by hand. Thus variant
   versions of rules that have been derived manually become ready to use in
   advanced case analysis later.
 
   \<^rail>\<open>
     @@{command case} @{syntax thmdecl}? (name | '(' name (('_' | @{syntax name}) *) ')')
     ;
     @@{attribute case_names} ((@{syntax name} ( '[' (('_' | @{syntax name}) *) ']' ) ? ) +)
     ;
     @@{attribute case_conclusion} @{syntax name} (@{syntax name} * )
     ;
     @@{attribute params} ((@{syntax name} * ) + @'and')
     ;
     @@{attribute consumes} @{syntax int}?
   \<close>
 
   \<^descr> @{command "case"}~\<open>a: (c x\<^sub>1 \<dots> x\<^sub>m)\<close> invokes a named local context \<open>c:
   x\<^sub>1, \<dots>, x\<^sub>m, \<phi>\<^sub>1, \<dots>, \<phi>\<^sub>m\<close>, as provided by an appropriate proof method (such
   as @{method_ref cases} and @{method_ref induct}). The command ``@{command
   "case"}~\<open>a: (c x\<^sub>1 \<dots> x\<^sub>m)\<close>'' abbreviates ``@{command "fix"}~\<open>x\<^sub>1 \<dots>
   x\<^sub>m\<close>~@{command "assume"}~\<open>a.c: \<phi>\<^sub>1 \<dots> \<phi>\<^sub>n\<close>''. Each local fact is qualified by
   the prefix \<open>a\<close>, and all such facts are collectively bound to the name \<open>a\<close>.
 
   The fact name is specification \<open>a\<close> is optional, the default is to re-use
   \<open>c\<close>. So @{command "case"}~\<open>(c x\<^sub>1 \<dots> x\<^sub>m)\<close> is the same as @{command
   "case"}~\<open>c: (c x\<^sub>1 \<dots> x\<^sub>m)\<close>.
 
   \<^descr> @{command "print_cases"} prints all local contexts of the current state,
   using Isar proof language notation.
 
   \<^descr> @{attribute case_names}~\<open>c\<^sub>1 \<dots> c\<^sub>k\<close> declares names for the local contexts
   of premises of a theorem; \<open>c\<^sub>1, \<dots>, c\<^sub>k\<close> refers to the \<^emph>\<open>prefix\<close> of the list
   of premises. Each of the cases \<open>c\<^sub>i\<close> can be of the form \<open>c[h\<^sub>1 \<dots> h\<^sub>n]\<close> where
   the \<open>h\<^sub>1 \<dots> h\<^sub>n\<close> are the names of the hypotheses in case \<open>c\<^sub>i\<close> from left to
   right.
 
   \<^descr> @{attribute case_conclusion}~\<open>c d\<^sub>1 \<dots> d\<^sub>k\<close> declares names for the
   conclusions of a named premise \<open>c\<close>; here \<open>d\<^sub>1, \<dots>, d\<^sub>k\<close> refers to the prefix
   of arguments of a logical formula built by nesting a binary connective
   (e.g.\ \<open>\<or>\<close>).
 
   Note that proof methods such as @{method induct} and @{method coinduct}
   already provide a default name for the conclusion as a whole. The need to
   name subformulas only arises with cases that split into several sub-cases,
   as in common co-induction rules.
 
   \<^descr> @{attribute params}~\<open>p\<^sub>1 \<dots> p\<^sub>m \<AND> \<dots> q\<^sub>1 \<dots> q\<^sub>n\<close> renames the innermost
   parameters of premises \<open>1, \<dots>, n\<close> of some theorem. An empty list of names may
   be given to skip positions, leaving the present parameters unchanged.
 
   Note that the default usage of case rules does \<^emph>\<open>not\<close> directly expose
   parameters to the proof context.
 
   \<^descr> @{attribute consumes}~\<open>n\<close> declares the number of ``major premises'' of a
   rule, i.e.\ the number of facts to be consumed when it is applied by an
   appropriate proof method. The default value of @{attribute consumes} is \<open>n =
   1\<close>, which is appropriate for the usual kind of cases and induction rules for
   inductive sets (cf.\ \secref{sec:hol-inductive}). Rules without any
   @{attribute consumes} declaration given are treated as if @{attribute
   consumes}~\<open>0\<close> had been specified.
 
   A negative \<open>n\<close> is interpreted relatively to the total number of premises of
   the rule in the target context. Thus its absolute value specifies the
   remaining number of premises, after subtracting the prefix of major premises
   as indicated above. This form of declaration has the technical advantage of
   being stable under more morphisms, notably those that export the result from
   a nested @{command_ref context} with additional assumptions.
 
   Note that explicit @{attribute consumes} declarations are only rarely
   needed; this is already taken care of automatically by the higher-level
   @{attribute cases}, @{attribute induct}, and @{attribute coinduct}
   declarations.
 \<close>
 
 
 subsection \<open>Proof methods\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{method_def cases} & : & \<open>method\<close> \\
     @{method_def induct} & : & \<open>method\<close> \\
     @{method_def induction} & : & \<open>method\<close> \\
     @{method_def coinduct} & : & \<open>method\<close> \\
   \end{matharray}
 
   The @{method cases}, @{method induct}, @{method induction}, and @{method
   coinduct} methods provide a uniform interface to common proof techniques
   over datatypes, inductive predicates (or sets), recursive functions etc. The
   corresponding rules may be specified and instantiated in a casual manner.
   Furthermore, these methods provide named local contexts that may be invoked
   via the @{command "case"} proof command within the subsequent proof text.
   This accommodates compact proof texts even when reasoning about large
   specifications.
 
   The @{method induct} method also provides some infrastructure to work with
   structured statements (either using explicit meta-level connectives, or
   including facts and parameters separately). This avoids cumbersome encoding
   of ``strengthened'' inductive statements within the object-logic.
 
   Method @{method induction} differs from @{method induct} only in the names
   of the facts in the local context invoked by the @{command "case"} command.
 
   \<^rail>\<open>
     @@{method cases} ('(' 'no_simp' ')')? \<newline>
       (@{syntax insts} * @'and') rule?
     ;
     (@@{method induct} | @@{method induction})
       ('(' 'no_simp' ')')? (definsts * @'and') \<newline> arbitrary? taking? rule?
     ;
     @@{method coinduct} @{syntax insts} taking rule?
     ;
 
     rule: ('type' | 'pred' | 'set') ':' (@{syntax name} +) | 'rule' ':' (@{syntax thm} +)
     ;
     definst: @{syntax name} ('==' | '\<equiv>') @{syntax term} | '(' @{syntax term} ')' | @{syntax inst}
     ;
     definsts: ( definst * )
     ;
     arbitrary: 'arbitrary' ':' ((@{syntax term} * ) @'and' +)
     ;
     taking: 'taking' ':' @{syntax insts}
   \<close>
 
   \<^descr> @{method cases}~\<open>insts R\<close> applies method @{method rule} with an
   appropriate case distinction theorem, instantiated to the subjects \<open>insts\<close>.
   Symbolic case names are bound according to the rule's local contexts.
 
   The rule is determined as follows, according to the facts and arguments
   passed to the @{method cases} method:
 
   \<^medskip>
   \begin{tabular}{llll}
     facts           &                 & arguments   & rule \\\hline
     \<open>\<turnstile> R\<close>   & @{method cases} &             & implicit rule \<open>R\<close> \\
                     & @{method cases} &             & classical case split \\
                     & @{method cases} & \<open>t\<close>   & datatype exhaustion (type of \<open>t\<close>) \\
     \<open>\<turnstile> A t\<close> & @{method cases} & \<open>\<dots>\<close> & inductive predicate/set elimination (of \<open>A\<close>) \\
     \<open>\<dots>\<close>     & @{method cases} & \<open>\<dots> rule: R\<close> & explicit rule \<open>R\<close> \\
   \end{tabular}
   \<^medskip>
 
   Several instantiations may be given, referring to the \<^emph>\<open>suffix\<close> of premises
   of the case rule; within each premise, the \<^emph>\<open>prefix\<close> of variables is
   instantiated. In most situations, only a single term needs to be specified;
   this refers to the first variable of the last premise (it is usually the
   same for all cases). The \<open>(no_simp)\<close> option can be used to disable
   pre-simplification of cases (see the description of @{method induct} below
   for details).
 
   \<^descr> @{method induct}~\<open>insts R\<close> and @{method induction}~\<open>insts R\<close> are analogous
   to the @{method cases} method, but refer to induction rules, which are
   determined as follows:
 
   \<^medskip>
   \begin{tabular}{llll}
     facts   &                  & arguments     & rule \\\hline
             & @{method induct} & \<open>P x\<close>         & datatype induction (type of \<open>x\<close>) \\
     \<open>\<turnstile> A x\<close> & @{method induct} & \<open>\<dots>\<close>          & predicate/set induction (of \<open>A\<close>) \\
     \<open>\<dots>\<close>    & @{method induct} & \<open>\<dots> rule: R\<close>  & explicit rule \<open>R\<close> \\
   \end{tabular}
   \<^medskip>
 
   Several instantiations may be given, each referring to some part of a mutual
   inductive definition or datatype --- only related partial induction rules
   may be used together, though. Any of the lists of terms \<open>P, x, \<dots>\<close> refers to
   the \<^emph>\<open>suffix\<close> of variables present in the induction rule. This enables the
   writer to specify only induction variables, or both predicates and
   variables, for example.
 
   Instantiations may be definitional: equations \<open>x \<equiv> t\<close> introduce local
   definitions, which are inserted into the claim and discharged after applying
   the induction rule. Equalities reappear in the inductive cases, but have
   been transformed according to the induction principle being involved here.
   In order to achieve practically useful induction hypotheses, some variables
   occurring in \<open>t\<close> need to generalized (see below). Instantiations of
   the form \<open>t\<close>, where \<open>t\<close> is not a variable, are taken as a shorthand for \<open>x \<equiv>
   t\<close>, where \<open>x\<close> is a fresh variable. If this is not intended, \<open>t\<close> has to be
   enclosed in parentheses. By default, the equalities generated by
   definitional instantiations are pre-simplified using a specific set of
   rules, usually consisting of distinctness and injectivity theorems for
   datatypes. This pre-simplification may cause some of the parameters of an
   inductive case to disappear, or may even completely delete some of the
   inductive cases, if one of the equalities occurring in their premises can be
   simplified to \<open>False\<close>. The \<open>(no_simp)\<close> option can be used to disable
   pre-simplification. Additional rules to be used in pre-simplification can be
   declared using the @{attribute_def induct_simp} attribute.
 
   The optional ``\<open>arbitrary: x\<^sub>1 \<dots> x\<^sub>m\<close>'' specification generalizes variables
   \<open>x\<^sub>1, \<dots>, x\<^sub>m\<close> of the original goal before applying induction. It is possible
   to separate variables by ``\<open>and\<close>'' to generalize in goals other than
   the first. Thus induction hypotheses may become sufficiently general to get
   the proof through. Together with definitional instantiations, one may
   effectively perform induction over expressions of a certain structure.
 
   The optional ``\<open>taking: t\<^sub>1 \<dots> t\<^sub>n\<close>'' specification provides additional
   instantiations of a prefix of pending variables in the rule. Such schematic
   induction rules rarely occur in practice, though.
 
   \<^descr> @{method coinduct}~\<open>inst R\<close> is analogous to the @{method induct} method,
   but refers to coinduction rules, which are determined as follows:
 
   \<^medskip>
   \begin{tabular}{llll}
     goal  &                    & arguments & rule \\\hline
           & @{method coinduct} & \<open>x\<close> & type coinduction (type of \<open>x\<close>) \\
     \<open>A x\<close> & @{method coinduct} & \<open>\<dots>\<close> & predicate/set coinduction (of \<open>A\<close>) \\
     \<open>\<dots>\<close>   & @{method coinduct} & \<open>\<dots> rule: R\<close> & explicit rule \<open>R\<close> \\
   \end{tabular}
   \<^medskip>
 
   Coinduction is the dual of induction. Induction essentially eliminates \<open>A x\<close>
   towards a generic result \<open>P x\<close>, while coinduction introduces \<open>A x\<close> starting
   with \<open>B x\<close>, for a suitable ``bisimulation'' \<open>B\<close>. The cases of a coinduct
   rule are typically named after the predicates or sets being covered, while
   the conclusions consist of several alternatives being named after the
   individual destructor patterns.
 
   The given instantiation refers to the \<^emph>\<open>suffix\<close> of variables occurring in
   the rule's major premise, or conclusion if unavailable. An additional
   ``\<open>taking: t\<^sub>1 \<dots> t\<^sub>n\<close>'' specification may be required in order to specify
   the bisimulation to be used in the coinduction step.
 
 
   Above methods produce named local contexts, as determined by the
   instantiated rule as given in the text. Beyond that, the @{method induct}
   and @{method coinduct} methods guess further instantiations from the goal
   specification itself. Any persisting unresolved schematic variables of the
   resulting rule will render the the corresponding case invalid. The term
   binding @{variable ?case} for the conclusion will be provided with each
   case, provided that term is fully specified.
 
   The @{command "print_cases"} command prints all named cases present in the
   current proof state.
 
   \<^medskip>
   Despite the additional infrastructure, both @{method cases} and @{method
   coinduct} merely apply a certain rule, after instantiation, while conforming
   due to the usual way of monotonic natural deduction: the context of a
   structured statement \<open>\<And>x\<^sub>1 \<dots> x\<^sub>m. \<phi>\<^sub>1 \<Longrightarrow> \<dots> \<phi>\<^sub>n \<Longrightarrow> \<dots>\<close> reappears unchanged after
   the case split.
 
   The @{method induct} method is fundamentally different in this respect: the
   meta-level structure is passed through the ``recursive'' course involved in
   the induction. Thus the original statement is basically replaced by separate
   copies, corresponding to the induction hypotheses and conclusion; the
   original goal context is no longer available. Thus local assumptions, fixed
   parameters and definitions effectively participate in the inductive
   rephrasing of the original statement.
 
   In @{method induct} proofs, local assumptions introduced by cases are split
   into two different kinds: \<open>hyps\<close> stemming from the rule and \<open>prems\<close> from the
   goal statement. This is reflected in the extracted cases accordingly, so
   invoking ``@{command "case"}~\<open>c\<close>'' will provide separate facts \<open>c.hyps\<close> and
   \<open>c.prems\<close>, as well as fact \<open>c\<close> to hold the all-inclusive list.
 
   In @{method induction} proofs, local assumptions introduced by cases are
   split into three different kinds: \<open>IH\<close>, the induction hypotheses, \<open>hyps\<close>,
   the remaining hypotheses stemming from the rule, and \<open>prems\<close>, the
   assumptions from the goal statement. The names are \<open>c.IH\<close>, \<open>c.hyps\<close> and
   \<open>c.prems\<close>, as above.
 
   \<^medskip>
   Facts presented to either method are consumed according to the number of
   ``major premises'' of the rule involved, which is usually 0 for plain cases
   and induction rules of datatypes etc.\ and 1 for rules of inductive
   predicates or sets and the like. The remaining facts are inserted into the
   goal verbatim before the actual \<open>cases\<close>, \<open>induct\<close>, or \<open>coinduct\<close> rule is
   applied.
 \<close>
 
 
 subsection \<open>Declaring rules\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{command_def "print_induct_rules"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
     @{attribute_def cases} & : & \<open>attribute\<close> \\
     @{attribute_def induct} & : & \<open>attribute\<close> \\
     @{attribute_def coinduct} & : & \<open>attribute\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     @@{attribute cases} spec
     ;
     @@{attribute induct} spec
     ;
     @@{attribute coinduct} spec
     ;
 
     spec: (('type' | 'pred' | 'set') ':' @{syntax name}) | 'del'
   \<close>
 
   \<^descr> @{command "print_induct_rules"} prints cases and induct rules for
   predicates (or sets) and types of the current context.
 
   \<^descr> @{attribute cases}, @{attribute induct}, and @{attribute coinduct} (as
   attributes) declare rules for reasoning about (co)inductive predicates (or
   sets) and types, using the corresponding methods of the same name. Certain
   definitional packages of object-logics usually declare emerging cases and
   induction rules as expected, so users rarely need to intervene.
 
   Rules may be deleted via the \<open>del\<close> specification, which covers all of the
   \<open>type\<close>/\<open>pred\<close>/\<open>set\<close> sub-categories simultaneously. For example, @{attribute
   cases}~\<open>del\<close> removes any @{attribute cases} rules declared for some type,
   predicate, or set.
 
   Manual rule declarations usually refer to the @{attribute case_names} and
   @{attribute params} attributes to adjust names of cases and parameters of a
   rule; the @{attribute consumes} declaration is taken care of automatically:
   @{attribute consumes}~\<open>0\<close> is specified for ``type'' rules and @{attribute
   consumes}~\<open>1\<close> for ``predicate'' / ``set'' rules.
 \<close>
 
 
 section \<open>Generalized elimination and case splitting \label{sec:obtain}\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{command_def "consider"} & : & \<open>proof(state) | proof(chain) \<rightarrow> proof(prove)\<close> \\
     @{command_def "obtain"} & : & \<open>proof(state) | proof(chain) \<rightarrow> proof(prove)\<close> \\
   \end{matharray}
 
   Generalized elimination means that hypothetical parameters and premises may
   be introduced in the current context, potentially with a split into cases.
   This works by virtue of a locally proven rule that establishes the soundness
   of this temporary context extension. As representative examples, one may
   think of standard rules from Isabelle/HOL like this:
 
   \<^medskip>
   \begin{tabular}{ll}
   \<open>\<exists>x. B x \<Longrightarrow> (\<And>x. B x \<Longrightarrow> thesis) \<Longrightarrow> thesis\<close> \\
   \<open>A \<and> B \<Longrightarrow> (A \<Longrightarrow> B \<Longrightarrow> thesis) \<Longrightarrow> thesis\<close> \\
   \<open>A \<or> B \<Longrightarrow> (A \<Longrightarrow> thesis) \<Longrightarrow> (B \<Longrightarrow> thesis) \<Longrightarrow> thesis\<close> \\
   \end{tabular}
   \<^medskip>
 
   In general, these particular rules and connectives need to get involved at
   all: this concept works directly in Isabelle/Pure via Isar commands defined
   below. In particular, the logic of elimination and case splitting is
   delegated to an Isar proof, which often involves automated tools.
 
   \<^rail>\<open>
     @@{command consider} @{syntax obtain_clauses}
     ;
     @@{command obtain} @{syntax par_name}? @{syntax vars} \<newline>
       @'where' concl prems @{syntax for_fixes}
     ;
     concl: (@{syntax props} + @'and')
     ;
     prems: (@'if' (@{syntax props'} + @'and'))?
   \<close>
 
   \<^descr> @{command consider}~\<open>(a) \<^vec>x \<WHERE> \<^vec>A \<^vec>x | (b)
   \<^vec>y \<WHERE> \<^vec>B \<^vec>y | \<dots>\<close> states a rule for case splitting
   into separate subgoals, such that each case involves new parameters and
   premises. After the proof is finished, the resulting rule may be used
   directly with the @{method cases} proof method (\secref{sec:cases-induct}),
   in order to perform actual case-splitting of the proof text via @{command
   case} and @{command next} as usual.
 
   Optional names in round parentheses refer to case names: in the proof of the
   rule this is a fact name, in the resulting rule it is used as annotation
   with the @{attribute_ref case_names} attribute.
 
   \<^medskip>
   Formally, the command @{command consider} is defined as derived Isar
   language element as follows:
 
   \begin{matharray}{l}
     @{command "consider"}~\<open>(a) \<^vec>x \<WHERE> \<^vec>A \<^vec>x | (b) \<^vec>y \<WHERE> \<^vec>B \<^vec>y | \<dots> \<equiv>\<close> \\[1ex]
     \quad @{command "have"}~\<open>[case_names a b \<dots>]: thesis\<close> \\
     \qquad \<open>\<IF> a [Pure.intro?]: \<And>\<^vec>x. \<^vec>A \<^vec>x \<Longrightarrow> thesis\<close> \\
     \qquad \<open>\<AND> b [Pure.intro?]: \<And>\<^vec>y. \<^vec>B \<^vec>y \<Longrightarrow> thesis\<close> \\
     \qquad \<open>\<AND> \<dots>\<close> \\
     \qquad \<open>\<FOR> thesis\<close> \\
     \qquad @{command "apply"}~\<open>(insert a b \<dots>)\<close> \\
   \end{matharray}
 
   See also \secref{sec:goals} for @{keyword "obtains"} in toplevel goal
   statements, as well as @{command print_statement} to print existing rules in
   a similar format.
 
   \<^descr> @{command obtain}~\<open>\<^vec>x \<WHERE> \<^vec>A \<^vec>x\<close> states a
   generalized elimination rule with exactly one case. After the proof is
   finished, it is activated for the subsequent proof text: the context is
   augmented via @{command fix}~\<open>\<^vec>x\<close> @{command assume}~\<open>\<^vec>A
   \<^vec>x\<close>, with special provisions to export later results by discharging
   these assumptions again.
 
   Note that according to the parameter scopes within the elimination rule,
   results \<^emph>\<open>must not\<close> refer to hypothetical parameters; otherwise the export
   will fail! This restriction conforms to the usual manner of existential
   reasoning in Natural Deduction.
 
   \<^medskip>
   Formally, the command @{command obtain} is defined as derived Isar language
   element as follows, using an instrumented variant of @{command assume}:
 
   \begin{matharray}{l}
     @{command "obtain"}~\<open>\<^vec>x \<WHERE> a: \<^vec>A \<^vec>x  \<langle>proof\<rangle> \<equiv>\<close> \\[1ex]
     \quad @{command "have"}~\<open>thesis\<close> \\
     \qquad \<open>\<IF> that [Pure.intro?]: \<And>\<^vec>x. \<^vec>A \<^vec>x \<Longrightarrow> thesis\<close> \\
     \qquad \<open>\<FOR> thesis\<close> \\
     \qquad @{command "apply"}~\<open>(insert that)\<close> \\
     \qquad \<open>\<langle>proof\<rangle>\<close> \\
     \quad @{command "fix"}~\<open>\<^vec>x\<close>~@{command "assume"}\<open>\<^sup>* a: \<^vec>A \<^vec>x\<close> \\
   \end{matharray}
 
   In the proof of @{command consider} and @{command obtain} the local premises
   are always bound to the fact name @{fact_ref that}, according to structured
   Isar statements involving @{keyword_ref "if"} (\secref{sec:goals}).
 
   Facts that are established by @{command "obtain"} cannot be polymorphic: any
   type-variables occurring here are fixed in the present context. This is a
   natural consequence of the role of @{command fix} and @{command assume} in
   this construct.
 \<close>
 
 end
diff --git a/src/Doc/Isar_Ref/Proof_Script.thy b/src/Doc/Isar_Ref/Proof_Script.thy
--- a/src/Doc/Isar_Ref/Proof_Script.thy
+++ b/src/Doc/Isar_Ref/Proof_Script.thy
@@ -1,280 +1,279 @@
 (*:maxLineLen=78:*)
 
 theory Proof_Script
   imports Main Base
 begin
 
 chapter \<open>Proof scripts\<close>
 
 text \<open>
   Interactive theorem proving is traditionally associated with ``proof
   scripts'', but Isabelle/Isar is centered around structured \<^emph>\<open>proof
   documents\<close> instead (see also \chref{ch:proofs}).
 
   Nonetheless, it is possible to emulate proof scripts by sequential
   refinements of a proof state in backwards mode, notably with the @{command
   apply} command (see \secref{sec:tactic-commands}).
 
   There are also various proof methods that allow to refer to implicit goal
   state information that is not accessible to structured Isar proofs (see
   \secref{sec:tactics}). Note that the @{command subgoal}
   (\secref{sec:subgoal}) command usually eliminates the need for implicit goal
   state references.
 \<close>
 
 
 section \<open>Commands for step-wise refinement \label{sec:tactic-commands}\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{command_def "supply"}\<open>\<^sup>*\<close> & : & \<open>proof(prove) \<rightarrow> proof(prove)\<close> \\
     @{command_def "apply"}\<open>\<^sup>*\<close> & : & \<open>proof(prove) \<rightarrow> proof(prove)\<close> \\
     @{command_def "apply_end"}\<open>\<^sup>*\<close> & : & \<open>proof(state) \<rightarrow> proof(state)\<close> \\
     @{command_def "done"}\<open>\<^sup>*\<close> & : & \<open>proof(prove) \<rightarrow> proof(state) | local_theory | theory\<close> \\
     @{command_def "defer"}\<open>\<^sup>*\<close> & : & \<open>proof \<rightarrow> proof\<close> \\
     @{command_def "prefer"}\<open>\<^sup>*\<close> & : & \<open>proof \<rightarrow> proof\<close> \\
     @{command_def "back"}\<open>\<^sup>*\<close> & : & \<open>proof \<rightarrow> proof\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     @@{command supply} (@{syntax thmdef}? @{syntax thms} + @'and')
     ;
     ( @@{command apply} | @@{command apply_end} ) @{syntax method}
     ;
     @@{command defer} @{syntax nat}?
     ;
     @@{command prefer} @{syntax nat}
   \<close>
 
   \<^descr> @{command "supply"} supports fact definitions during goal refinement: it
   is similar to @{command "note"}, but it operates in backwards mode and does
   not have any impact on chained facts.
 
   \<^descr> @{command "apply"}~\<open>m\<close> applies proof method \<open>m\<close> in initial position, but
   unlike @{command "proof"} it retains ``\<open>proof(prove)\<close>'' mode. Thus
   consecutive method applications may be given just as in tactic scripts.
 
   Facts are passed to \<open>m\<close> as indicated by the goal's forward-chain mode, and
   are \<^emph>\<open>consumed\<close> afterwards. Thus any further @{command "apply"} command
   would always work in a purely backward manner.
 
   \<^descr> @{command "apply_end"}~\<open>m\<close> applies proof method \<open>m\<close> as if in terminal
   position. Basically, this simulates a multi-step tactic script for @{command
   "qed"}, but may be given anywhere within the proof body.
 
   No facts are passed to \<open>m\<close> here. Furthermore, the static context is that of
   the enclosing goal (as for actual @{command "qed"}). Thus the proof method
   may not refer to any assumptions introduced in the current body, for
   example.
 
   \<^descr> @{command "done"} completes a proof script, provided that the current goal
   state is solved completely. Note that actual structured proof commands
   (e.g.\ ``@{command "."}'' or @{command "sorry"}) may be used to conclude
   proof scripts as well.
 
   \<^descr> @{command "defer"}~\<open>n\<close> and @{command "prefer"}~\<open>n\<close> shuffle the list of
   pending goals: @{command "defer"} puts off sub-goal \<open>n\<close> to the end of the
   list (\<open>n = 1\<close> by default), while @{command "prefer"} brings sub-goal \<open>n\<close> to
   the front.
 
   \<^descr> @{command "back"} does back-tracking over the result sequence of the
   latest proof command. Any proof command may return multiple results, and
   this command explores the possibilities step-by-step. It is mainly useful
   for experimentation and interactive exploration, and should be avoided in
   finished proofs.
 \<close>
 
 
 section \<open>Explicit subgoal structure \label{sec:subgoal}\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{command_def "subgoal"}\<open>\<^sup>*\<close> & : & \<open>proof \<rightarrow> proof\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     @@{command subgoal} @{syntax thmbind}? prems? params?
     ;
     prems: @'premises' @{syntax thmbind}?
     ;
     params: @'for' '\<dots>'? (('_' | @{syntax name})+)
   \<close>
 
   \<^descr> @{command "subgoal"} allows to impose some structure on backward
   refinements, to avoid proof scripts degenerating into long of @{command
   apply} sequences.
 
   The current goal state, which is essentially a hidden part of the Isar/VM
   configuration, is turned into a proof context and remaining conclusion.
   This corresponds to @{command fix}~/ @{command assume}~/ @{command show} in
   structured proofs, but the text of the parameters, premises and conclusion
   is not given explicitly.
 
   Goal parameters may be specified separately, in order to allow referring to
   them in the proof body: ``@{command subgoal}~@{keyword "for"}~\<open>x y z\<close>''
   names a \<^emph>\<open>prefix\<close>, and ``@{command subgoal}~@{keyword "for"}~\<open>\<dots> x y z\<close>''
   names a \<^emph>\<open>suffix\<close> of goal parameters. The latter uses a literal \<^verbatim>\<open>\<dots>\<close> symbol
   as notation. Parameter positions may be skipped via dummies (underscore).
   Unspecified names remain internal, and thus inaccessible in the proof text.
 
   ``@{command subgoal}~@{keyword "premises"}~\<open>prems\<close>'' indicates that goal
   premises should be turned into assumptions of the context (otherwise the
   remaining conclusion is a Pure implication). The fact name and attributes
   are optional; the particular name ``\<open>prems\<close>'' is a common convention for the
   premises of an arbitrary goal context in proof scripts.
 
   ``@{command subgoal}~\<open>result\<close>'' indicates a fact name for the result of a
   proven subgoal. Thus it may be re-used in further reasoning, similar to the
   result of @{command show} in structured Isar proofs.
 
 
   Here are some abstract examples:
 \<close>
 
 lemma "\<And>x y z. A x \<Longrightarrow> B y \<Longrightarrow> C z"
   and "\<And>u v. X u \<Longrightarrow> Y v"
   subgoal \<proof>
   subgoal \<proof>
   done
 
 lemma "\<And>x y z. A x \<Longrightarrow> B y \<Longrightarrow> C z"
   and "\<And>u v. X u \<Longrightarrow> Y v"
   subgoal for x y z \<proof>
   subgoal for u v \<proof>
   done
 
 lemma "\<And>x y z. A x \<Longrightarrow> B y \<Longrightarrow> C z"
   and "\<And>u v. X u \<Longrightarrow> Y v"
   subgoal premises for x y z
     using \<open>A x\<close> \<open>B y\<close>
     \<proof>
   subgoal premises for u v
     using \<open>X u\<close>
     \<proof>
   done
 
 lemma "\<And>x y z. A x \<Longrightarrow> B y \<Longrightarrow> C z"
   and "\<And>u v. X u \<Longrightarrow> Y v"
   subgoal r premises prems for x y z
   proof -
     have "A x" by (fact prems)
     moreover have "B y" by (fact prems)
     ultimately show ?thesis \<proof>
   qed
   subgoal premises prems for u v
   proof -
     have "\<And>x y z. A x \<Longrightarrow> B y \<Longrightarrow> C z" by (fact r)
     moreover
     have "X u" by (fact prems)
     ultimately show ?thesis \<proof>
   qed
   done
 
 lemma "\<And>x y z. A x \<Longrightarrow> B y \<Longrightarrow> C z"
   subgoal premises prems for \<dots> z
   proof -
     from prems show "C z" \<proof>
   qed
   done
 
 
 section \<open>Tactics: improper proof methods \label{sec:tactics}\<close>
 
 text \<open>
   The following improper proof methods emulate traditional tactics. These
   admit direct access to the goal state, which is normally considered harmful!
   In particular, this may involve both numbered goal addressing (default 1),
   and dynamic instantiation within the scope of some subgoal.
 
   \begin{warn}
     Dynamic instantiations refer to universally quantified parameters of a
     subgoal (the dynamic context) rather than fixed variables and term
     abbreviations of a (static) Isar context.
   \end{warn}
 
   Tactic emulation methods, unlike their ML counterparts, admit simultaneous
   instantiation from both dynamic and static contexts. If names occur in both
   contexts goal parameters hide locally fixed variables. Likewise, schematic
   variables refer to term abbreviations, if present in the static context.
   Otherwise the schematic variable is interpreted as a schematic variable and
   left to be solved by unification with certain parts of the subgoal.
 
   Note that the tactic emulation proof methods in Isabelle/Isar are
   consistently named \<open>foo_tac\<close>. Note also that variable names occurring on
   left hand sides of instantiations must be preceded by a question mark if
   they coincide with a keyword or contain dots. This is consistent with the
   attribute @{attribute "where"} (see \secref{sec:pure-meth-att}).
 
   \begin{matharray}{rcl}
     @{method_def rule_tac}\<open>\<^sup>*\<close> & : & \<open>method\<close> \\
     @{method_def erule_tac}\<open>\<^sup>*\<close> & : & \<open>method\<close> \\
     @{method_def drule_tac}\<open>\<^sup>*\<close> & : & \<open>method\<close> \\
     @{method_def frule_tac}\<open>\<^sup>*\<close> & : & \<open>method\<close> \\
     @{method_def cut_tac}\<open>\<^sup>*\<close> & : & \<open>method\<close> \\
     @{method_def thin_tac}\<open>\<^sup>*\<close> & : & \<open>method\<close> \\
     @{method_def subgoal_tac}\<open>\<^sup>*\<close> & : & \<open>method\<close> \\
     @{method_def rename_tac}\<open>\<^sup>*\<close> & : & \<open>method\<close> \\
     @{method_def rotate_tac}\<open>\<^sup>*\<close> & : & \<open>method\<close> \\
     @{method_def tactic}\<open>\<^sup>*\<close> & : & \<open>method\<close> \\
     @{method_def raw_tactic}\<open>\<^sup>*\<close> & : & \<open>method\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     (@@{method rule_tac} | @@{method erule_tac} | @@{method drule_tac} |
       @@{method frule_tac} | @@{method cut_tac}) @{syntax goal_spec}? \<newline>
     (@{syntax named_insts} @{syntax for_fixes} @'in' @{syntax thm} | @{syntax thms} )
     ;
     @@{method thin_tac} @{syntax goal_spec}? @{syntax prop} @{syntax for_fixes}
     ;
     @@{method subgoal_tac} @{syntax goal_spec}? (@{syntax prop} +) @{syntax for_fixes}
     ;
     @@{method rename_tac} @{syntax goal_spec}? (@{syntax name} +)
     ;
     @@{method rotate_tac} @{syntax goal_spec}? @{syntax int}?
     ;
     (@@{method tactic} | @@{method raw_tactic}) @{syntax text}
   \<close>
 
   \<^descr> @{method rule_tac} etc. do resolution of rules with explicit
-  instantiation. This works the same way as the ML tactics \<^ML>\<open>Rule_Insts.res_inst_tac\<close> etc.\ (see @{cite "isabelle-implementation"}).
+  instantiation. This works the same way as the ML tactics \<^ML>\<open>Rule_Insts.res_inst_tac\<close> etc.\ (see \<^cite>\<open>"isabelle-implementation"\<close>).
 
   Multiple rules may be only given if there is no instantiation; then @{method
-  rule_tac} is the same as \<^ML>\<open>resolve_tac\<close> in ML (see @{cite
-  "isabelle-implementation"}).
+  rule_tac} is the same as \<^ML>\<open>resolve_tac\<close> in ML (see \<^cite>\<open>"isabelle-implementation"\<close>).
 
   \<^descr> @{method cut_tac} inserts facts into the proof state as assumption of a
   subgoal; instantiations may be given as well. Note that the scope of
   schematic variables is spread over the main goal statement and rule premises
   are turned into new subgoals. This is in contrast to the regular method
   @{method insert} which inserts closed rule statements.
 
   \<^descr> @{method thin_tac}~\<open>\<phi>\<close> deletes the specified premise from a subgoal. Note
   that \<open>\<phi>\<close> may contain schematic variables, to abbreviate the intended
   proposition; the first matching subgoal premise will be deleted. Removing
   useless premises from a subgoal increases its readability and can make
   search tactics run faster.
 
   \<^descr> @{method subgoal_tac}~\<open>\<phi>\<^sub>1 \<dots> \<phi>\<^sub>n\<close> adds the propositions \<open>\<phi>\<^sub>1 \<dots> \<phi>\<^sub>n\<close> as
   local premises to a subgoal, and poses the same as new subgoals (in the
   original context).
 
   \<^descr> @{method rename_tac}~\<open>x\<^sub>1 \<dots> x\<^sub>n\<close> renames parameters of a goal according to
   the list \<open>x\<^sub>1, \<dots>, x\<^sub>n\<close>, which refers to the \<^emph>\<open>suffix\<close> of variables.
 
   \<^descr> @{method rotate_tac}~\<open>n\<close> rotates the premises of a subgoal by \<open>n\<close>
   positions: from right to left if \<open>n\<close> is positive, and from left to right if
   \<open>n\<close> is negative; the default value is 1.
 
   \<^descr> @{method tactic}~\<open>text\<close> produces a proof method from any ML text of type
   \<^ML_type>\<open>tactic\<close>. Apart from the usual ML environment and the current proof
   context, the ML code may refer to the locally bound values \<^ML_text>\<open>facts\<close>,
   which indicates any current facts used for forward-chaining.
 
   \<^descr> @{method raw_tactic} is similar to @{method tactic}, but presents the goal
   state in its raw internal form, where simultaneous subgoals appear as
   conjunction of the logical framework instead of the usual split into several
   subgoals. While feature this is useful for debugging of complex method
   definitions, it should not never appear in production theories.
 \<close>
 
 end
diff --git a/src/Doc/Isar_Ref/Spec.thy b/src/Doc/Isar_Ref/Spec.thy
--- a/src/Doc/Isar_Ref/Spec.thy
+++ b/src/Doc/Isar_Ref/Spec.thy
@@ -1,1549 +1,1548 @@
 (*:maxLineLen=78:*)
 
 theory Spec
   imports Main Base
 begin
 
 chapter \<open>Specifications\<close>
 
 text \<open>
   The Isabelle/Isar theory format integrates specifications and proofs, with
   support for interactive development by continuous document editing. There is
   a separate document preparation system (see \chref{ch:document-prep}), for
   typesetting formal developments together with informal text. The resulting
   hyper-linked PDF documents can be used both for WWW presentation and printed
   copies.
 
   The Isar proof language (see \chref{ch:proofs}) is embedded into the theory
   language as a proper sub-language. Proof mode is entered by stating some
   \<^theory_text>\<open>theorem\<close> or \<^theory_text>\<open>lemma\<close> at the theory level, and left again with the final
   conclusion (e.g.\ via \<^theory_text>\<open>qed\<close>).
 \<close>
 
 
 section \<open>Defining theories \label{sec:begin-thy}\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{command_def "theory"} & : & \<open>toplevel \<rightarrow> theory\<close> \\
     @{command_def (global) "end"} & : & \<open>theory \<rightarrow> toplevel\<close> \\
     @{command_def "thy_deps"}\<open>\<^sup>*\<close> & : & \<open>theory \<rightarrow>\<close> \\
   \end{matharray}
 
   Isabelle/Isar theories are defined via theory files, which consist of an
   outermost sequence of definition--statement--proof elements. Some
   definitions are self-sufficient (e.g.\ \<^theory_text>\<open>fun\<close> in Isabelle/HOL), with
   foundational proofs performed internally. Other definitions require an
   explicit proof as justification (e.g.\ \<^theory_text>\<open>function\<close> and \<^theory_text>\<open>termination\<close> in
   Isabelle/HOL). Plain statements like \<^theory_text>\<open>theorem\<close> or \<^theory_text>\<open>lemma\<close> are merely a
   special case of that, defining a theorem from a given proposition and its
   proof.
 
   The theory body may be sub-structured by means of \<^emph>\<open>local theory targets\<close>,
   such as \<^theory_text>\<open>locale\<close> and \<^theory_text>\<open>class\<close>. It is also possible to use \<^theory_text>\<open>context begin \<dots>
   end\<close> blocks to delimited a local theory context: a \<^emph>\<open>named context\<close> to
   augment a locale or class specification, or an \<^emph>\<open>unnamed context\<close> to refer
   to local parameters and assumptions that are discharged later. See
   \secref{sec:target} for more details.
 
   \<^medskip>
   A theory is commenced by the \<^theory_text>\<open>theory\<close> command, which indicates imports of
   previous theories, according to an acyclic foundational order. Before the
   initial \<^theory_text>\<open>theory\<close> command, there may be optional document header material
   (like \<^theory_text>\<open>section\<close> or \<^theory_text>\<open>text\<close>, see \secref{sec:markup}). The document header
   is outside of the formal theory context, though.
 
   A theory is concluded by a final @{command (global) "end"} command, one that
   does not belong to a local theory target. No further commands may follow
   such a global @{command (global) "end"}.
 
   \<^rail>\<open>
     @@{command theory} @{syntax system_name}
       @'imports' (@{syntax system_name} +) \<newline>
       keywords? abbrevs? @'begin'
     ;
     keywords: @'keywords' (keyword_decls + @'and')
     ;
     keyword_decls: (@{syntax string} +) ('::' @{syntax name} @{syntax tags})?
     ;
     abbrevs: @'abbrevs' (((text+) '=' (text+)) + @'and')
     ;
     @@{command thy_deps} (thy_bounds thy_bounds?)?
     ;
     thy_bounds: @{syntax name} | '(' (@{syntax name} + @'|') ')'
   \<close>
 
   \<^descr> \<^theory_text>\<open>theory A imports B\<^sub>1 \<dots> B\<^sub>n begin\<close> starts a new theory \<open>A\<close> based on the
   merge of existing theories \<open>B\<^sub>1 \<dots> B\<^sub>n\<close>. Due to the possibility to import
   more than one ancestor, the resulting theory structure of an Isabelle
   session forms a directed acyclic graph (DAG). Isabelle takes care that
   sources contributing to the development graph are always up-to-date: changed
   files are automatically rechecked whenever a theory header specification is
   processed.
 
   Empty imports are only allowed in the bootstrap process of the special
   theory \<^theory>\<open>Pure\<close>, which is the start of any other formal development
   based on Isabelle. Regular user theories usually refer to some more complex
   entry point, such as theory \<^theory>\<open>Main\<close> in Isabelle/HOL.
 
   The @{keyword_def "keywords"} specification declares outer syntax
   (\chref{ch:outer-syntax}) that is introduced in this theory later on (rare
   in end-user applications). Both minor keywords and major keywords of the
   Isar command language need to be specified, in order to make parsing of
   proof documents work properly. Command keywords need to be classified
   according to their structural role in the formal text. Examples may be seen
   in Isabelle/HOL sources itself, such as @{keyword "keywords"}~\<^verbatim>\<open>"typedef"\<close>
   \<open>:: thy_goal_defn\<close> or @{keyword "keywords"}~\<^verbatim>\<open>"datatype"\<close> \<open>:: thy_defn\<close> for
   theory-level definitions with and without proof, respectively. Additional
   @{syntax tags} provide defaults for document preparation
   (\secref{sec:document-markers}).
 
   The @{keyword_def "abbrevs"} specification declares additional abbreviations
   for syntactic completion. The default for a new keyword is just its name,
   but completion may be avoided by defining @{keyword "abbrevs"} with empty
   text.
 
   \<^descr> @{command (global) "end"} concludes the current theory definition. Note
   that some other commands, e.g.\ local theory targets \<^theory_text>\<open>locale\<close> or \<^theory_text>\<open>class\<close>
   may involve a \<^theory_text>\<open>begin\<close> that needs to be matched by @{command (local) "end"},
   according to the usual rules for nested blocks.
 
   \<^descr> \<^theory_text>\<open>thy_deps\<close> visualizes the theory hierarchy as a directed acyclic graph.
   By default, all imported theories are shown. This may be restricted by
   specifying bounds wrt. the theory inclusion relation.
 \<close>
 
 
 section \<open>Local theory targets \label{sec:target}\<close>
 
 text \<open>
   \begin{matharray}{rcll}
     @{command_def "context"} & : & \<open>theory \<rightarrow> local_theory\<close> \\
     @{command_def (local) "end"} & : & \<open>local_theory \<rightarrow> theory\<close> \\
     @{keyword_def "private"} \\
     @{keyword_def "qualified"} \\
   \end{matharray}
 
   A local theory target is a specification context that is managed separately
   within the enclosing theory. Contexts may introduce parameters (fixed
   variables) and assumptions (hypotheses). Definitions and theorems depending
   on the context may be added incrementally later on.
 
   \<^emph>\<open>Named contexts\<close> refer to locales (cf.\ \secref{sec:locale}) or type
   classes (cf.\ \secref{sec:class}); the name ``\<open>-\<close>'' signifies the global
   theory context.
 
   \<^emph>\<open>Unnamed contexts\<close> may introduce additional parameters and assumptions, and
   results produced in the context are generalized accordingly. Such auxiliary
   contexts may be nested within other targets, like \<^theory_text>\<open>locale\<close>, \<^theory_text>\<open>class\<close>,
   \<^theory_text>\<open>instantiation\<close>, \<^theory_text>\<open>overloading\<close>.
 
   \<^rail>\<open>
     @@{command context} @{syntax name} @{syntax_ref "opening"}? @'begin'
     ;
     @@{command context} @{syntax_ref "includes"}? (@{syntax context_elem} * ) @'begin'
     ;
     @{syntax_def target}: '(' @'in' @{syntax name} ')'
   \<close>
 
   \<^descr> \<^theory_text>\<open>context c bundles begin\<close> opens a named context, by recommencing an existing
   locale or class \<open>c\<close>. Note that locale and class definitions allow to include
   the \<^theory_text>\<open>begin\<close> keyword as well, in order to continue the local theory
   immediately after the initial specification.  Optionally given
   \<open>bundles\<close> only take effect in the surface context within the \<^theory_text>\<open>begin\<close> /
   \<^theory_text>\<open>end\<close> block.
 
   \<^descr> \<^theory_text>\<open>context bundles elements begin\<close> opens an unnamed context, by extending
   the enclosing global or local theory target by the given declaration bundles
   (\secref{sec:bundle}) and context elements (\<^theory_text>\<open>fixes\<close>, \<^theory_text>\<open>assumes\<close> etc.). This
   means any results stemming from definitions and proofs in the extended
   context will be exported into the enclosing target by lifting over extra
   parameters and premises.
 
   \<^descr> @{command (local) "end"} concludes the current local theory, according to
   the nesting of contexts. Note that a global @{command (global) "end"} has a
   different meaning: it concludes the theory itself (\secref{sec:begin-thy}).
 
   \<^descr> \<^theory_text>\<open>private\<close> or \<^theory_text>\<open>qualified\<close> may be given as modifiers before any local
   theory command. This restricts name space accesses to the local scope, as
   determined by the enclosing \<^theory_text>\<open>context begin \<dots> end\<close> block. Outside its scope,
   a \<^theory_text>\<open>private\<close> name is inaccessible, and a \<^theory_text>\<open>qualified\<close> name is only
   accessible with some qualification.
 
   Neither a global \<^theory_text>\<open>theory\<close> nor a \<^theory_text>\<open>locale\<close> target provides a local scope by
   itself: an extra unnamed context is required to use \<^theory_text>\<open>private\<close> or
   \<^theory_text>\<open>qualified\<close> here.
 
   \<^descr> \<open>(\<close>@{keyword_def "in"}~\<open>c)\<close> given after any local theory command specifies
   an immediate target, e.g.\ ``\<^theory_text>\<open>definition (in c)\<close>'' or
   ``\<^theory_text>\<open>theorem (in c)\<close>''. This works both in a local or global theory context;
   the current target context will be suspended for this command only. Note
   that ``\<^theory_text>\<open>(in -)\<close>'' will always produce a global result independently of the
   current target context.
 
 
   Any specification element that operates on \<open>local_theory\<close> according to this
   manual implicitly allows the above target syntax \<^theory_text>\<open>(in c)\<close>, but individual
   syntax diagrams omit that aspect for clarity.
 
   \<^medskip>
   The exact meaning of results produced within a local theory context depends
   on the underlying target infrastructure (locale, type class etc.). The
   general idea is as follows, considering a context named \<open>c\<close> with parameter
   \<open>x\<close> and assumption \<open>A[x]\<close>.
 
   Definitions are exported by introducing a global version with additional
   arguments; a syntactic abbreviation links the long form with the abstract
   version of the target context. For example, \<open>a \<equiv> t[x]\<close> becomes \<open>c.a ?x \<equiv>
   t[?x]\<close> at the theory level (for arbitrary \<open>?x\<close>), together with a local
   abbreviation \<open>a \<equiv> c.a x\<close> in the target context (for the fixed parameter
   \<open>x\<close>).
 
   Theorems are exported by discharging the assumptions and generalizing the
   parameters of the context. For example, \<open>a: B[x]\<close> becomes \<open>c.a: A[?x] \<Longrightarrow>
   B[?x]\<close>, again for arbitrary \<open>?x\<close>.
 \<close>
 
 
 section \<open>Bundled declarations \label{sec:bundle}\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{command_def "bundle"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
     @{command "bundle"} & : & \<open>theory \<rightarrow> local_theory\<close> \\
     @{command_def "print_bundles"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
     @{command_def "include"} & : & \<open>proof(state) \<rightarrow> proof(state)\<close> \\
     @{command_def "including"} & : & \<open>proof(prove) \<rightarrow> proof(prove)\<close> \\
     @{keyword_def "includes"} & : & syntax \\
   \end{matharray}
 
   The outer syntax of fact expressions (\secref{sec:syn-att}) involves
   theorems and attributes, which are evaluated in the context and applied to
   it. Attributes may declare theorems to the context, as in \<open>this_rule [intro]
   that_rule [elim]\<close> for example. Configuration options (\secref{sec:config})
   are special declaration attributes that operate on the context without a
   theorem, as in \<open>[[show_types = false]]\<close> for example.
 
   Expressions of this form may be defined as \<^emph>\<open>bundled declarations\<close> in the
   context, and included in other situations later on. Including declaration
   bundles augments a local context casually without logical dependencies,
   which is in contrast to locales and locale interpretation
   (\secref{sec:locale}).
 
   \<^rail>\<open>
     @@{command bundle} @{syntax name}
       ( '=' @{syntax thms} @{syntax for_fixes} | @'begin')
     ;
     @@{command print_bundles} ('!'?)
     ;
     (@@{command include} | @@{command including}) (@{syntax name}+)
     ;
     @{syntax_def "includes"}: @'includes' (@{syntax name}+)
     ;
     @{syntax_def "opening"}: @'opening' (@{syntax name}+)
     ;
     @@{command unbundle} (@{syntax name}+)
   \<close>
 
   \<^descr> \<^theory_text>\<open>bundle b = decls\<close> defines a bundle of declarations in the current
   context. The RHS is similar to the one of the \<^theory_text>\<open>declare\<close> command. Bundles
   defined in local theory targets are subject to transformations via
   morphisms, when moved into different application contexts; this works
   analogously to any other local theory specification.
 
   \<^descr> \<^theory_text>\<open>bundle b begin body end\<close> defines a bundle of declarations from the
   \<open>body\<close> of local theory specifications. It may consist of commands that are
   technically equivalent to \<^theory_text>\<open>declare\<close> or \<^theory_text>\<open>declaration\<close>, which also includes
   \<^theory_text>\<open>notation\<close>, for example. Named fact declarations like ``\<^theory_text>\<open>lemmas a [simp] =
   b\<close>'' or ``\<^theory_text>\<open>lemma a [simp]: B \<proof>\<close>'' are also admitted, but the name
   bindings are not recorded in the bundle.
 
   \<^descr> \<^theory_text>\<open>print_bundles\<close> prints the named bundles that are available in the
   current context; the ``\<open>!\<close>'' option indicates extra verbosity.
 
   \<^descr> \<^theory_text>\<open>include b\<^sub>1 \<dots> b\<^sub>n\<close> activates the declarations from the given bundles
   in a proof body (forward mode). This is analogous to \<^theory_text>\<open>note\<close>
   (\secref{sec:proof-facts}) with the expanded bundles.
 
   \<^descr> \<^theory_text>\<open>including b\<^sub>1 \<dots> b\<^sub>n\<close> is similar to \<^theory_text>\<open>include\<close>, but works in proof refinement
   (backward mode). This is analogous to \<^theory_text>\<open>using\<close> (\secref{sec:proof-facts})
   with the expanded bundles.
 
   \<^descr> \<^theory_text>\<open>includes b\<^sub>1 \<dots> b\<^sub>n\<close> is similar to \<^theory_text>\<open>include\<close>, but applies to a
   confined specification context: unnamed \<^theory_text>\<open>context\<close>s and
   long statements of \<^theory_text>\<open>theorem\<close>.
 
   \<^descr> \<^theory_text>\<open>opening b\<^sub>1 \<dots> b\<^sub>n\<close> is similar to \<^theory_text>\<open>includes\<close>, but applies to
   a named specification context: \<^theory_text>\<open>locale\<close>s, \<^theory_text>\<open>class\<close>es and
   named \<^theory_text>\<open>context\<close>s. The effect is confined to the surface context within the
   specification block itself and the corresponding \<^theory_text>\<open>begin\<close> / \<^theory_text>\<open>end\<close> block.
 
   \<^descr> \<^theory_text>\<open>unbundle b\<^sub>1 \<dots> b\<^sub>n\<close> activates the declarations from the given bundles in
   the current local theory context. This is analogous to \<^theory_text>\<open>lemmas\<close>
   (\secref{sec:theorems}) with the expanded bundles.
 
 
   Here is an artificial example of bundling various configuration options:
 \<close>
 
 (*<*)experiment begin(*>*)
 bundle trace = [[simp_trace, linarith_trace, metis_trace, smt_trace]]
 
 lemma "x = x"
   including trace by metis
 (*<*)end(*>*)
 
 
 section \<open>Term definitions \label{sec:term-definitions}\<close>
 
 text \<open>
   \begin{matharray}{rcll}
     @{command_def "definition"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
     @{attribute_def "defn"} & : & \<open>attribute\<close> \\
     @{command_def "print_defn_rules"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
     @{command_def "abbreviation"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
     @{command_def "print_abbrevs"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
   \end{matharray}
 
   Term definitions may either happen within the logic (as equational axioms of
   a certain form (see also \secref{sec:overloading}), or outside of it as
   rewrite system on abstract syntax. The second form is called
   ``abbreviation''.
 
   \<^rail>\<open>
     @@{command definition} decl? definition
     ;
     @@{command abbreviation} @{syntax mode}? decl? abbreviation
     ;
     @@{command print_abbrevs} ('!'?)
     ;
     decl: @{syntax name} ('::' @{syntax type})? @{syntax mixfix}? @'where'
     ;
     definition: @{syntax thmdecl}? @{syntax prop}
       @{syntax spec_prems} @{syntax for_fixes}
     ;
     abbreviation: @{syntax prop} @{syntax for_fixes}
   \<close>
 
   \<^descr> \<^theory_text>\<open>definition c where eq\<close> produces an internal definition \<open>c \<equiv> t\<close> according
   to the specification given as \<open>eq\<close>, which is then turned into a proven fact.
   The given proposition may deviate from internal meta-level equality
   according to the rewrite rules declared as @{attribute defn} by the
   object-logic. This usually covers object-level equality \<open>x = y\<close> and
   equivalence \<open>A \<longleftrightarrow> B\<close>. End-users normally need not change the @{attribute
   defn} setup.
 
   Definitions may be presented with explicit arguments on the LHS, as well as
   additional conditions, e.g.\ \<open>f x y = t\<close> instead of \<open>f \<equiv> \<lambda>x y. t\<close> and \<open>y \<noteq> 0
   \<Longrightarrow> g x y = u\<close> instead of an unrestricted \<open>g \<equiv> \<lambda>x y. u\<close>.
 
   \<^descr> \<^theory_text>\<open>print_defn_rules\<close> prints the definitional rewrite rules declared via
   @{attribute defn} in the current context.
 
   \<^descr> \<^theory_text>\<open>abbreviation c where eq\<close> introduces a syntactic constant which is
   associated with a certain term according to the meta-level equality \<open>eq\<close>.
 
   Abbreviations participate in the usual type-inference process, but are
   expanded before the logic ever sees them. Pretty printing of terms involves
   higher-order rewriting with rules stemming from reverted abbreviations. This
   needs some care to avoid overlapping or looping syntactic replacements!
 
   The optional \<open>mode\<close> specification restricts output to a particular print
   mode; using ``\<open>input\<close>'' here achieves the effect of one-way abbreviations.
   The mode may also include an ``\<^theory_text>\<open>output\<close>'' qualifier that affects the
   concrete syntax declared for abbreviations, cf.\ \<^theory_text>\<open>syntax\<close> in
   \secref{sec:syn-trans}.
 
   \<^descr> \<^theory_text>\<open>print_abbrevs\<close> prints all constant abbreviations of the current context;
   the ``\<open>!\<close>'' option indicates extra verbosity.
 \<close>
 
 
 section \<open>Axiomatizations \label{sec:axiomatizations}\<close>
 
 text \<open>
   \begin{matharray}{rcll}
     @{command_def "axiomatization"} & : & \<open>theory \<rightarrow> theory\<close> & (axiomatic!) \\
   \end{matharray}
 
   \<^rail>\<open>
     @@{command axiomatization} @{syntax vars}? (@'where' axiomatization)?
     ;
     axiomatization: (@{syntax thmdecl} @{syntax prop} + @'and')
       @{syntax spec_prems} @{syntax for_fixes}
   \<close>
 
   \<^descr> \<^theory_text>\<open>axiomatization c\<^sub>1 \<dots> c\<^sub>m where \<phi>\<^sub>1 \<dots> \<phi>\<^sub>n\<close> introduces several constants
   simultaneously and states axiomatic properties for these. The constants are
   marked as being specified once and for all, which prevents additional
   specifications for the same constants later on, but it is always possible to
   emit axiomatizations without referring to particular constants. Note that
   lack of precise dependency tracking of axiomatizations may disrupt the
   well-formedness of an otherwise definitional theory.
 
   Axiomatization is restricted to a global theory context: support for local
   theory targets \secref{sec:target} would introduce an extra dimension of
   uncertainty what the written specifications really are, and make it
   infeasible to argue why they are correct.
 
   Axiomatic specifications are required when declaring a new logical system
   within Isabelle/Pure, but in an application environment like Isabelle/HOL
   the user normally stays within definitional mechanisms provided by the logic
   and its libraries.
 \<close>
 
 
 section \<open>Generic declarations\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{command_def "declaration"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
     @{command_def "syntax_declaration"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
     @{command_def "declare"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
   \end{matharray}
 
   Arbitrary operations on the background context may be wrapped-up as generic
   declaration elements. Since the underlying concept of local theories may be
   subject to later re-interpretation, there is an additional dependency on a
   morphism that tells the difference of the original declaration context wrt.\
   the application context encountered later on. A fact declaration is an
   important special case: it consists of a theorem which is applied to the
   context by means of an attribute.
 
   \<^rail>\<open>
     (@@{command declaration} | @@{command syntax_declaration})
       ('(' @'pervasive' ')')? \<newline> @{syntax text}
     ;
     @@{command declare} (@{syntax thms} + @'and')
   \<close>
 
   \<^descr> \<^theory_text>\<open>declaration d\<close> adds the declaration function \<open>d\<close> of ML type \<^ML_type>\<open>declaration\<close>, to the current local theory under construction. In later
   application contexts, the function is transformed according to the morphisms
   being involved in the interpretation hierarchy.
 
   If the \<^theory_text>\<open>(pervasive)\<close> option is given, the corresponding declaration is
   applied to all possible contexts involved, including the global background
   theory.
 
   \<^descr> \<^theory_text>\<open>syntax_declaration\<close> is similar to \<^theory_text>\<open>declaration\<close>, but is meant to affect
   only ``syntactic'' tools by convention (such as notation and type-checking
   information).
 
   \<^descr> \<^theory_text>\<open>declare thms\<close> declares theorems to the current local theory context. No
   theorem binding is involved here, unlike \<^theory_text>\<open>lemmas\<close> (cf.\
   \secref{sec:theorems}), so \<^theory_text>\<open>declare\<close> only has the effect of applying
   attributes as included in the theorem specification.
 \<close>
 
 
 section \<open>Locales \label{sec:locale}\<close>
 
 text \<open>
   A locale is a functor that maps parameters (including implicit type
   parameters) and a specification to a list of declarations. The syntax of
   locales is modeled after the Isar proof context commands (cf.\
   \secref{sec:proof-context}).
 
   Locale hierarchies are supported by maintaining a graph of dependencies
   between locale instances in the global theory. Dependencies may be
   introduced through import (where a locale is defined as sublocale of the
   imported instances) or by proving that an existing locale is a sublocale of
   one or several locale instances.
 
   A locale may be opened with the purpose of appending to its list of
   declarations (cf.\ \secref{sec:target}). When opening a locale declarations
   from all dependencies are collected and are presented as a local theory. In
   this process, which is called \<^emph>\<open>roundup\<close>, redundant locale instances are
   omitted. A locale instance is redundant if it is subsumed by an instance
   encountered earlier. A more detailed description of this process is
-  available elsewhere @{cite Ballarin2014}.
+  available elsewhere \<^cite>\<open>Ballarin2014\<close>.
 \<close>
 
 
 subsection \<open>Locale expressions \label{sec:locale-expr}\<close>
 
 text \<open>
   A \<^emph>\<open>locale expression\<close> denotes a context composed of instances of existing
   locales. The context consists of the declaration elements from the locale
   instances. Redundant locale instances are omitted according to roundup.
 
   \<^rail>\<open>
     @{syntax_def locale_expr}: (instance + '+') @{syntax for_fixes}
     ;
     instance: (qualifier ':')? @{syntax name} (pos_insts | named_insts) \<newline>
       rewrites?
     ;
     qualifier: @{syntax name} ('?')?
     ;
     pos_insts: ('_' | @{syntax term})*
     ;
     named_insts: @'where' (@{syntax name} '=' @{syntax term} + @'and')
     ;
     rewrites: @'rewrites' (@{syntax thmdecl}? @{syntax prop} + @'and')
   \<close>
 
   A locale instance consists of a reference to a locale and either positional
   or named parameter instantiations optionally followed by rewrites clauses.
   Identical instantiations (that is, those
   that instantiate a parameter by itself) may be omitted. The notation ``\<open>_\<close>''
   enables to omit the instantiation for a parameter inside a positional
   instantiation.
 
   Terms in instantiations are from the context the locale expressions is
   declared in. Local names may be added to this context with the optional
   \<^theory_text>\<open>for\<close> clause. This is useful for shadowing names bound in outer contexts,
   and for declaring syntax. In addition, syntax declarations from one instance
   are effective when parsing subsequent instances of the same expression.
 
   Instances have an optional qualifier which applies to names in declarations.
   Names include local definitions and theorem names. If present, the qualifier
   itself is either mandatory (default) or non-mandatory (when followed by
   ``\<^verbatim>\<open>?\<close>''). Non-mandatory means that the qualifier may be omitted on input.
   Qualifiers only affect name spaces; they play no role in determining whether
   one locale instance subsumes another.
 
   Rewrite clauses amend instances with equations that act as rewrite rules.
   This is particularly useful for changing concepts introduced through
   definitions. Rewrite clauses are available only in interpretation commands
   (see \secref{sec:locale-interpretation} below) and must be proved the user.
 \<close>
 
 
 subsection \<open>Locale declarations\<close>
 
 text \<open>
   \begin{tabular}{rcl}
     @{command_def "locale"} & : & \<open>theory \<rightarrow> local_theory\<close> \\
     @{command_def "experiment"} & : & \<open>theory \<rightarrow> local_theory\<close> \\
     @{command_def "print_locale"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
     @{command_def "print_locales"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
     @{command_def "locale_deps"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
   \end{tabular}
 
   @{index_ref \<open>\<^theory_text>\<open>fixes\<close> (element)\<close>}
   @{index_ref \<open>\<^theory_text>\<open>constrains\<close> (element)\<close>}
   @{index_ref \<open>\<^theory_text>\<open>assumes\<close> (element)\<close>}
   @{index_ref \<open>\<^theory_text>\<open>defines\<close> (element)\<close>}
   @{index_ref \<open>\<^theory_text>\<open>notes\<close> (element)\<close>}
   \<^rail>\<open>
     @@{command locale} @{syntax name} ('=' @{syntax locale})? @'begin'?
     ;
     @@{command experiment} (@{syntax context_elem}*) @'begin'
     ;
     @@{command print_locale} '!'? @{syntax name}
     ;
     @@{command print_locales} ('!'?)
     ;
     @{syntax_def locale}: @{syntax context_elem}+ |
       @{syntax_ref "opening"} ('+' (@{syntax context_elem}+))? |
       @{syntax locale_expr} @{syntax_ref "opening"}? ('+' (@{syntax context_elem}+))?
     ;
     @{syntax_def context_elem}:
       @'fixes' @{syntax vars} |
       @'constrains' (@{syntax name} '::' @{syntax type} + @'and') |
       @'assumes' (@{syntax props} + @'and') |
       @'defines' (@{syntax thmdecl}? @{syntax prop} @{syntax prop_pat}? + @'and') |
       @'notes' (@{syntax thmdef}? @{syntax thms} + @'and')
   \<close>
 
   \<^descr> \<^theory_text>\<open>locale loc = import opening bundles + body\<close> defines a new locale \<open>loc\<close>
   as a context consisting of a certain view of existing locales (\<open>import\<close>) plus some
   additional elements (\<open>body\<close>) with declaration \<open>bundles\<close> enriching the context
   of the command itself. All \<open>import\<close>, \<open>bundles\<close> and \<open>body\<close> are optional; the
   degenerate form \<^theory_text>\<open>locale loc\<close> defines an empty locale, which may still be
   useful to collect declarations of facts later on. Type-inference on locale
   expressions automatically takes care of the most general typing that the
   combined context elements may acquire.
 
   The \<open>import\<close> consists of a locale expression; see \secref{sec:locale-expr}
   above. Its \<^theory_text>\<open>for\<close> clause defines the parameters of \<open>import\<close>. These are
   parameters of the defined locale. Locale parameters whose instantiation is
   omitted automatically extend the (possibly empty) \<^theory_text>\<open>for\<close> clause: they are
   inserted at its beginning. This means that these parameters may be referred
   to from within the expression and also in the subsequent context elements
   and provides a notational convenience for the inheritance of parameters in
   locale declarations.
 
   Declarations from \<open>bundles\<close>, see \secref{sec:bundle}, are effective in the
   entire command including a subsequent \<^theory_text>\<open>begin\<close> / \<^theory_text>\<open>end\<close> block, but they do
   not contribute to the declarations stored in the locale.
 
   The \<open>body\<close> consists of context elements:
 
     \<^descr> @{element "fixes"}~\<open>x :: \<tau> (mx)\<close> declares a local parameter of type \<open>\<tau>\<close>
     and mixfix annotation \<open>mx\<close> (both are optional). The special syntax
     declaration ``\<open>(\<close>@{keyword_ref "structure"}\<open>)\<close>'' means that \<open>x\<close> may be
     referenced implicitly in this context.
 
     \<^descr> @{element "constrains"}~\<open>x :: \<tau>\<close> introduces a type constraint \<open>\<tau>\<close> on the
     local parameter \<open>x\<close>. This element is deprecated. The type constraint
     should be introduced in the \<^theory_text>\<open>for\<close> clause or the relevant @{element
     "fixes"} element.
 
     \<^descr> @{element "assumes"}~\<open>a: \<phi>\<^sub>1 \<dots> \<phi>\<^sub>n\<close> introduces local premises, similar
     to \<^theory_text>\<open>assume\<close> within a proof (cf.\ \secref{sec:proof-context}).
 
     \<^descr> @{element "defines"}~\<open>a: x \<equiv> t\<close> defines a previously declared parameter.
     This is similar to \<^theory_text>\<open>define\<close> within a proof (cf.\
     \secref{sec:proof-context}), but @{element "defines"} is restricted to
     Pure equalities and the defined variable needs to be declared beforehand
     via @{element "fixes"}. The left-hand side of the equation may have
     additional arguments, e.g.\ ``@{element "defines"}~\<open>f x\<^sub>1 \<dots> x\<^sub>n \<equiv> t\<close>'',
     which need to be free in the context.
 
     \<^descr> @{element "notes"}~\<open>a = b\<^sub>1 \<dots> b\<^sub>n\<close> reconsiders facts within a local
     context. Most notably, this may include arbitrary declarations in any
     attribute specifications included here, e.g.\ a local @{attribute simp}
     rule.
 
   Both @{element "assumes"} and @{element "defines"} elements contribute to
   the locale specification. When defining an operation derived from the
   parameters, \<^theory_text>\<open>definition\<close> (\secref{sec:term-definitions}) is usually more
   appropriate.
 
   Note that ``\<^theory_text>\<open>(is p\<^sub>1 \<dots> p\<^sub>n)\<close>'' patterns given in the syntax of @{element
   "assumes"} and @{element "defines"} above are illegal in locale definitions.
   In the long goal format of \secref{sec:goals}, term bindings may be included
   as expected, though.
 
   \<^medskip>
   Locale specifications are ``closed up'' by turning the given text into a
   predicate definition \<open>loc_axioms\<close> and deriving the original assumptions as
   local lemmas (modulo local definitions). The predicate statement covers only
   the newly specified assumptions, omitting the content of included locale
   expressions. The full cumulative view is only provided on export, involving
   another predicate \<open>loc\<close> that refers to the complete specification text.
 
   In any case, the predicate arguments are those locale parameters that
   actually occur in the respective piece of text. Also these predicates
   operate at the meta-level in theory, but the locale packages attempts to
   internalize statements according to the object-logic setup (e.g.\ replacing
   \<open>\<And>\<close> by \<open>\<forall>\<close>, and \<open>\<Longrightarrow>\<close> by \<open>\<longrightarrow>\<close> in HOL; see also \secref{sec:object-logic}).
   Separate introduction rules \<open>loc_axioms.intro\<close> and \<open>loc.intro\<close> are provided
   as well.
 
   \<^descr> \<^theory_text>\<open>experiment body begin\<close> opens an anonymous locale context with private
   naming policy. Specifications in its body are inaccessible from outside.
   This is useful to perform experiments, without polluting the name space.
 
   \<^descr> \<^theory_text>\<open>print_locale "locale"\<close> prints the contents of the named locale. The
   command omits @{element "notes"} elements by default. Use \<^theory_text>\<open>print_locale!\<close>
   to have them included.
 
   \<^descr> \<^theory_text>\<open>print_locales\<close> prints the names of all locales of the current theory;
   the ``\<open>!\<close>'' option indicates extra verbosity.
 
   \<^descr> \<^theory_text>\<open>locale_deps\<close> visualizes all locales and their relations as a Hasse
   diagram. This includes locales defined as type classes (\secref{sec:class}).
 \<close>
 
 
 subsection \<open>Locale interpretation \label{sec:locale-interpretation}\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{command "interpretation"} & : & \<open>local_theory \<rightarrow> proof(prove)\<close> \\
     @{command_def "interpret"} & : & \<open>proof(state) | proof(chain) \<rightarrow> proof(prove)\<close> \\
     @{command_def "global_interpretation"} & : & \<open>theory | local_theory \<rightarrow> proof(prove)\<close> \\
     @{command_def "sublocale"} & : & \<open>theory | local_theory \<rightarrow> proof(prove)\<close> \\
     @{command_def "print_interps"}\<open>\<^sup>*\<close> & :  & \<open>context \<rightarrow>\<close> \\
     @{method_def intro_locales} & : & \<open>method\<close> \\
     @{method_def unfold_locales} & : & \<open>method\<close> \\
     @{attribute_def trace_locales} & : & \mbox{\<open>attribute\<close> \quad default \<open>false\<close>} \\
   \end{matharray}
 
   Locales may be instantiated, and the resulting instantiated declarations
   added to the current context. This requires proof (of the instantiated
   specification) and is called \<^emph>\<open>locale interpretation\<close>. Interpretation is
   possible within arbitrary local theories (\<^theory_text>\<open>interpretation\<close>), within proof
   bodies (\<^theory_text>\<open>interpret\<close>), into global theories (\<^theory_text>\<open>global_interpretation\<close>) and
   into locales (\<^theory_text>\<open>sublocale\<close>).
 
   \<^rail>\<open>
     @@{command interpretation} @{syntax locale_expr}
     ;
     @@{command interpret} @{syntax locale_expr}
     ;
     @@{command global_interpretation} @{syntax locale_expr} definitions?
     ;
     @@{command sublocale} (@{syntax name} ('<' | '\<subseteq>'))? @{syntax locale_expr} \<newline>
       definitions?
     ;
     @@{command print_interps} @{syntax name}
     ;
 
     definitions: @'defines' (@{syntax thmdecl}? @{syntax name} \<newline>
       @{syntax mixfix}? '=' @{syntax term} + @'and');
   \<close>
 
   The core of each interpretation command is a locale expression \<open>expr\<close>; the
   command generates proof obligations for the instantiated specifications.
   Once these are discharged by the user, instantiated declarations (in
   particular, facts) are added to the context in a post-processing phase, in a
   manner specific to each command.
 
   Interpretation commands are aware of interpretations that are already
   active: post-processing is achieved through a variant of roundup that takes
   interpretations of the current global or local theory into account. In order
   to simplify the proof obligations according to existing interpretations use
   methods @{method intro_locales} or @{method unfold_locales}.
 
   Rewrites clauses \<^theory_text>\<open>rewrites eqns\<close> occur within expressions. They amend the
   morphism through which a locale instance is interpreted with rewrite rules,
   also called rewrite morphisms. This is particularly useful for interpreting
   concepts introduced through definitions. The equations must be proved the
   user. To enable syntax of the instantiated locale within the equation, while
   reading a locale expression, equations of a locale instance are read in a
   temporary context where the instance is already activated. If activation
   fails, typically due to duplicate constant declarations, processing falls
   back to reading the equation first.
 
   Given definitions \<open>defs\<close> produce corresponding definitions in the local
   theory's underlying target \<^emph>\<open>and\<close> amend the morphism with rewrite rules
   stemming from the symmetric of those definitions. Hence these need not be
   proved explicitly the user. Such rewrite definitions are a even more useful
   device for interpreting concepts introduced through definitions, but they
   are only supported for interpretation commands operating in a local theory
   whose implementing target actually supports this.  Note that despite
   the suggestive \<^theory_text>\<open>and\<close> connective, \<open>defs\<close>
   are processed sequentially without mutual recursion.
 
   \<^descr> \<^theory_text>\<open>interpretation expr\<close> interprets \<open>expr\<close> into a local theory
   such that its lifetime is limited to the current context block (e.g. a
   locale or unnamed context). At the closing @{command end} of the block the
   interpretation and its declarations disappear. Hence facts based on
   interpretation can be established without creating permanent links to the
   interpreted locale instances, as would be the case with @{command
   sublocale}.
 
   When used on the level of a global theory, there is no end of a current
   context block, hence \<^theory_text>\<open>interpretation\<close> behaves identically to
   \<^theory_text>\<open>global_interpretation\<close> then.
 
   \<^descr> \<^theory_text>\<open>interpret expr\<close> interprets \<open>expr\<close> into a proof context:
   the interpretation and its declarations disappear when closing the current
   proof block. Note that for \<^theory_text>\<open>interpret\<close> the \<open>eqns\<close> should be explicitly
   universally quantified.
 
   \<^descr> \<^theory_text>\<open>global_interpretation expr defines defs\<close> interprets \<open>expr\<close>
   into a global theory.
 
   When adding declarations to locales, interpreted versions of these
   declarations are added to the global theory for all interpretations in the
   global theory as well. That is, interpretations into global theories
   dynamically participate in any declarations added to locales.
 
   Free variables in the interpreted expression are allowed. They are turned
   into schematic variables in the generated declarations. In order to use a
   free variable whose name is already bound in the context --- for example,
   because a constant of that name exists --- add it to the \<^theory_text>\<open>for\<close> clause.
 
   When used in a nested target, resulting declarations are propagated
   through the whole target stack.
 
   \<^descr> \<^theory_text>\<open>sublocale name \<subseteq> expr defines defs\<close> interprets \<open>expr\<close>
   into the locale \<open>name\<close>. A proof that the specification of \<open>name\<close> implies the
   specification of \<open>expr\<close> is required. As in the localized version of the
   theorem command, the proof is in the context of \<open>name\<close>. After the proof
   obligation has been discharged, the locale hierarchy is changed as if \<open>name\<close>
   imported \<open>expr\<close> (hence the name \<^theory_text>\<open>sublocale\<close>). When the context of \<open>name\<close> is
   subsequently entered, traversing the locale hierarchy will involve the
   locale instances of \<open>expr\<close>, and their declarations will be added to the
   context. This makes \<^theory_text>\<open>sublocale\<close> dynamic: extensions of a locale that is
   instantiated in \<open>expr\<close> may take place after the \<^theory_text>\<open>sublocale\<close> declaration and
   still become available in the context. Circular \<^theory_text>\<open>sublocale\<close> declarations
   are allowed as long as they do not lead to infinite chains.
 
   If interpretations of \<open>name\<close> exist in the current global theory, the command
   adds interpretations for \<open>expr\<close> as well, with the same qualifier, although
   only for fragments of \<open>expr\<close> that are not interpreted in the theory already.
 
   Rewrites clauses in the expression or rewrite definitions \<open>defs\<close> can help break
   infinite chains induced by circular \<^theory_text>\<open>sublocale\<close> declarations.
 
   In a named context block the \<^theory_text>\<open>sublocale\<close> command may also be used, but the
   locale argument must be omitted. The command then refers to the locale (or
   class) target of the context block.
 
   \<^descr> \<^theory_text>\<open>print_interps name\<close> lists all interpretations of locale \<open>name\<close> in the
   current theory or proof context, including those due to a combination of an
   \<^theory_text>\<open>interpretation\<close> or \<^theory_text>\<open>interpret\<close> and one or several \<^theory_text>\<open>sublocale\<close>
   declarations.
 
   \<^descr> @{method intro_locales} and @{method unfold_locales} repeatedly expand all
   introduction rules of locale predicates of the theory. While @{method
   intro_locales} only applies the \<open>loc.intro\<close> introduction rules and therefore
   does not descend to assumptions, @{method unfold_locales} is more aggressive
   and applies \<open>loc_axioms.intro\<close> as well. Both methods are aware of locale
   specifications entailed by the context, both from target statements, and
   from interpretations (see below). New goals that are entailed by the current
   context are discharged automatically.
 
   While @{method unfold_locales} is part of the default method for \<^theory_text>\<open>proof\<close>
   and often invoked ``behind the scenes'', @{method intro_locales} helps
   understand which proof obligations originated from which locale instances.
   The latter method is useful while developing proofs but rare in finished
   developments.
 
   \<^descr> @{attribute trace_locales}, when set to \<open>true\<close>, prints the locale
   instances activated during roundup. Use this when locale commands yield
   obscure errors or for understanding local theories created by complex locale
   hierarchies.
 
   \begin{warn}
     If a global theory inherits declarations (body elements) for a locale from
     one parent and an interpretation of that locale from another parent, the
     interpretation will not be applied to the declarations.
   \end{warn}
 
   \begin{warn}
     Since attributes are applied to interpreted theorems, interpretation may
     modify the context of common proof tools, e.g.\ the Simplifier or
     Classical Reasoner. As the behaviour of such tools is \<^emph>\<open>not\<close> stable under
     interpretation morphisms, manual declarations might have to be added to
     the target context of the interpretation to revert such declarations.
   \end{warn}
 
   \begin{warn}
     An interpretation in a local theory or proof context may subsume previous
     interpretations. This happens if the same specification fragment is
     interpreted twice and the instantiation of the second interpretation is
     more general than the interpretation of the first. The locale package does
     not attempt to remove subsumed interpretations.
   \end{warn}
 
   \begin{warn}
     While \<^theory_text>\<open>interpretation (in c) \<dots>\<close> is admissible, it is not useful since
     its result is discarded immediately.
   \end{warn}
 \<close>
 
 
 section \<open>Classes \label{sec:class}\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{command_def "class"} & : & \<open>theory \<rightarrow> local_theory\<close> \\
     @{command_def "instantiation"} & : & \<open>theory \<rightarrow> local_theory\<close> \\
     @{command_def "instance"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
     @{command "instance"} & : & \<open>theory \<rightarrow> proof(prove)\<close> \\
     @{command_def "subclass"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
     @{command_def "print_classes"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
     @{command_def "class_deps"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
     @{method_def intro_classes} & : & \<open>method\<close> \\
   \end{matharray}
 
   A class is a particular locale with \<^emph>\<open>exactly one\<close> type variable \<open>\<alpha>\<close>. Beyond
   the underlying locale, a corresponding type class is established which is
-  interpreted logically as axiomatic type class @{cite "Wenzel:1997:TPHOL"}
+  interpreted logically as axiomatic type class \<^cite>\<open>"Wenzel:1997:TPHOL"\<close>
   whose logical content are the assumptions of the locale. Thus, classes
   provide the full generality of locales combined with the commodity of type
-  classes (notably type-inference). See @{cite "isabelle-classes"} for a short
+  classes (notably type-inference). See \<^cite>\<open>"isabelle-classes"\<close> for a short
   tutorial.
 
   \<^rail>\<open>
     @@{command class} class_spec @'begin'?
     ;
     class_spec: @{syntax name} '='
       ((@{syntax name} @{syntax_ref "opening"}? '+' (@{syntax context_elem}+)) |
         @{syntax name} @{syntax_ref "opening"}? |
         @{syntax_ref "opening"}? '+' (@{syntax context_elem}+))
     ;
     @@{command instantiation} (@{syntax name} + @'and') '::' @{syntax arity} @'begin'
     ;
     @@{command instance} (() | (@{syntax name} + @'and') '::' @{syntax arity} |
       @{syntax name} ('<' | '\<subseteq>') @{syntax name} )
     ;
     @@{command subclass} @{syntax name}
     ;
     @@{command class_deps} (class_bounds class_bounds?)?
     ;
     class_bounds: @{syntax sort} | '(' (@{syntax sort} + @'|') ')'
   \<close>
 
   \<^descr> \<^theory_text>\<open>class c = superclasses bundles + body\<close> defines a new class \<open>c\<close>, inheriting from
   \<open>superclasses\<close>. This introduces a locale \<open>c\<close> with import of all locales
   \<open>superclasses\<close>.
 
   Any @{element "fixes"} in \<open>body\<close> are lifted to the global theory level
   (\<^emph>\<open>class operations\<close> \<open>f\<^sub>1, \<dots>, f\<^sub>n\<close> of class \<open>c\<close>), mapping the local type
   parameter \<open>\<alpha>\<close> to a schematic type variable \<open>?\<alpha> :: c\<close>.
 
   Likewise, @{element "assumes"} in \<open>body\<close> are also lifted, mapping each local
   parameter \<open>f :: \<tau>[\<alpha>]\<close> to its corresponding global constant \<open>f :: \<tau>[?\<alpha> ::
   c]\<close>. The corresponding introduction rule is provided as
   \<open>c_class_axioms.intro\<close>. This rule should be rarely needed directly --- the
   @{method intro_classes} method takes care of the details of class membership
   proofs.
 
   Optionally given \<open>bundles\<close> take effect in the surface context within the
   \<open>body\<close> and the potentially following \<^theory_text>\<open>begin\<close> / \<^theory_text>\<open>end\<close> block.
 
   \<^descr> \<^theory_text>\<open>instantiation t :: (s\<^sub>1, \<dots>, s\<^sub>n)s begin\<close> opens a target (cf.\
   \secref{sec:target}) which allows to specify class operations \<open>f\<^sub>1, \<dots>, f\<^sub>n\<close>
   corresponding to sort \<open>s\<close> at the particular type instance \<open>(\<alpha>\<^sub>1 :: s\<^sub>1, \<dots>,
   \<alpha>\<^sub>n :: s\<^sub>n) t\<close>. A plain \<^theory_text>\<open>instance\<close> command in the target body poses a goal
   stating these type arities. The target is concluded by an @{command_ref
   (local) "end"} command.
 
   Note that a list of simultaneous type constructors may be given; this
   corresponds nicely to mutually recursive type definitions, e.g.\ in
   Isabelle/HOL.
 
   \<^descr> \<^theory_text>\<open>instance\<close> in an instantiation target body sets up a goal stating the
   type arities claimed at the opening \<^theory_text>\<open>instantiation\<close>. The proof would
   usually proceed by @{method intro_classes}, and then establish the
   characteristic theorems of the type classes involved. After finishing the
   proof, the background theory will be augmented by the proven type arities.
 
   On the theory level, \<^theory_text>\<open>instance t :: (s\<^sub>1, \<dots>, s\<^sub>n)s\<close> provides a convenient
   way to instantiate a type class with no need to specify operations: one can
   continue with the instantiation proof immediately.
 
   \<^descr> \<^theory_text>\<open>subclass c\<close> in a class context for class \<open>d\<close> sets up a goal stating that
   class \<open>c\<close> is logically contained in class \<open>d\<close>. After finishing the proof,
   class \<open>d\<close> is proven to be subclass \<open>c\<close> and the locale \<open>c\<close> is interpreted
   into \<open>d\<close> simultaneously.
 
   A weakened form of this is available through a further variant of @{command
   instance}: \<^theory_text>\<open>instance c\<^sub>1 \<subseteq> c\<^sub>2\<close> opens a proof that class \<open>c\<^sub>2\<close> implies
   \<open>c\<^sub>1\<close> without reference to the underlying locales; this is useful if the
   properties to prove the logical connection are not sufficient on the locale
   level but on the theory level.
 
   \<^descr> \<^theory_text>\<open>print_classes\<close> prints all classes in the current theory.
 
   \<^descr> \<^theory_text>\<open>class_deps\<close> visualizes classes and their subclass relations as a
   directed acyclic graph. By default, all classes from the current theory
   context are show. This may be restricted by optional bounds as follows:
   \<^theory_text>\<open>class_deps upper\<close> or \<^theory_text>\<open>class_deps upper lower\<close>. A class is visualized, iff
   it is a subclass of some sort from \<open>upper\<close> and a superclass of some sort
   from \<open>lower\<close>.
 
   \<^descr> @{method intro_classes} repeatedly expands all class introduction rules of
   this theory. Note that this method usually needs not be named explicitly, as
   it is already included in the default proof step (e.g.\ of \<^theory_text>\<open>proof\<close>). In
   particular, instantiation of trivial (syntactic) classes may be performed by
   a single ``\<^theory_text>\<open>..\<close>'' proof step.
 \<close>
 
 
 subsection \<open>The class target\<close>
 
 text \<open>
   %FIXME check
 
   A named context may refer to a locale (cf.\ \secref{sec:target}). If this
   locale is also a class \<open>c\<close>, apart from the common locale target behaviour
   the following happens.
 
     \<^item> Local constant declarations \<open>g[\<alpha>]\<close> referring to the local type parameter
     \<open>\<alpha>\<close> and local parameters \<open>f[\<alpha>]\<close> are accompanied by theory-level constants
     \<open>g[?\<alpha> :: c]\<close> referring to theory-level class operations \<open>f[?\<alpha> :: c]\<close>.
 
     \<^item> Local theorem bindings are lifted as are assumptions.
 
     \<^item> Local syntax refers to local operations \<open>g[\<alpha>]\<close> and global operations
     \<open>g[?\<alpha> :: c]\<close> uniformly. Type inference resolves ambiguities. In rare
     cases, manual type annotations are needed.
 \<close>
 
 
 subsection \<open>Co-regularity of type classes and arities\<close>
 
 text \<open>
   The class relation together with the collection of type-constructor arities
   must obey the principle of \<^emph>\<open>co-regularity\<close> as defined below.
 
   \<^medskip>
   For the subsequent formulation of co-regularity we assume that the class
   relation is closed by transitivity and reflexivity. Moreover the collection
   of arities \<open>t :: (\<^vec>s)c\<close> is completed such that \<open>t :: (\<^vec>s)c\<close> and
   \<open>c \<subseteq> c'\<close> implies \<open>t :: (\<^vec>s)c'\<close> for all such declarations.
 
   Treating sorts as finite sets of classes (meaning the intersection), the
   class relation \<open>c\<^sub>1 \<subseteq> c\<^sub>2\<close> is extended to sorts as follows:
   \[
     \<open>s\<^sub>1 \<subseteq> s\<^sub>2 \<equiv> \<forall>c\<^sub>2 \<in> s\<^sub>2. \<exists>c\<^sub>1 \<in> s\<^sub>1. c\<^sub>1 \<subseteq> c\<^sub>2\<close>
   \]
 
   This relation on sorts is further extended to tuples of sorts (of the same
   length) in the component-wise way.
 
   \<^medskip>
   Co-regularity of the class relation together with the arities relation
   means:
   \[
     \<open>t :: (\<^vec>s\<^sub>1)c\<^sub>1 \<Longrightarrow> t :: (\<^vec>s\<^sub>2)c\<^sub>2 \<Longrightarrow> c\<^sub>1 \<subseteq> c\<^sub>2 \<Longrightarrow> \<^vec>s\<^sub>1 \<subseteq> \<^vec>s\<^sub>2\<close>
   \]
   for all such arities. In other words, whenever the result classes of some
   type-constructor arities are related, then the argument sorts need to be
   related in the same way.
 
   \<^medskip>
   Co-regularity is a very fundamental property of the order-sorted algebra of
   types. For example, it entails principal types and most general unifiers,
-  e.g.\ see @{cite "nipkow-prehofer"}.
+  e.g.\ see \<^cite>\<open>"nipkow-prehofer"\<close>.
 \<close>
 
 
 section \<open>Overloaded constant definitions \label{sec:overloading}\<close>
 
 text \<open>
   Definitions essentially express abbreviations within the logic. The simplest
   form of a definition is \<open>c :: \<sigma> \<equiv> t\<close>, where \<open>c\<close> is a new constant and \<open>t\<close> is
   a closed term that does not mention \<open>c\<close>. Moreover, so-called \<^emph>\<open>hidden
   polymorphism\<close> is excluded: all type variables in \<open>t\<close> need to occur in its
   type \<open>\<sigma>\<close>.
 
   \<^emph>\<open>Overloading\<close> means that a constant being declared as \<open>c :: \<alpha> decl\<close> may be
   defined separately on type instances \<open>c :: (\<beta>\<^sub>1, \<dots>, \<beta>\<^sub>n)\<kappa> decl\<close> for each
   type constructor \<open>\<kappa>\<close>. At most occasions overloading will be used in a
   Haskell-like fashion together with type classes by means of \<^theory_text>\<open>instantiation\<close>
   (see \secref{sec:class}). Sometimes low-level overloading is desirable; this
   is supported by \<^theory_text>\<open>consts\<close> and \<^theory_text>\<open>overloading\<close> explained below.
 
   The right-hand side of overloaded definitions may mention overloaded
   constants recursively at type instances corresponding to the immediate
   argument types \<open>\<beta>\<^sub>1, \<dots>, \<beta>\<^sub>n\<close>. Incomplete specification patterns impose
   global constraints on all occurrences. E.g.\ \<open>d :: \<alpha> \<times> \<alpha>\<close> on the left-hand
   side means that all corresponding occurrences on some right-hand side need
   to be an instance of this, and general \<open>d :: \<alpha> \<times> \<beta>\<close> will be disallowed. Full
-  details are given by Kun\v{c}ar @{cite "Kuncar:2015"}.
+  details are given by Kun\v{c}ar \<^cite>\<open>"Kuncar:2015"\<close>.
 
   \<^medskip>
   The \<^theory_text>\<open>consts\<close> command and the \<^theory_text>\<open>overloading\<close> target provide a convenient
   interface for end-users. Regular specification elements such as @{command
   definition}, @{command inductive}, @{command function} may be used in the
   body. It is also possible to use \<^theory_text>\<open>consts c :: \<sigma>\<close> with later \<^theory_text>\<open>overloading c
   \<equiv> c :: \<sigma>\<close> to keep the declaration and definition of a constant separate.
 
   \begin{matharray}{rcl}
     @{command_def "consts"} & : & \<open>theory \<rightarrow> theory\<close> \\
     @{command_def "overloading"} & : & \<open>theory \<rightarrow> local_theory\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     @@{command consts} ((@{syntax name} '::' @{syntax type} @{syntax mixfix}?) +)
     ;
     @@{command overloading} ( spec + ) @'begin'
     ;
     spec: @{syntax name} ( '\<equiv>' | '==' ) @{syntax term} ( '(' @'unchecked' ')' )?
   \<close>
 
   \<^descr> \<^theory_text>\<open>consts c :: \<sigma>\<close> declares constant \<open>c\<close> to have any instance of type scheme
   \<open>\<sigma>\<close>. The optional mixfix annotations may attach concrete syntax to the
   constants declared.
 
   \<^descr> \<^theory_text>\<open>overloading x\<^sub>1 \<equiv> c\<^sub>1 :: \<tau>\<^sub>1 \<dots> x\<^sub>n \<equiv> c\<^sub>n :: \<tau>\<^sub>n begin \<dots> end\<close> defines
   a theory target (cf.\ \secref{sec:target}) which allows to specify already
   declared constants via definitions in the body. These are identified by an
   explicitly given mapping from variable names \<open>x\<^sub>i\<close> to constants \<open>c\<^sub>i\<close> at
   particular type instances. The definitions themselves are established using
   common specification tools, using the names \<open>x\<^sub>i\<close> as reference to the
   corresponding constants.
 
   Option \<^theory_text>\<open>(unchecked)\<close> disables global dependency checks for the
   corresponding definition, which is occasionally useful for exotic
   overloading; this is a form of axiomatic specification. It is at the
   discretion of the user to avoid malformed theory specifications!
 \<close>
 
 
 subsubsection \<open>Example\<close>
 
 consts Length :: "'a \<Rightarrow> nat"
 
 overloading
   Length\<^sub>0 \<equiv> "Length :: unit \<Rightarrow> nat"
   Length\<^sub>1 \<equiv> "Length :: 'a \<times> unit \<Rightarrow> nat"
   Length\<^sub>2 \<equiv> "Length :: 'a \<times> 'b \<times> unit \<Rightarrow> nat"
   Length\<^sub>3 \<equiv> "Length :: 'a \<times> 'b \<times> 'c \<times> unit \<Rightarrow> nat"
 begin
 
 fun Length\<^sub>0 :: "unit \<Rightarrow> nat" where "Length\<^sub>0 () = 0"
 fun Length\<^sub>1 :: "'a \<times> unit \<Rightarrow> nat" where "Length\<^sub>1 (a, ()) = 1"
 fun Length\<^sub>2 :: "'a \<times> 'b \<times> unit \<Rightarrow> nat" where "Length\<^sub>2 (a, b, ()) = 2"
 fun Length\<^sub>3 :: "'a \<times> 'b \<times> 'c \<times> unit \<Rightarrow> nat" where "Length\<^sub>3 (a, b, c, ()) = 3"
 
 end
 
 lemma "Length (a, b, c, ()) = 3" by simp
 lemma "Length ((a, b), (c, d), ()) = 2" by simp
 lemma "Length ((a, b, c, d, e), ()) = 1" by simp
 
 
 section \<open>Incorporating ML code \label{sec:ML}\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{command_def "SML_file"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
     @{command_def "SML_file_debug"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
     @{command_def "SML_file_no_debug"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
     @{command_def "ML_file"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
     @{command_def "ML_file_debug"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
     @{command_def "ML_file_no_debug"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
     @{command_def "ML"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
     @{command_def "ML_export"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
     @{command_def "ML_prf"} & : & \<open>proof \<rightarrow> proof\<close> \\
     @{command_def "ML_val"} & : & \<open>any \<rightarrow>\<close> \\
     @{command_def "ML_command"} & : & \<open>any \<rightarrow>\<close> \\
     @{command_def "setup"} & : & \<open>theory \<rightarrow> theory\<close> \\
     @{command_def "local_setup"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
     @{command_def "attribute_setup"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
   \end{matharray}
   \begin{tabular}{rcll}
     @{attribute_def ML_print_depth} & : & \<open>attribute\<close> & default 10 \\
     @{attribute_def ML_source_trace} & : & \<open>attribute\<close> & default \<open>false\<close> \\
     @{attribute_def ML_debugger} & : & \<open>attribute\<close> & default \<open>false\<close> \\
     @{attribute_def ML_exception_trace} & : & \<open>attribute\<close> & default \<open>false\<close> \\
     @{attribute_def ML_exception_debugger} & : & \<open>attribute\<close> & default \<open>false\<close> \\
     @{attribute_def ML_environment} & : & \<open>attribute\<close> & default \<open>Isabelle\<close> \\
   \end{tabular}
 
   \<^rail>\<open>
     (@@{command SML_file} |
       @@{command SML_file_debug} |
       @@{command SML_file_no_debug} |
       @@{command ML_file} |
       @@{command ML_file_debug} |
       @@{command ML_file_no_debug}) @{syntax name} ';'?
     ;
     (@@{command ML} | @@{command ML_export} | @@{command ML_prf} |
       @@{command ML_val} | @@{command ML_command} | @@{command setup} |
       @@{command local_setup}) @{syntax text}
     ;
     @@{command attribute_setup} @{syntax name} '=' @{syntax text} @{syntax text}?
   \<close>
 
   \<^descr> \<^theory_text>\<open>SML_file name\<close> reads and evaluates the given Standard ML file. Top-level
   SML bindings are stored within the (global or local) theory context; the
   initial environment is restricted to the Standard ML implementation of
   Poly/ML, without the many add-ons of Isabelle/ML. Multiple \<^theory_text>\<open>SML_file\<close>
   commands may be used to build larger Standard ML projects, independently of
   the regular Isabelle/ML environment.
 
   \<^descr> \<^theory_text>\<open>ML_file name\<close> reads and evaluates the given ML file. The current theory
   context is passed down to the ML toplevel and may be modified, using \<^ML>\<open>Context.>>\<close> or derived ML commands. Top-level ML bindings are stored
   within the (global or local) theory context.
 
   \<^descr> \<^theory_text>\<open>SML_file_debug\<close>, \<^theory_text>\<open>SML_file_no_debug\<close>, \<^theory_text>\<open>ML_file_debug\<close>, and
   \<^theory_text>\<open>ML_file_no_debug\<close> change the @{attribute ML_debugger} option locally while
   the given file is compiled.
 
   \<^descr> \<^theory_text>\<open>ML\<close> is similar to \<^theory_text>\<open>ML_file\<close>, but evaluates directly the given \<open>text\<close>.
   Top-level ML bindings are stored within the (global or local) theory
   context.
 
   \<^descr> \<^theory_text>\<open>ML_export\<close> is similar to \<^theory_text>\<open>ML\<close>, but the resulting toplevel bindings are
   exported to the global bootstrap environment of the ML process --- it has
   a lasting effect that cannot be retracted. This allows ML evaluation
   without a formal theory context, e.g. for command-line tools via @{tool
-  process} @{cite "isabelle-system"}.
+  process} \<^cite>\<open>"isabelle-system"\<close>.
 
   \<^descr> \<^theory_text>\<open>ML_prf\<close> is analogous to \<^theory_text>\<open>ML\<close> but works within a proof context.
   Top-level ML bindings are stored within the proof context in a purely
   sequential fashion, disregarding the nested proof structure. ML bindings
   introduced by \<^theory_text>\<open>ML_prf\<close> are discarded at the end of the proof.
 
   \<^descr> \<^theory_text>\<open>ML_val\<close> and \<^theory_text>\<open>ML_command\<close> are diagnostic versions of \<^theory_text>\<open>ML\<close>, which means
   that the context may not be updated. \<^theory_text>\<open>ML_val\<close> echos the bindings produced
   at the ML toplevel, but \<^theory_text>\<open>ML_command\<close> is silent.
 
   \<^descr> \<^theory_text>\<open>setup "text"\<close> changes the current theory context by applying \<open>text\<close>,
   which refers to an ML expression of type \<^ML_type>\<open>theory -> theory\<close>. This
   enables to initialize any object-logic specific tools and packages written
   in ML, for example.
 
   \<^descr> \<^theory_text>\<open>local_setup\<close> is similar to \<^theory_text>\<open>setup\<close> for a local theory context, and an
   ML expression of type \<^ML_type>\<open>local_theory -> local_theory\<close>. This allows
   to invoke local theory specification packages without going through concrete
   outer syntax, for example.
 
   \<^descr> \<^theory_text>\<open>attribute_setup name = "text" description\<close> defines an attribute in the
   current context. The given \<open>text\<close> has to be an ML expression of type
   \<^ML_type>\<open>attribute context_parser\<close>, cf.\ basic parsers defined in
   structure \<^ML_structure>\<open>Args\<close> and \<^ML_structure>\<open>Attrib\<close>.
 
   In principle, attributes can operate both on a given theorem and the
   implicit context, although in practice only one is modified and the other
   serves as parameter. Here are examples for these two cases:
 \<close>
 
 (*<*)experiment begin(*>*)
         attribute_setup my_rule =
           \<open>Attrib.thms >> (fn ths =>
             Thm.rule_attribute ths
               (fn context: Context.generic => fn th: thm =>
                 let val th' = th OF ths
                 in th' end))\<close>
 
         attribute_setup my_declaration =
           \<open>Attrib.thms >> (fn ths =>
             Thm.declaration_attribute
               (fn th: thm => fn context: Context.generic =>
                 let val context' = context
                 in context' end))\<close>
 (*<*)end(*>*)
 
 text \<open>
   \<^descr> @{attribute ML_print_depth} controls the printing depth of the ML toplevel
   pretty printer. Typically the limit should be less than 10. Bigger values
   such as 100--1000 are occasionally useful for debugging.
 
   \<^descr> @{attribute ML_source_trace} indicates whether the source text that is
   given to the ML compiler should be output: it shows the raw Standard ML
   after expansion of Isabelle/ML antiquotations.
 
   \<^descr> @{attribute ML_debugger} controls compilation of sources with or without
   debugging information. The global system option @{system_option_ref
   ML_debugger} does the same when building a session image. It is also
   possible use commands like \<^theory_text>\<open>ML_file_debug\<close> etc. The ML debugger is
-  explained further in @{cite "isabelle-jedit"}.
+  explained further in \<^cite>\<open>"isabelle-jedit"\<close>.
 
   \<^descr> @{attribute ML_exception_trace} indicates whether the ML run-time system
   should print a detailed stack trace on exceptions. The result is dependent
   on various ML compiler optimizations. The boundary for the exception trace
   is the current Isar command transactions: it is occasionally better to
   insert the combinator \<^ML>\<open>Runtime.exn_trace\<close> into ML code for debugging
-  @{cite "isabelle-implementation"}, closer to the point where it actually
+  \<^cite>\<open>"isabelle-implementation"\<close>, closer to the point where it actually
   happens.
 
   \<^descr> @{attribute ML_exception_debugger} controls detailed exception trace via
   the Poly/ML debugger, at the cost of extra compile-time and run-time
   overhead. Relevant ML modules need to be compiled beforehand with debugging
   enabled, see @{attribute ML_debugger} above.
 
   \<^descr> @{attribute ML_environment} determines the named ML environment for
   toplevel declarations, e.g.\ in command \<^theory_text>\<open>ML\<close> or \<^theory_text>\<open>ML_file\<close>. The following
   ML environments are predefined in Isabelle/Pure:
 
     \<^item> \<open>Isabelle\<close> for Isabelle/ML. It contains all modules of Isabelle/Pure and
     further add-ons, e.g. material from Isabelle/HOL.
 
     \<^item> \<open>SML\<close> for official Standard ML. It contains only the initial basis
     according to \<^url>\<open>http://sml-family.org/Basis/overview.html\<close>.
 
   The Isabelle/ML function \<^ML>\<open>ML_Env.setup\<close> defines a new ML environment.
   This is useful to incorporate big SML projects in an isolated name space,
   possibly with variations on ML syntax; the existing setup of
   \<^ML>\<open>ML_Env.SML_operations\<close> follows the official standard.
 
   It is also possible to move toplevel bindings between ML environments, using
   a notation with ``\<open>>\<close>'' as separator. For example:
 \<close>
 
 (*<*)experiment begin(*>*)
         declare [[ML_environment = "Isabelle>SML"]]
         ML \<open>val println = writeln\<close>
 
         declare [[ML_environment = "SML"]]
         ML \<open>println "test"\<close>
 
         declare [[ML_environment = "Isabelle"]]
         ML \<open>ML \<open>println\<close> (*bad*) handle ERROR msg => warning msg\<close>
 (*<*)end(*>*)
 
 
 section \<open>Generated files and exported files\<close>
 
 text \<open>
   Write access to the physical file-system is incompatible with the stateless
   model of processing Isabelle documents. To avoid bad effects, the following
   concepts for abstract file-management are provided by Isabelle:
 
     \<^descr>[Generated files] are stored within the theory context in Isabelle/ML.
     This allows to operate on the content in Isabelle/ML, e.g. via the command
     @{command compile_generated_files}.
 
     \<^descr>[Exported files] are stored within the session database in
     Isabelle/Scala. This allows to deliver artefacts to external tools, see
-    also @{cite "isabelle-system"} for session \<^verbatim>\<open>ROOT\<close> declaration
+    also \<^cite>\<open>"isabelle-system"\<close> for session \<^verbatim>\<open>ROOT\<close> declaration
     \<^theory_text>\<open>export_files\<close>, and @{tool build} option \<^verbatim>\<open>-e\<close>.
 
   A notable example is the command @{command_ref export_code}
   (\chref{ch:export-code}): it uses both concepts simultaneously.
 
   File names are hierarchically structured, using a slash as separator. The
   (long) theory name is used as a prefix: the resulting name needs to be
   globally unique.
 
   \begin{matharray}{rcll}
     @{command_def "generate_file"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
     @{command_def "export_generated_files"} & : & \<open>context \<rightarrow>\<close> \\
     @{command_def "compile_generated_files"} & : & \<open>context \<rightarrow>\<close> \\
     @{command_def "external_file"} & : & \<open>any \<rightarrow> any\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     @@{command generate_file} path '=' content
     ;
     path: @{syntax embedded}
     ;
     content: @{syntax embedded}
     ;
     @@{command export_generated_files} (files_in_theory + @'and')
     ;
     files_in_theory: (@'_' | (path+)) (('(' @'in' @{syntax name} ')')?)
     ;
     @@{command compile_generated_files} (files_in_theory + @'and') \<newline>
       (@'external_files' (external_files + @'and'))? \<newline>
       (@'export_files' (export_files + @'and'))? \<newline>
       (@'export_prefix' path)?
     ;
     external_files: (path+) (('(' @'in' path ')')?)
     ;
     export_files: (path+) (executable?)
     ;
     executable: '(' ('exe' | 'executable') ')'
     ;
     @@{command external_file} @{syntax name} ';'?
   \<close>
 
   \<^descr> \<^theory_text>\<open>generate_file path = content\<close> augments the table of generated files
   within the current theory by a new entry: duplicates are not allowed. The
   name extension determines a pre-existent file-type; the \<open>content\<close> is a
   string that is preprocessed according to rules of this file-type.
 
   For example, Isabelle/Pure supports \<^verbatim>\<open>.hs\<close> as file-type for Haskell:
   embedded cartouches are evaluated as Isabelle/ML expressions of type
   \<^ML_type>\<open>string\<close>, the result is inlined in Haskell string syntax.
 
   \<^descr> \<^theory_text>\<open>export_generated_files paths (in thy)\<close> retrieves named generated files
   from the given theory (that needs be reachable via imports of the current
   one). By default, the current theory node is used. Using ``\<^verbatim>\<open>_\<close>''
   (underscore) instead of explicit path names refers to \emph{all} files of a
   theory node.
 
   The overall list of files is prefixed with the respective (long) theory name
   and exported to the session database. In Isabelle/jEdit the result can be
   browsed via the virtual file-system with prefix ``\<^verbatim>\<open>isabelle-export:\<close>''
   (using the regular file-browser).
 
   \<^descr> \<^theory_text>\<open>scala_build_generated_files paths (in thy)\<close> retrieves named generated
   files as for \<^theory_text>\<open>export_generated_files\<close> and writes them into a temporary
   directory, which is taken as starting point for build process of
-  Isabelle/Scala/Java modules (see @{cite "isabelle-system"}). The
+  Isabelle/Scala/Java modules (see \<^cite>\<open>"isabelle-system"\<close>). The
   corresponding @{path \<open>build.props\<close>} file is expected directly in the toplevel
   directory, instead of @{path \<open>etc/build.props\<close>} for Isabelle system
   components. These properties need to specify sources, resources, services
   etc. as usual. The resulting JAR module becomes an export artefact of the
   session database, with a name of the form
   ``\<open>theory\<close>\<^verbatim>\<open>:classpath/\<close>\<open>module\<close>\<^verbatim>\<open>.jar\<close>''.
 
   \<^descr> \<^theory_text>\<open>compile_generated_files paths (in thy) where compile_body\<close> retrieves
   named generated files as for \<^theory_text>\<open>export_generated_files\<close> and writes them into
   a temporary directory, such that the \<open>compile_body\<close> may operate on them as
   an ML function of type \<^ML_type>\<open>Path.T -> unit\<close>. This may create further
   files, e.g.\ executables produced by a compiler that is invoked as external
   process (e.g.\ via \<^ML>\<open>Isabelle_System.bash\<close>), or any other files.
 
   The option ``\<^theory_text>\<open>external_files paths (in base_dir)\<close>'' copies files from the
   physical file-system into the temporary directory, \emph{before} invoking
   \<open>compile_body\<close>. The \<open>base_dir\<close> prefix is removed from each of the \<open>paths\<close>,
   but the remaining sub-directory structure is reconstructed in the target
   directory.
 
   The option ``\<^theory_text>\<open>export_files paths\<close>'' exports the specified files from the
   temporary directory to the session database, \emph{after} invoking
   \<open>compile_body\<close>. Entries may be decorated with ``\<^theory_text>\<open>(exe)\<close>'' to say that it is
   a platform-specific executable program: the executable file-attribute will
   be set, and on Windows the \<^verbatim>\<open>.exe\<close> file-extension will be included;
   ``\<^theory_text>\<open>(executable)\<close>'' only refers to the file-attribute, without special
   treatment of the \<^verbatim>\<open>.exe\<close> extension.
 
   The option ``\<^theory_text>\<open>export_prefix path\<close>'' specifies an extra path prefix for all
   exports of \<^theory_text>\<open>export_files\<close> above.
 
   \<^descr> \<^theory_text>\<open>external_file name\<close> declares the formal dependency on the given file
-  name, such that the Isabelle build process knows about it (see also @{cite
-  "isabelle-system"}). This is required for any files mentioned in
+  name, such that the Isabelle build process knows about it (see also \<^cite>\<open>"isabelle-system"\<close>). This is required for any files mentioned in
   \<^theory_text>\<open>compile_generated_files / external_files\<close> above, in order to document
   source dependencies properly. It is also possible to use \<^theory_text>\<open>external_file\<close>
   alone, e.g.\ when other Isabelle/ML tools use \<^ML>\<open>File.read\<close>, without
   specific management of content by the Prover IDE.
 \<close>
 
 
 section \<open>Primitive specification elements\<close>
 
 subsection \<open>Sorts\<close>
 
 text \<open>
   \begin{matharray}{rcll}
     @{command_def "default_sort"} & : & \<open>local_theory \<rightarrow> local_theory\<close>
   \end{matharray}
 
   \<^rail>\<open>
     @@{command default_sort} @{syntax sort}
   \<close>
 
   \<^descr> \<^theory_text>\<open>default_sort s\<close> makes sort \<open>s\<close> the new default sort for any type
   variable that is given explicitly in the text, but lacks a sort constraint
   (wrt.\ the current context). Type variables generated by type inference are
   not affected.
 
   Usually the default sort is only changed when defining a new object-logic.
   For example, the default sort in Isabelle/HOL is \<^class>\<open>type\<close>, the class of
   all HOL types.
 
   When merging theories, the default sorts of the parents are logically
   intersected, i.e.\ the representations as lists of classes are joined.
 \<close>
 
 
 subsection \<open>Types \label{sec:types-pure}\<close>
 
 text \<open>
   \begin{matharray}{rcll}
     @{command_def "type_synonym"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
     @{command_def "typedecl"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     @@{command type_synonym} (@{syntax typespec} '=' @{syntax type} @{syntax mixfix}?)
     ;
     @@{command typedecl} @{syntax typespec} @{syntax mixfix}?
   \<close>
 
   \<^descr> \<^theory_text>\<open>type_synonym (\<alpha>\<^sub>1, \<dots>, \<alpha>\<^sub>n) t = \<tau>\<close> introduces a \<^emph>\<open>type synonym\<close> \<open>(\<alpha>\<^sub>1, \<dots>,
   \<alpha>\<^sub>n) t\<close> for the existing type \<open>\<tau>\<close>. Unlike the semantic type definitions in
   Isabelle/HOL, type synonyms are merely syntactic abbreviations without any
   logical significance. Internally, type synonyms are fully expanded.
 
   \<^descr> \<^theory_text>\<open>typedecl (\<alpha>\<^sub>1, \<dots>, \<alpha>\<^sub>n) t\<close> declares a new type constructor \<open>t\<close>. If the
   object-logic defines a base sort \<open>s\<close>, then the constructor is declared to
   operate on that, via the axiomatic type-class instance \<open>t :: (s, \<dots>, s)s\<close>.
 
 
   \begin{warn}
     If you introduce a new type axiomatically, i.e.\ via @{command_ref
     typedecl} and @{command_ref axiomatization}
     (\secref{sec:axiomatizations}), the minimum requirement is that it has a
     non-empty model, to avoid immediate collapse of the logical environment.
     Moreover, one needs to demonstrate that the interpretation of such
     free-form axiomatizations can coexist with other axiomatization schemes
     for types, notably @{command_def typedef} in Isabelle/HOL
     (\secref{sec:hol-typedef}), or any other extension that people might have
     introduced elsewhere.
   \end{warn}
 \<close>
 
 
 section \<open>Naming existing theorems \label{sec:theorems}\<close>
 
 text \<open>
   \begin{matharray}{rcll}
     @{command_def "lemmas"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
     @{command_def "named_theorems"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     @@{command lemmas} (@{syntax thmdef}? @{syntax thms} + @'and')
       @{syntax for_fixes}
     ;
     @@{command named_theorems} (@{syntax name} @{syntax text}? + @'and')
   \<close>
 
   \<^descr> \<^theory_text>\<open>lemmas a = b\<^sub>1 \<dots> b\<^sub>n\<close>~@{keyword_def "for"}~\<open>x\<^sub>1 \<dots> x\<^sub>m\<close> evaluates given
   facts (with attributes) in the current context, which may be augmented by
   local variables. Results are standardized before being stored, i.e.\
   schematic variables are renamed to enforce index \<open>0\<close> uniformly.
 
   \<^descr> \<^theory_text>\<open>named_theorems name description\<close> declares a dynamic fact within the
   context. The same \<open>name\<close> is used to define an attribute with the usual
   \<open>add\<close>/\<open>del\<close> syntax (e.g.\ see \secref{sec:simp-rules}) to maintain the
   content incrementally, in canonical declaration order of the text structure.
 \<close>
 
 
 section \<open>Oracles \label{sec:oracles}\<close>
 
 text \<open>
   \begin{matharray}{rcll}
     @{command_def "oracle"} & : & \<open>theory \<rightarrow> theory\<close> & (axiomatic!) \\
     @{command_def "thm_oracles"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
   \end{matharray}
 
   Oracles allow Isabelle to take advantage of external reasoners such as
   arithmetic decision procedures, model checkers, fast tautology checkers or
   computer algebra systems. Invoked as an oracle, an external reasoner can
   create arbitrary Isabelle theorems.
 
   It is the responsibility of the user to ensure that the external reasoner is
   as trustworthy as the application requires. Another typical source of errors
   is the linkup between Isabelle and the external tool, not just its concrete
   implementation, but also the required translation between two different
   logical environments.
 
   Isabelle merely guarantees well-formedness of the propositions being
   asserted, and records within the internal derivation object how presumed
   theorems depend on unproven suppositions. This also includes implicit
   type-class reasoning via the order-sorted algebra of class relations and
   type arities (see also @{command_ref instantiation} and @{command_ref
   instance}).
 
   \<^rail>\<open>
     @@{command oracle} @{syntax name} '=' @{syntax text}
     ;
     @@{command thm_oracles} @{syntax thms}
   \<close>
 
   \<^descr> \<^theory_text>\<open>oracle name = "text"\<close> turns the given ML expression \<open>text\<close> of type
   \<^ML_text>\<open>'a -> cterm\<close> into an ML function of type \<^ML_text>\<open>'a -> thm\<close>,
   which is bound to the global identifier \<^ML_text>\<open>name\<close>. This acts like an
   infinitary specification of axioms! Invoking the oracle only works within
   the scope of the resulting theory.
 
   See \<^file>\<open>~~/src/HOL/Examples/Iff_Oracle.thy\<close> for a worked example of defining
   a new primitive rule as oracle, and turning it into a proof method.
 
   \<^descr> \<^theory_text>\<open>thm_oracles thms\<close> displays all oracles used in the internal derivation
   of the given theorems; this covers the full graph of transitive
   dependencies.
 \<close>
 
 
 section \<open>Name spaces\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{command_def "alias"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
     @{command_def "type_alias"} & : & \<open>local_theory \<rightarrow> local_theory\<close> \\
     @{command_def "hide_class"} & : & \<open>theory \<rightarrow> theory\<close> \\
     @{command_def "hide_type"} & : & \<open>theory \<rightarrow> theory\<close> \\
     @{command_def "hide_const"} & : & \<open>theory \<rightarrow> theory\<close> \\
     @{command_def "hide_fact"} & : & \<open>theory \<rightarrow> theory\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     (@{command alias} | @{command type_alias}) @{syntax name} '=' @{syntax name}
     ;
     (@{command hide_class} | @{command hide_type} |
       @{command hide_const} | @{command hide_fact}) ('(' @'open' ')')? (@{syntax name} + )
   \<close>
 
   Isabelle organizes any kind of name declarations (of types, constants,
   theorems etc.) by separate hierarchically structured name spaces. Normally
   the user does not have to control the behaviour of name spaces by hand, yet
   the following commands provide some way to do so.
 
   \<^descr> \<^theory_text>\<open>alias\<close> and \<^theory_text>\<open>type_alias\<close> introduce aliases for constants and type
   constructors, respectively. This allows adhoc changes to name-space
   accesses.
 
   \<^descr> \<^theory_text>\<open>type_alias b = c\<close> introduces an alias for an existing type constructor.
 
   \<^descr> \<^theory_text>\<open>hide_class names\<close> fully removes class declarations from a given name
   space; with the \<open>(open)\<close> option, only the unqualified base name is hidden.
 
   Note that hiding name space accesses has no impact on logical declarations
   --- they remain valid internally. Entities that are no longer accessible to
   the user are printed with the special qualifier ``\<open>??\<close>'' prefixed to the
   full internal name.
 
   \<^descr> \<^theory_text>\<open>hide_type\<close>, \<^theory_text>\<open>hide_const\<close>, and \<^theory_text>\<open>hide_fact\<close> are similar to
   \<^theory_text>\<open>hide_class\<close>, but hide types, constants, and facts, respectively.
 \<close>
 
 end
diff --git a/src/Doc/JEdit/JEdit.thy b/src/Doc/JEdit/JEdit.thy
--- a/src/Doc/JEdit/JEdit.thy
+++ b/src/Doc/JEdit/JEdit.thy
@@ -1,2246 +1,2236 @@
 (*:maxLineLen=78:*)
 
 theory JEdit
 imports Base
 begin
 
 chapter \<open>Introduction\<close>
 
 section \<open>Concepts and terminology\<close>
 
 text \<open>
   Isabelle/jEdit is a Prover IDE that integrates \<^emph>\<open>parallel proof checking\<close>
-  @{cite "Wenzel:2009" and "Wenzel:2013:ITP"} with \<^emph>\<open>asynchronous user
-  interaction\<close> @{cite "Wenzel:2010" and "Wenzel:2012:UITP-EPTCS" and
-  "Wenzel:2014:ITP-PIDE" and "Wenzel:2014:UITP"}, based on a document-oriented
-  approach to \<^emph>\<open>continuous proof processing\<close> @{cite "Wenzel:2011:CICM" and
-  "Wenzel:2012" and "Wenzel:2018:FIDE" and "Wenzel:2019:MKM"}. Many concepts
+  \<^cite>\<open>"Wenzel:2009" and "Wenzel:2013:ITP"\<close> with \<^emph>\<open>asynchronous user
+  interaction\<close> \<^cite>\<open>"Wenzel:2010" and "Wenzel:2012:UITP-EPTCS" and
+  "Wenzel:2014:ITP-PIDE" and "Wenzel:2014:UITP"\<close>, based on a document-oriented
+  approach to \<^emph>\<open>continuous proof processing\<close> \<^cite>\<open>"Wenzel:2011:CICM" and
+  "Wenzel:2012" and "Wenzel:2018:FIDE" and "Wenzel:2019:MKM"\<close>. Many concepts
   and system components are fit together in order to make this work. The main
   building blocks are as follows.
 
     \<^descr>[Isabelle/ML] is the implementation and extension language of Isabelle,
-    see also @{cite "isabelle-implementation"}. It is integrated into the
+    see also \<^cite>\<open>"isabelle-implementation"\<close>. It is integrated into the
     logical context of Isabelle/Isar and allows to manipulate logical entities
     directly. Arbitrary add-on tools may be implemented for object-logics such
     as Isabelle/HOL.
 
     \<^descr>[Isabelle/Scala] is the system programming language of Isabelle. It
     extends the pure logical environment of Isabelle/ML towards the outer
     world of graphical user interfaces, text editors, IDE frameworks, web
     services, SSH servers, SQL databases etc. Both Scala and ML provide
     library modules to support formatted text with formal markup, and to
     encode/decode algebraic datatypes. Scala communicates with ML via
     asynchronous protocol commands; from the ML perspective this is wrapped up
     as synchronous function call (RPC).
 
     \<^descr>[PIDE] is a general framework for Prover IDEs based on Isabelle/Scala. It
     is built around a concept of parallel and asynchronous document
     processing, which is supported natively by the parallel proof engine that
     is implemented in Isabelle/ML. The traditional prover command loop is
     given up; instead there is direct support for editing of source text, with
     rich formal markup for GUI rendering.
 
     \<^descr>[jEdit] is a sophisticated text editor\<^footnote>\<open>\<^url>\<open>http://www.jedit.org\<close>\<close>
     implemented in Java\<^footnote>\<open>\<^url>\<open>https://openjdk.java.net\<close>\<close>. The editor is easily
     extensible by plugins written in any language that works on the JVM. In
     the context of Isabelle this is usually
     Scala\<^footnote>\<open>\<^url>\<open>https://www.scala-lang.org\<close>\<close>.
 
     \<^descr>[Isabelle/jEdit] is the main application of the PIDE framework and the
     default user-interface for Isabelle. It targets both beginners and
     experts. Technically, Isabelle/jEdit consists of the original jEdit code
     base with minimal patches and a special plugin for Isabelle. This is
     integrated as a desktop application for the main operating system
     families: Linux, Windows, macOS.
 
   End-users of Isabelle download and run a standalone application that exposes
   jEdit as a text editor on the surface. Thus there is occasionally a tendency
   to apply the name ``jEdit'' to any of the Isabelle Prover IDE aspects,
   without proper differentiation. When discussing these PIDE building blocks
   in public forums, mailing lists, or even scientific publications, it is
   particularly important to distinguish Isabelle/ML versus Standard ML,
   Isabelle/Scala versus Scala, Isabelle/jEdit versus jEdit.
 \<close>
 
 
 section \<open>The Isabelle/jEdit Prover IDE\<close>
 
 text \<open>
   \begin{figure}[!htb]
   \begin{center}
   \includegraphics[width=\textwidth]{isabelle-jedit}
   \end{center}
   \caption{The Isabelle/jEdit Prover IDE}
   \label{fig:isabelle-jedit}
   \end{figure}
 
   Isabelle/jEdit (\figref{fig:isabelle-jedit}) consists of some plugins for
   the jEdit text editor, while preserving its overall look-and-feel. The main
   plugin is called ``Isabelle'' and has its own menu \<^emph>\<open>Plugins~/ Isabelle\<close>
   with access to several actions and add-on panels (see also
   \secref{sec:dockables}), as well as \<^emph>\<open>Plugins~/ Plugin Options~/ Isabelle\<close>
   (see also \secref{sec:options}).
 
   The options allow to specify a logic session name, but the same selector is
   also accessible in the \<^emph>\<open>Theories\<close> panel (\secref{sec:theories}). After
   startup of the Isabelle plugin, the selected logic session image is provided
-  automatically by the Isabelle build tool @{cite "isabelle-system"}: if it is
+  automatically by the Isabelle build tool \<^cite>\<open>"isabelle-system"\<close>: if it is
   absent or outdated wrt.\ its sources, the build process updates it within
   the running text editor. Prover IDE functionality is fully activated after
   successful termination of the build process. A failure may require changing
   some options and restart of the Isabelle plugin or application. Changing the
   logic session requires a restart of the whole application to take effect.
 
   \<^medskip> The main job of the Prover IDE is to manage sources and their changes,
   taking the logical structure as a formal document into account (see also
   \secref{sec:document-model}). The editor and the prover are connected
   asynchronously without locking. The prover is free to organize the checking
   of the formal text in parallel on multiple cores, and provides feedback via
   markup, which is rendered in the editor via colors, boxes, squiggly
   underlines, hyperlinks, popup windows, icons, clickable output etc.
 
   Using the mouse together with the modifier key \<^verbatim>\<open>CONTROL\<close> (Linux, Windows)
   or \<^verbatim>\<open>COMMAND\<close> (macOS) exposes formal content via tooltips and/or
   hyperlinks (see also \secref{sec:tooltips-hyperlinks}). Output (in popups
   etc.) may be explored recursively, using the same techniques as in the
   editor source buffer.
 
   Thus the Prover IDE gives an impression of direct access to formal content
   of the prover within the editor, but in reality only certain aspects are
   exposed, according to the possibilities of the prover and its add-on tools.
 \<close>
 
 
 subsection \<open>Documentation\<close>
 
 text \<open>
   The \<^emph>\<open>Documentation\<close> panel of Isabelle/jEdit provides access to some example
   theory files and the standard Isabelle documentation. PDF files are opened
   by regular desktop operations of the underlying platform. The section
   ``Original jEdit Documentation'' contains the original \<^emph>\<open>User's Guide\<close> of
   this sophisticated text editor. The same is accessible via the \<^verbatim>\<open>Help\<close> menu
   or \<^verbatim>\<open>F1\<close> keyboard shortcut, using the built-in HTML viewer of Java/Swing.
   The latter also includes \<^emph>\<open>Frequently Asked Questions\<close> and documentation of
   individual plugins.
 
   Most of the information about jEdit is relevant for Isabelle/jEdit as well,
   but users need to keep in mind that defaults sometimes differ, and the
   official jEdit documentation does not know about the Isabelle plugin with
   its support for continuous checking of formal source text: jEdit is a plain
   text editor, but Isabelle/jEdit is a Prover IDE.
 \<close>
 
 
 subsection \<open>Plugins\<close>
 
 text \<open>
   The \<^emph>\<open>Plugin Manager\<close> of jEdit allows to augment editor functionality by JVM
   modules (jars) that are provided by the central plugin repository, which is
   accessible via various mirror sites.
 
   Connecting to the plugin server-infrastructure of the jEdit project allows
   to update bundled plugins or to add further functionality. This needs to be
   done with the usual care for such an open bazaar of contributions. Arbitrary
   combinations of add-on features are apt to cause problems. It is advisable
   to start with the default configuration of Isabelle/jEdit and develop a
   sense how it is meant to work, before loading too many other plugins.
 
   \<^medskip>
   The \<^emph>\<open>Isabelle\<close> plugin is responsible for the main Prover IDE functionality
   of Isabelle/jEdit: it manages the prover session in the background. A few
   additional plugins are bundled with Isabelle/jEdit for convenience or out of
   necessity, notably \<^emph>\<open>Console\<close> with its \<^emph>\<open>Scala\<close> sub-plugin
   (\secref{sec:scala-console}) and \<^emph>\<open>SideKick\<close> with some Isabelle-specific
   parsers for document tree structure (\secref{sec:sidekick}). The
   \<^emph>\<open>Navigator\<close> plugin is particularly important for hyperlinks within the
   formal document-model (\secref{sec:tooltips-hyperlinks}). Further plugins
   (e.g.\ \<^emph>\<open>ErrorList\<close>, \<^emph>\<open>Code2HTML\<close>) are included to saturate the dependencies
   of bundled plugins, but have no particular use in Isabelle/jEdit.
 \<close>
 
 
 subsection \<open>Options \label{sec:options}\<close>
 
 text \<open>
   Both jEdit and Isabelle have distinctive management of persistent options.
 
   Regular jEdit options are accessible via the dialogs \<^emph>\<open>Utilities~/ Global
   Options\<close> or \<^emph>\<open>Plugins~/ Plugin Options\<close>, with a second chance to flip the
   two within the central options dialog. Changes are stored in
   \<^path>\<open>$JEDIT_SETTINGS/properties\<close> and \<^path>\<open>$JEDIT_SETTINGS/keymaps\<close>.
 
   Isabelle system options are managed by Isabelle/Scala and changes are stored
   in \<^path>\<open>$ISABELLE_HOME_USER/etc/preferences\<close>, independently of
-  other jEdit properties. See also @{cite "isabelle-system"}, especially the
+  other jEdit properties. See also \<^cite>\<open>"isabelle-system"\<close>, especially the
   coverage of sessions and command-line tools like @{tool build} or @{tool
   options}.
 
   Those Isabelle options that are declared as \<^verbatim>\<open>public\<close> are configurable in
   Isabelle/jEdit via \<^emph>\<open>Plugin Options~/ Isabelle~/ General\<close>. Moreover, there
   are various options for rendering document content, which are configurable
   via \<^emph>\<open>Plugin Options~/ Isabelle~/ Rendering\<close>. Thus \<^emph>\<open>Plugin Options~/
   Isabelle\<close> in jEdit provides a view on a subset of Isabelle system options.
   Note that some of these options affect general parameters that are relevant
   outside Isabelle/jEdit as well, e.g.\ @{system_option threads} or
-  @{system_option parallel_proofs} for the Isabelle build tool @{cite
-  "isabelle-system"}, but it is possible to use the settings variable
+  @{system_option parallel_proofs} for the Isabelle build tool \<^cite>\<open>"isabelle-system"\<close>, but it is possible to use the settings variable
   @{setting ISABELLE_BUILD_OPTIONS} to change defaults for batch builds
   without affecting the Prover IDE.
 
   The jEdit action @{action_def isabelle.options} opens the options dialog for
   the Isabelle plugin; it can be mapped to editor GUI elements as usual.
 
   \<^medskip>
   Options are usually loaded on startup and saved on shutdown of
   Isabelle/jEdit. Editing the generated \<^path>\<open>$JEDIT_SETTINGS/properties\<close>
   or \<^path>\<open>$ISABELLE_HOME_USER/etc/preferences\<close> manually while the
   application is running may cause lost updates!
 \<close>
 
 
 subsection \<open>Keymaps\<close>
 
 text \<open>
   Keyboard shortcuts are managed as a separate concept of \<^emph>\<open>keymap\<close> that is
   configurable via \<^emph>\<open>Global Options~/ Shortcuts\<close>. The \<^verbatim>\<open>imported\<close> keymap is
   derived from the initial environment of properties that is available at the
   first start of the editor; afterwards the keymap file takes precedence and
   is no longer affected by change of default properties.
 
   Users may modify their keymap later, but this can lead to conflicts with
   \<^verbatim>\<open>shortcut\<close> properties in \<^file>\<open>$JEDIT_HOME/properties/jEdit.props\<close>.
 
   The action @{action_def "isabelle.keymap-merge"} helps to resolve pending
   Isabelle keymap changes wrt. the current jEdit keymap; non-conflicting
   changes are applied implicitly. This action is automatically invoked on
   Isabelle/jEdit startup.
 \<close>
 
 
 section \<open>Command-line invocation \label{sec:command-line}\<close>
 
 text \<open>
   Isabelle/jEdit is normally invoked as a single-instance desktop application,
   based on platform-specific executables for Linux, Windows, macOS.
 
   It is also possible to invoke the Prover IDE on the command-line, with some
   extra options and environment settings. The command-line usage of @{tool_def
   jedit} is as follows:
   @{verbatim [display]
 \<open>Usage: isabelle jedit [OPTIONS] [FILES ...]
 
   Options are:
     -A NAME      ancestor session for option -R (default: parent)
     -D NAME=X    set JVM system property
     -J OPTION    add JVM runtime option
                  (default $JEDIT_JAVA_SYSTEM_OPTIONS $JEDIT_JAVA_OPTIONS)
     -R NAME      build image with requirements from other sessions
     -b           build only
     -d DIR       include session directory
     -f           fresh build
     -i NAME      include session in name-space of theories
     -j OPTION    add jEdit runtime option
                  (default $JEDIT_OPTIONS)
     -l NAME      logic image name
     -m MODE      add print mode for output
     -n           no build of session image on startup
     -p CMD       ML process command prefix (process policy)
     -s           system build mode for session image (system_heaps=true)
     -u           user build mode for session image (system_heaps=false)
 
   Start jEdit with Isabelle plugin setup and open FILES
   (default "$USER_HOME/Scratch.thy" or ":" for empty buffer).\<close>}
 
   The \<^verbatim>\<open>-l\<close> option specifies the session name of the logic image to be used
   for proof processing. Additional session root directories may be included
-  via option \<^verbatim>\<open>-d\<close> to augment the session name space (see also @{cite
-  "isabelle-system"}). By default, the specified image is checked and built on
+  via option \<^verbatim>\<open>-d\<close> to augment the session name space (see also \<^cite>\<open>"isabelle-system"\<close>). By default, the specified image is checked and built on
   demand, but option \<^verbatim>\<open>-n\<close> bypasses the implicit build process for the
   selected session image. Options \<^verbatim>\<open>-s\<close> and \<^verbatim>\<open>-u\<close> override the default system
   option @{system_option system_heaps}: this determines where to store the
   session image of @{tool build}.
 
   The \<^verbatim>\<open>-R\<close> option builds an auxiliary logic image with all theories from
   other sessions that are not already present in its parent; it also opens the
   session \<^verbatim>\<open>ROOT\<close> entry in the editor to facilitate editing of the main
   session. The \<^verbatim>\<open>-A\<close> option specifies and alternative ancestor session for
   option \<^verbatim>\<open>-R\<close>: this allows to restructure the hierarchy of session images on
   the spot. Options \<^verbatim>\<open>-R\<close> and \<^verbatim>\<open>-l\<close> are mutually exclusive.
 
   The \<^verbatim>\<open>-i\<close> option includes additional sessions into the name-space of
   theories: multiple occurrences are possible.
 
   The \<^verbatim>\<open>-m\<close> option specifies additional print modes for the prover process.
   Note that the system option @{system_option_ref jedit_print_mode} allows to
   do the same persistently (e.g.\ via the \<^emph>\<open>Plugin Options\<close> dialog of
   Isabelle/jEdit), without requiring command-line invocation.
 
   The \<^verbatim>\<open>-J\<close> and \<^verbatim>\<open>-j\<close> options pass additional low-level options to the JVM or
   jEdit, respectively. The defaults are provided by the Isabelle settings
-  environment @{cite "isabelle-system"}, but note that these only work for the
+  environment \<^cite>\<open>"isabelle-system"\<close>, but note that these only work for the
   command-line tool described here, and not the desktop application.
 
   The \<^verbatim>\<open>-D\<close> option allows to define JVM system properties; this is passed
   directly to the underlying \<^verbatim>\<open>java\<close> process.
 
   The \<^verbatim>\<open>-b\<close> and \<^verbatim>\<open>-f\<close> options control the self-build mechanism of
   Isabelle/Scala/PIDE/jEdit. This is only relevant for building from sources,
   the official Isabelle release already includes a pre-built version of
   Isabelle/jEdit.
 
   \<^bigskip>
   It is also possible to connect to an already running Isabelle/jEdit process
   via @{tool_def jedit_client}:
   @{verbatim [display]
 \<open>Usage: isabelle jedit_client [OPTIONS] [FILES ...]
 
   Options are:
     -c           only check presence of server
     -n           only report server name
     -s NAME      server name (default "Isabelle")
 
   Connect to already running Isabelle/jEdit instance and open FILES\<close>}
 
   The \<^verbatim>\<open>-c\<close> option merely checks the presence of the server, producing a
   process return-code.
 
   The \<^verbatim>\<open>-n\<close> option reports the server name, and the \<^verbatim>\<open>-s\<close> option provides a
   different server name. The default server name is the official distribution
   name (e.g.\ \<^verbatim>\<open>Isabelle2022\<close>). Thus @{tool jedit_client} can connect to the
   Isabelle desktop application without further options.
 
   The \<^verbatim>\<open>-p\<close> option allows to override the implicit default of the system
   option @{system_option_ref ML_process_policy} for ML processes started by
   the Prover IDE, e.g. to control CPU affinity on multiprocessor systems.
 
   The JVM system property \<^verbatim>\<open>isabelle.jedit_server\<close> provides a different server
   name, e.g.\ use \<^verbatim>\<open>isabelle jedit -Disabelle.jedit_server=\<close>\<open>name\<close> and
   \<^verbatim>\<open>isabelle jedit_client -s\<close>~\<open>name\<close> to connect later on.
 \<close>
 
 
 section \<open>GUI rendering\<close>
 
 text \<open>
   Isabelle/jEdit is a classic Java/AWT/Swing application: its GUI rendering
   usually works well, but there are technical side-conditions on the Java
   window system and graphics engine. When researching problems and solutions
   on the Web, it often helps to include other well-known Swing applications,
   notably IntelliJ IDEA and Netbeans.
 \<close>
 
 
 subsection \<open>Portable and scalable look-and-feel\<close>
 
 text \<open>
   In the past, \<^emph>\<open>system look-and-feels\<close> tried hard to imitate native GUI
   elements on specific platforms (Windows, macOS/Aqua, Linux/GTK+), but many
   technical problems have accumulated in recent years (e.g.\ see
   \secref{sec:problems}).
 
   In 2021, we are de-facto back to \<^emph>\<open>portable look-and-feels\<close>, which also
   happen to be \emph{scalable} on high-resolution displays:
 
     \<^item> \<^verbatim>\<open>FlatLaf Light\<close> is the default for Isabelle/jEdit on all platforms. It
     generally looks good and adapts itself pretty well to high-resolution
     displays.
 
     \<^item> \<^verbatim>\<open>FlatLaf Dark\<close> is an alternative, but it requires further changes of
     editor colors by the user (or by the jEdit plugin \<^verbatim>\<open>Editor Scheme\<close>). Also
     note that Isabelle/PIDE has its own extensive set of rendering options
     that need to be revisited.
 
     \<^item> \<^verbatim>\<open>Metal\<close> still works smoothly, although it is stylistically outdated. It
     can accommodate high-resolution displays via font properties (see below).
 
   Changing the look-and-feel in \<^emph>\<open>Global Options~/ Appearance\<close> often updates
   the GUI only partially: a full restart of Isabelle/jEdit is required to see
   the true effect.
 \<close>
 
 
 subsection \<open>Adjusting fonts\<close>
 
 text \<open>
   The preferred font family for Isabelle/jEdit is \<^verbatim>\<open>Isabelle DejaVu\<close>: it is
   used by default for the main text area and various GUI elements. The default
   font sizes attempt to deliver a usable application for common display types,
   such as ``Full HD'' at $1920 \times 1080$ and ``Ultra HD'' at $3840 \times
   2160$.
 
   \<^medskip> Isabelle/jEdit provides various options to adjust font sizes in particular
   GUI elements. Here is a summary of all relevant font properties:
 
     \<^item> \<^emph>\<open>Global Options / Text Area / Text font\<close>: the main text area font,
     which is also used as reference point for various derived font sizes,
     e.g.\ the \<^emph>\<open>Output\<close> (\secref{sec:output}) and \<^emph>\<open>State\<close>
     (\secref{sec:state-output}) panels.
 
     \<^item> \<^emph>\<open>Global Options / Gutter / Gutter font\<close>: the font for the gutter area
     left of the main text area, e.g.\ relevant for display of line numbers
     (disabled by default).
 
     \<^item> \<^emph>\<open>Global Options / Appearance / Button, menu and label font\<close> as well as
     \<^emph>\<open>List and text field font\<close>: this specifies the primary and secondary font
     for the \<^emph>\<open>Metal\<close> look-and-feel.
 
     \<^item> \<^emph>\<open>Plugin Options / Isabelle / General / Reset Font Size\<close>: the main text
     area font size for action @{action_ref "isabelle.reset-font-size"}, e.g.\
     relevant for quick scaling like in common web browsers.
 
     \<^item> \<^emph>\<open>Plugin Options / Console / General / Font\<close>: the console window font,
     e.g.\ relevant for Isabelle/Scala command-line.
 \<close>
 
 
 chapter \<open>Augmented jEdit functionality\<close>
 
 section \<open>Dockable windows \label{sec:dockables}\<close>
 
 text \<open>
   In jEdit terminology, a \<^emph>\<open>view\<close> is an editor window with one or more \<^emph>\<open>text
   areas\<close> that show the content of one or more \<^emph>\<open>buffers\<close>. A regular view may
   be surrounded by \<^emph>\<open>dockable windows\<close> that show additional information in
   arbitrary format, not just text; a \<^emph>\<open>plain view\<close> does not allow dockables.
   The \<^emph>\<open>dockable window manager\<close> of jEdit organizes these dockable windows,
   either as \<^emph>\<open>floating\<close> windows, or \<^emph>\<open>docked\<close> panels within one of the four
   margins of the view. There may be any number of floating instances of some
   dockable window, but at most one docked instance; jEdit actions that address
   \<^emph>\<open>the\<close> dockable window of a particular kind refer to the unique docked
   instance.
 
   Dockables are used routinely in jEdit for important functionality like
   \<^emph>\<open>HyperSearch Results\<close> or the \<^emph>\<open>File System Browser\<close>. Plugins often provide
   a central dockable to access their main functionality, which may be opened
   by the user on demand. The Isabelle/jEdit plugin takes this approach to the
   extreme: its plugin menu provides the entry-points to many panels that are
   managed as dockable windows. Some important panels are docked by default,
   e.g.\ \<^emph>\<open>Documentation\<close>, \<^emph>\<open>State\<close>, \<^emph>\<open>Theories\<close> \<^emph>\<open>Output\<close>, \<^emph>\<open>Query\<close>. The user
   can change this arrangement easily and persistently.
 
   Compared to plain jEdit, dockable window management in Isabelle/jEdit is
   slightly augmented according to the the following principles:
 
   \<^item> Floating windows are dependent on the main window as \<^emph>\<open>dialog\<close> in
   the sense of Java/AWT/Swing. Dialog windows always stay on top of the view,
   which is particularly important in full-screen mode. The desktop environment
   of the underlying platform may impose further policies on such dependent
   dialogs, in contrast to fully independent windows, e.g.\ some window
   management functions may be missing.
 
   \<^item> Keyboard focus of the main view vs.\ a dockable window is carefully
   managed according to the intended semantics, as a panel mainly for output or
   input. For example, activating the \<^emph>\<open>Output\<close> (\secref{sec:output}) or State
   (\secref{sec:state-output}) panel via the dockable window manager returns
   keyboard focus to the main text area, but for \<^emph>\<open>Query\<close> (\secref{sec:query})
   or \<^emph>\<open>Sledgehammer\<close> \secref{sec:sledgehammer} the focus is given to the main
   input field of that panel.
 
   \<^item> Panels that provide their own text area for output have an additional
   dockable menu item \<^emph>\<open>Detach\<close>. This produces an independent copy of the
   current output as a floating \<^emph>\<open>Info\<close> window, which displays that content
   independently of ongoing changes of the PIDE document-model. Note that
   Isabelle/jEdit popup windows (\secref{sec:tooltips-hyperlinks}) provide a
   similar \<^emph>\<open>Detach\<close> operation as an icon.
 \<close>
 
 
 section \<open>Isabelle symbols \label{sec:symbols}\<close>
 
 text \<open>
   Isabelle sources consist of \<^emph>\<open>symbols\<close> that extend plain ASCII to allow
   infinitely many mathematical symbols within the formal sources. This works
   without depending on particular encodings and varying Unicode
   standards.\<^footnote>\<open>Raw Unicode characters within formal sources compromise
   portability and reliability in the face of changing interpretation of
   special features of Unicode, such as Combining Characters or Bi-directional
-  Text.\<close> See @{cite "Wenzel:2011:CICM"}.
+  Text.\<close> See \<^cite>\<open>"Wenzel:2011:CICM"\<close>.
 
   For the prover back-end, formal text consists of ASCII characters that are
   grouped according to some simple rules, e.g.\ as plain ``\<^verbatim>\<open>a\<close>'' or symbolic
   ``\<^verbatim>\<open>\<alpha>\<close>''. For the editor front-end, a certain subset of symbols is rendered
   physically via Unicode glyphs, to show ``\<^verbatim>\<open>\<alpha>\<close>'' as ``\<open>\<alpha>\<close>'', for example.
   This symbol interpretation is specified by the Isabelle system distribution
   in \<^file>\<open>$ISABELLE_HOME/etc/symbols\<close> and may be augmented by the user in
   \<^path>\<open>$ISABELLE_HOME_USER/etc/symbols\<close>.
 
-  The appendix of @{cite "isabelle-isar-ref"} gives an overview of the
+  The appendix of \<^cite>\<open>"isabelle-isar-ref"\<close> gives an overview of the
   standard interpretation of finitely many symbols from the infinite
   collection. Uninterpreted symbols are displayed literally, e.g.\
   ``\<^verbatim>\<open>\<foobar>\<close>''. Overlap of Unicode characters used in symbol
   interpretation with informal ones (which might appear e.g.\ in comments)
   needs to be avoided. Raw Unicode characters within prover source files
   should be restricted to informal parts, e.g.\ to write text in non-latin
   alphabets in comments.
 \<close>
 
 paragraph \<open>Encoding.\<close>
 
 text \<open>Technically, the Unicode interpretation of Isabelle symbols is an
   \<^emph>\<open>encoding\<close> called \<^verbatim>\<open>UTF-8-Isabelle\<close> in jEdit (\<^emph>\<open>not\<close> in the underlying
   JVM). It is provided by the Isabelle Base plugin and enabled by default for
   all source files in Isabelle/jEdit.
 
   Sometimes such defaults are reset accidentally, or malformed UTF-8 sequences
   in the text force jEdit to fall back on a different encoding like
   \<^verbatim>\<open>ISO-8859-15\<close>. In that case, verbatim ``\<^verbatim>\<open>\<alpha>\<close>'' will be shown in the text
   buffer instead of its Unicode rendering ``\<open>\<alpha>\<close>''. The jEdit menu operation
   \<^emph>\<open>File~/ Reload with Encoding~/ UTF-8-Isabelle\<close> helps to resolve such
   problems (after repairing malformed parts of the text).
 
   If the loaded text already contains Unicode sequences that are in conflict
   with the Isabelle symbol encoding, the fallback-encoding UTF-8 is used and
   Isabelle symbols remain in literal \<^verbatim>\<open>\<symbol>\<close> form. The jEdit menu
   operation \<^emph>\<open>Utilities~/ Buffer Options~/ Character encoding\<close> allows to
   enforce \<^verbatim>\<open>UTF-8-Isabelle\<close>, but this will also change original Unicode text
   into Isabelle symbols when saving the file!
 \<close>
 
 paragraph \<open>Font.\<close>
 text \<open>Correct rendering via Unicode requires a font that contains glyphs for
   the corresponding codepoints. There are also various unusual symbols with
   particular purpose in Isabelle, e.g.\ control symbols and very long arrows.
   Isabelle/jEdit prefers its own font collection \<^verbatim>\<open>Isabelle DejaVu\<close>, with
   families \<^verbatim>\<open>Serif\<close> (default for help texts), \<^verbatim>\<open>Sans\<close> (default for GUI
   elements), \<^verbatim>\<open>Mono Sans\<close> (default for text area). This ensures that all
   standard Isabelle symbols are shown on the screen (or printer) as expected.
 
   Note that a Java/AWT/Swing application can load additional fonts only if
   they are not installed on the operating system already! Outdated versions of
   Isabelle fonts that happen to be provided by the operating system prevent
   Isabelle/jEdit to use its bundled version. This could lead to missing glyphs
   (black rectangles), when the system version of a font is older than the
   application version. This problem can be avoided by refraining to
   ``install'' a copy of the Isabelle fonts in the first place, although it
   might be tempting to use the same font in other applications.
 
   HTML pages generated by Isabelle refer to the same Isabelle fonts as a
   server-side resource. Thus a web-browser can use that without requiring a
   locally installed copy.
 \<close>
 
 paragraph \<open>Input methods.\<close>
 text \<open>In principle, Isabelle/jEdit could delegate the problem to produce
   Isabelle symbols in their Unicode rendering to the underlying operating
   system and its \<^emph>\<open>input methods\<close>. Regular jEdit also provides various ways to
   work with \<^emph>\<open>abbreviations\<close> to produce certain non-ASCII characters. Since
   none of these standard input methods work satisfactorily for the
   mathematical characters required for Isabelle, various specific
   Isabelle/jEdit mechanisms are provided.
 
   This is a summary for practically relevant input methods for Isabelle
   symbols.
 
   \<^enum> The \<^emph>\<open>Symbols\<close> panel: some GUI buttons allow to insert certain symbols in
   the text buffer. There are also tooltips to reveal the official Isabelle
   representation with some additional information about \<^emph>\<open>symbol
   abbreviations\<close> (see below).
 
   \<^enum> Copy/paste from decoded source files: text that is already rendered as
   Unicode can be re-used for other text. This also works between different
   applications, e.g.\ Isabelle/jEdit and some web browser or mail client, as
   long as the same Unicode interpretation of Isabelle symbols is used.
 
   \<^enum> Copy/paste from prover output within Isabelle/jEdit. The same principles
   as for text buffers apply, but note that \<^emph>\<open>copy\<close> in secondary Isabelle/jEdit
   windows works via the keyboard shortcuts \<^verbatim>\<open>C+c\<close> or \<^verbatim>\<open>C+INSERT\<close>, while jEdit
   menu actions always refer to the primary text area!
 
   \<^enum> Completion provided by the Isabelle plugin (see \secref{sec:completion}).
   Isabelle symbols have a canonical name and optional abbreviations. This can
   be used with the text completion mechanism of Isabelle/jEdit, to replace a
   prefix of the actual symbol like \<^verbatim>\<open>\<lambda>\<close>, or its name preceded by backslash
   \<^verbatim>\<open>\lambda\<close>, or its ASCII abbreviation \<^verbatim>\<open>%\<close> by the Unicode rendering.
 
   The following table is an extract of the information provided by the
   standard \<^file>\<open>$ISABELLE_HOME/etc/symbols\<close> file:
 
   \<^medskip>
   \begin{tabular}{lll}
     \<^bold>\<open>symbol\<close> & \<^bold>\<open>name with backslash\<close> & \<^bold>\<open>abbreviation\<close> \\\hline
     \<open>\<lambda>\<close> & \<^verbatim>\<open>\lambda\<close> & \<^verbatim>\<open>%\<close> \\
     \<open>\<Rightarrow>\<close> & \<^verbatim>\<open>\Rightarrow\<close> & \<^verbatim>\<open>=>\<close> \\
     \<open>\<Longrightarrow>\<close> & \<^verbatim>\<open>\Longrightarrow\<close> & \<^verbatim>\<open>==>\<close> \\[0.5ex]
     \<open>\<And>\<close> & \<^verbatim>\<open>\And\<close> & \<^verbatim>\<open>!!\<close> \\
     \<open>\<equiv>\<close> & \<^verbatim>\<open>\equiv\<close> & \<^verbatim>\<open>==\<close> \\[0.5ex]
     \<open>\<forall>\<close> & \<^verbatim>\<open>\forall\<close> & \<^verbatim>\<open>!\<close> \\
     \<open>\<exists>\<close> & \<^verbatim>\<open>\exists\<close> & \<^verbatim>\<open>?\<close> \\
     \<open>\<longrightarrow>\<close> & \<^verbatim>\<open>\longrightarrow\<close> & \<^verbatim>\<open>-->\<close> \\
     \<open>\<and>\<close> & \<^verbatim>\<open>\and\<close> & \<^verbatim>\<open>&\<close> \\
     \<open>\<or>\<close> & \<^verbatim>\<open>\or\<close> & \<^verbatim>\<open>|\<close> \\
     \<open>\<not>\<close> & \<^verbatim>\<open>\not\<close> & \<^verbatim>\<open>~\<close> \\
     \<open>\<noteq>\<close> & \<^verbatim>\<open>\noteq\<close> & \<^verbatim>\<open>~=\<close> \\
     \<open>\<in>\<close> & \<^verbatim>\<open>\in\<close> & \<^verbatim>\<open>:\<close> \\
     \<open>\<notin>\<close> & \<^verbatim>\<open>\notin\<close> & \<^verbatim>\<open>~:\<close> \\
   \end{tabular}
   \<^medskip>
 
   Note that the above abbreviations refer to the input method. The logical
   notation provides ASCII alternatives that often coincide, but sometimes
   deviate. This occasionally causes user confusion with old-fashioned Isabelle
   source that use ASCII replacement notation like \<^verbatim>\<open>!\<close> or \<^verbatim>\<open>ALL\<close> directly in
   the text.
 
   On the other hand, coincidence of symbol abbreviations with ASCII
   replacement syntax syntax helps to update old theory sources via explicit
   completion (see also \<^verbatim>\<open>C+b\<close> explained in \secref{sec:completion}).
 \<close>
 
 paragraph \<open>Control symbols.\<close>
 text \<open>There are some special control symbols to modify the display style of a
   single symbol (without nesting). Control symbols may be applied to a region
   of selected text, either using the \<^emph>\<open>Symbols\<close> panel or keyboard shortcuts or
   jEdit actions. These editor operations produce a separate control symbol for
   each symbol in the text, in order to make the whole text appear in a certain
   style.
 
   \<^medskip>
   \begin{tabular}{llll}
     \<^bold>\<open>style\<close> & \<^bold>\<open>symbol\<close> & \<^bold>\<open>shortcut\<close> & \<^bold>\<open>action\<close> \\\hline
     superscript & \<^verbatim>\<open>\<^sup>\<close> & \<^verbatim>\<open>C+e UP\<close> & @{action_ref "isabelle.control-sup"} \\
     subscript & \<^verbatim>\<open>\<^sub>\<close> & \<^verbatim>\<open>C+e DOWN\<close> & @{action_ref "isabelle.control-sub"} \\
     bold face & \<^verbatim>\<open>\<^bold>\<close> & \<^verbatim>\<open>C+e RIGHT\<close> & @{action_ref "isabelle.control-bold"} \\
     emphasized & \<^verbatim>\<open>\<^emph>\<close> & \<^verbatim>\<open>C+e LEFT\<close> & @{action_ref "isabelle.control-emph"} \\
     reset & & \<^verbatim>\<open>C+e BACK_SPACE\<close> & @{action_ref "isabelle.control-reset"} \\
   \end{tabular}
   \<^medskip>
 
   To produce a single control symbol, it is also possible to complete on
   \<^verbatim>\<open>\sup\<close>, \<^verbatim>\<open>\sub\<close>, \<^verbatim>\<open>\bold\<close>, \<^verbatim>\<open>\emph\<close> as for regular symbols.
 
   The emphasized style only takes effect in document output (when used with a
   cartouche), but not in the editor.
 \<close>
 
 
 section \<open>Scala console \label{sec:scala-console}\<close>
 
 text \<open>
   The \<^emph>\<open>Console\<close> plugin manages various shells (command interpreters), e.g.\
   \<^emph>\<open>BeanShell\<close>, which is the official jEdit scripting language, and the
   cross-platform \<^emph>\<open>System\<close> shell. Thus the console provides similar
   functionality than the Emacs buffers \<^verbatim>\<open>*scratch*\<close> and \<^verbatim>\<open>*shell*\<close>.
 
   Isabelle/jEdit extends the repertoire of the console by \<^emph>\<open>Scala\<close>, which is
   the regular Scala toplevel loop running inside the same JVM process as
   Isabelle/jEdit itself. This means the Scala command interpreter has access
   to the JVM name space and state of the running Prover IDE application. The
   default environment imports the full content of packages \<^verbatim>\<open>isabelle\<close> and
   \<^verbatim>\<open>isabelle.jedit\<close>.
 
   For example, \<^verbatim>\<open>PIDE\<close> refers to the Isabelle/jEdit plugin object, and \<^verbatim>\<open>view\<close>
   to the current editor view of jEdit. The Scala expression
   \<^verbatim>\<open>PIDE.snapshot(view)\<close> makes a PIDE document snapshot of the current buffer
   within the current editor view: it allows to retrieve document markup in a
   timeless~/ stateless manner, while the prover continues its processing.
 
   This helps to explore Isabelle/Scala functionality interactively. Some care
   is required to avoid interference with the internals of the running
   application.
 \<close>
 
 
 section \<open>Physical and logical files \label{sec:files}\<close>
 
 text \<open>
   File specifications in jEdit follow various formats and conventions
   according to \<^emph>\<open>Virtual File Systems\<close>, which may be also provided by plugins.
   This allows to access remote files via the \<^verbatim>\<open>https:\<close> protocol prefix, for
   example. Isabelle/jEdit attempts to work with the file-system model of jEdit
   as far as possible. In particular, theory sources are passed from the editor
   to the prover, without indirection via the file-system. Thus files don't
   need to be saved: the editor buffer content is used directly.
 \<close>
 
 
 subsection \<open>Local files and environment variables \label{sec:local-files}\<close>
 
 text \<open>
   Local files (without URL notation) are particularly important. The file path
   notation is that of the Java Virtual Machine on the underlying platform. On
   Windows the preferred form uses backslashes, but happens to accept forward
   slashes like Unix/POSIX as well. Further differences arise due to Windows
   drive letters and network shares: thus relative paths (with forward slashes)
   are portable, but absolute paths are not.
 
   File paths in Java are distinct from Isabelle; the latter uses POSIX
   notation with forward slashes on \<^emph>\<open>all\<close> platforms. Isabelle/ML on Windows
   uses Unix-style path notation, with drive letters according to Cygwin (e.g.\
   \<^verbatim>\<open>/cygdrive/c\<close>). Environment variables from the Isabelle process may be used
   freely, e.g.\ \<^file>\<open>$ISABELLE_HOME/etc/symbols\<close> or \<^file>\<open>$POLYML_HOME/README\<close>.
   There are special shortcuts: \<^dir>\<open>~\<close> for \<^dir>\<open>$USER_HOME\<close> and \<^dir>\<open>~~\<close> for
   \<^dir>\<open>$ISABELLE_HOME\<close>.
 
   \<^medskip> Since jEdit happens to support environment variables within file
   specifications as well, it is natural to use similar notation within the
   editor, e.g.\ in the file-browser. This does not work in full generality,
   though, due to the bias of jEdit towards platform-specific notation and of
   Isabelle towards POSIX. Moreover, the Isabelle settings environment is not
   accessible when starting Isabelle/jEdit via the desktop application wrapper,
   in contrast to @{tool jedit} run from the command line
   (\secref{sec:command-line}).
 
   Isabelle/jEdit imitates important system settings within the Java process
   environment, in order to allow easy access to these important places from
   the editor: \<^verbatim>\<open>$ISABELLE_HOME\<close>, \<^verbatim>\<open>$ISABELLE_HOME_USER\<close>, \<^verbatim>\<open>$JEDIT_HOME\<close>,
   \<^verbatim>\<open>$JEDIT_SETTINGS\<close>. The file browser of jEdit also includes \<^emph>\<open>Favorites\<close> for
   these locations.
 
   \<^medskip> Path specifications in prover input or output usually include formal
   markup that turns it into a hyperlink (see also
   \secref{sec:tooltips-hyperlinks}). This allows to open the corresponding
   file in the text editor, independently of the path notation. If the path
   refers to a directory, it is opened in the jEdit file browser.
 
   Formally checked paths in prover input are subject to completion
   (\secref{sec:completion}): partial specifications are resolved via directory
   content and possible completions are offered in a popup.
 \<close>
 
 
 subsection \<open>PIDE resources via virtual file-systems\<close>
 
 text \<open>
   The jEdit file browser is docked by default. It provides immediate access to
   the local file-system, as well as important Isabelle resources via the
   \<^emph>\<open>Favorites\<close> menu. Environment variables like \<^verbatim>\<open>$ISABELLE_HOME\<close> are
   discussed in \secref{sec:local-files}. Virtual file-systems are more
   special: the idea is to present structured information like a directory
   tree. The following URLs are offered in the \<^emph>\<open>Favorites\<close> menu, or by
   corresponding jEdit actions.
 
     \<^item> URL \<^verbatim>\<open>isabelle-export:\<close> or action @{action_def
     "isabelle-export-browser"} shows a toplevel directory with theory names:
     each may provide its own tree structure of session exports. Exports are
     like a logical file-system for the current prover session, maintained as
     Isabelle/Scala data structures and written to the session database
     eventually. The \<^verbatim>\<open>isabelle-export:\<close> URL exposes the current content
     according to a snapshot of the document model. The file browser is \<^emph>\<open>not\<close>
     updated continuously when the PIDE document changes: the reload operation
     needs to be used explicitly. A notable example for exports is the command
-    @{command_ref export_code} @{cite "isabelle-isar-ref"}.
+    @{command_ref export_code} \<^cite>\<open>"isabelle-isar-ref"\<close>.
 
     \<^item> URL \<^verbatim>\<open>isabelle-session:\<close> or action @{action_def
     "isabelle-session-browser"} show the structure of session chapters and
     sessions within them. What looks like a file-entry is actually a reference
     to the session definition in its corresponding \<^verbatim>\<open>ROOT\<close> file. The latter is
     subject to Prover IDE markup, so the session theories and other files may
     be browsed quickly by following hyperlinks in the text.
 \<close>
 
 
 section \<open>Indentation\<close>
 
 text \<open>
   Isabelle/jEdit augments the existing indentation facilities of jEdit to take
   the structure of theory and proof texts into account. There is also special
   support for unstructured proof scripts (\<^theory_text>\<open>apply\<close> etc.).
 
     \<^descr>[Syntactic indentation] follows the outer syntax of Isabelle/Isar.
 
     Action @{action "indent-lines"} (shortcut \<^verbatim>\<open>C+i\<close>) indents the current line
     according to command keywords and some command substructure: this
     approximation may need further manual tuning.
 
     Action @{action "isabelle.newline"} (shortcut \<^verbatim>\<open>ENTER\<close>) indents the old
     and the new line according to command keywords only: leading to precise
     alignment of the main Isar language elements. This depends on option
     @{system_option_def "jedit_indent_newline"} (enabled by default).
 
     Regular input (via keyboard or completion) indents the current line
     whenever an new keyword is emerging at the start of the line. This depends
     on option @{system_option_def "jedit_indent_input"} (enabled by default).
 
     \<^descr>[Semantic indentation] adds additional white space to unstructured proof
     scripts via the number of subgoals. This requires information of ongoing
     document processing and may thus lag behind when the user is editing too
     quickly; see also option @{system_option_def "jedit_script_indent"} and
     @{system_option_def "jedit_script_indent_limit"}.
 
   The above options are accessible in the menu \<^emph>\<open>Plugins / Plugin Options /
   Isabelle / General\<close>. A prerequisite for advanced indentation is \<^emph>\<open>Utilities
   / Buffer Options / Automatic indentation\<close>: it needs to be set to \<^verbatim>\<open>full\<close>
   (default).
 \<close>
 
 
 section \<open>SideKick parsers \label{sec:sidekick}\<close>
 
 text \<open>
   The \<^emph>\<open>SideKick\<close> plugin provides some general services to display buffer
   structure in a tree view. Isabelle/jEdit provides SideKick parsers for its
   main mode for theory files, ML files, as well as some minor modes for the
   \<^verbatim>\<open>NEWS\<close> file (see \figref{fig:sidekick}), session \<^verbatim>\<open>ROOT\<close> files, system
   \<^verbatim>\<open>options\<close>, and Bib{\TeX} files (\secref{sec:bibtex}).
 
   \begin{figure}[!htb]
   \begin{center}
   \includegraphics[scale=0.333]{sidekick}
   \end{center}
   \caption{The Isabelle NEWS file with SideKick tree view}
   \label{fig:sidekick}
   \end{figure}
 
   The default SideKick parser for theory files is \<^verbatim>\<open>isabelle\<close>: it provides a
   tree-view on the formal document structure, with section headings at the top
   and formal specification elements at the bottom. The alternative parser
   \<^verbatim>\<open>isabelle-context\<close> shows nesting of context blocks according to \<^theory_text>\<open>begin \<dots>
   end\<close> structure.
 
   \<^medskip>
   Isabelle/ML files are structured according to semi-formal comments that are
-  explained in @{cite "isabelle-implementation"}. This outline is turned into
+  explained in \<^cite>\<open>"isabelle-implementation"\<close>. This outline is turned into
   a tree-view by default, by using the \<^verbatim>\<open>isabelle-ml\<close> parser. There is also a
   folding mode of the same name, for hierarchic text folds within ML files.
 
   \<^medskip>
   The special SideKick parser \<^verbatim>\<open>isabelle-markup\<close> exposes the uninterpreted
   markup tree of the PIDE document model of the current buffer. This is
   occasionally useful for informative purposes, but the amount of displayed
   information might cause problems for large buffers.
 \<close>
 
 
 chapter \<open>Prover IDE functionality \label{sec:document-model}\<close>
 
 section \<open>Document model \label{sec:document-model}\<close>
 
 text \<open>
   The document model is central to the PIDE architecture: the editor and the
   prover have a common notion of structured source text with markup, which is
   produced by formal processing. The editor is responsible for edits of
   document source, as produced by the user. The prover is responsible for
   reports of document markup, as produced by its processing in the background.
 
   Isabelle/jEdit handles classic editor events of jEdit, in order to connect
   the physical world of the GUI (with its singleton state) to the mathematical
   world of multiple document versions (with timeless and stateless updates).
 \<close>
 
 
 subsection \<open>Editor buffers and document nodes \label{sec:buffer-node}\<close>
 
 text \<open>
   As a regular text editor, jEdit maintains a collection of \<^emph>\<open>buffers\<close> to
   store text files; each buffer may be associated with any number of visible
   \<^emph>\<open>text areas\<close>. Buffers are subject to an \<^emph>\<open>edit mode\<close> that is determined
   from the file name extension. The following modes are treated specifically
   in Isabelle/jEdit:
 
   \<^medskip>
   \begin{tabular}{lll}
   \<^bold>\<open>mode\<close> & \<^bold>\<open>file name\<close> & \<^bold>\<open>content\<close> \\\hline
   \<^verbatim>\<open>isabelle\<close> & \<^verbatim>\<open>*.thy\<close> & theory source \\
   \<^verbatim>\<open>isabelle-ml\<close> & \<^verbatim>\<open>*.ML\<close> & Isabelle/ML source \\
   \<^verbatim>\<open>sml\<close> & \<^verbatim>\<open>*.sml\<close> or \<^verbatim>\<open>*.sig\<close> & Standard ML source \\
   \<^verbatim>\<open>isabelle-root\<close> & \<^verbatim>\<open>ROOT\<close> & session root \\
   \<^verbatim>\<open>isabelle-options\<close> & & Isabelle options \\
   \<^verbatim>\<open>isabelle-news\<close> & & Isabelle NEWS \\
   \end{tabular}
   \<^medskip>
 
   All jEdit buffers are automatically added to the PIDE document-model as
   \<^emph>\<open>document nodes\<close>. The overall document structure is defined by the theory
   nodes in two dimensions:
 
     \<^enum> via \<^bold>\<open>theory imports\<close> that are specified in the \<^emph>\<open>theory header\<close> using
-    concrete syntax of the @{command_ref theory} command @{cite
-    "isabelle-isar-ref"};
+    concrete syntax of the @{command_ref theory} command \<^cite>\<open>"isabelle-isar-ref"\<close>;
 
     \<^enum> via \<^bold>\<open>auxiliary files\<close> that are included into a theory by \<^emph>\<open>load
     commands\<close>, notably @{command_ref ML_file} and @{command_ref SML_file}
-    @{cite "isabelle-isar-ref"}.
+    \<^cite>\<open>"isabelle-isar-ref"\<close>.
 
   In any case, source files are managed by the PIDE infrastructure: the
   physical file-system only plays a subordinate role. The relevant version of
   source text is passed directly from the editor to the prover, using internal
   communication channels.
 \<close>
 
 
 subsection \<open>Theories \label{sec:theories}\<close>
 
 text \<open>
   The \<^emph>\<open>Theories\<close> panel (see also \figref{fig:theories}) provides an overview
   of the status of continuous checking of theory nodes within the document
   model.
 
   \begin{figure}[!htb]
   \begin{center}
   \includegraphics[scale=0.333]{theories}
   \end{center}
   \caption{Theories panel with an overview of the document-model, and jEdit
   text areas as editable views on some of the document nodes}
   \label{fig:theories}
   \end{figure}
 
   Theory imports are resolved automatically by the PIDE document model: all
   required files are loaded and stored internally, without the need to open
   corresponding jEdit buffers. Opening or closing editor buffers later on has
   no direct impact on the formal document content: it only affects visibility.
 
   In contrast, auxiliary files (e.g.\ from @{command ML_file} commands) are
   \<^emph>\<open>not\<close> resolved within the editor by default, but the prover process takes
   care of that. This may be changed by enabling the system option
   @{system_option jedit_auto_resolve}: it ensures that all files are uniformly
   provided by the editor.
 
   \<^medskip>
   The visible \<^emph>\<open>perspective\<close> of Isabelle/jEdit is defined by the collective
   view on theory buffers via open text areas. The perspective is taken as a
   hint for document processing: the prover ensures that those parts of a
   theory where the user is looking are checked, while other parts that are
   presently not required are ignored. The perspective is changed by opening or
   closing text area windows, or scrolling within a window.
 
   The \<^emph>\<open>Theories\<close> panel provides some further options to influence the process
   of continuous checking: it may be switched off globally to restrict the
   prover to superficial processing of command syntax. It is also possible to
   indicate theory nodes as \<^emph>\<open>required\<close> for continuous checking: this means
   such nodes and all their imports are always processed independently of the
   visibility status (if continuous checking is enabled). Big theory libraries
   that are marked as required can have significant impact on performance!
 
   The \<^emph>\<open>Purge\<close> button restricts the document model to theories that are
   required for open editor buffers: inaccessible theories are removed and will
   be rechecked when opened or imported later.
 
   \<^medskip>
   Formal markup of checked theory content is turned into GUI rendering, based
   on a standard repertoire known from mainstream IDEs for programming
   languages: colors, icons, highlighting, squiggly underlines, tooltips,
   hyperlinks etc. For outer syntax of Isabelle/Isar there is some traditional
   syntax-highlighting via static keywords and tokenization within the editor;
   this buffer syntax is determined from theory imports. In contrast, the
   painting of inner syntax (term language etc.)\ uses semantic information
   that is reported dynamically from the logical context. Thus the prover can
   provide additional markup to help the user to understand the meaning of
   formal text, and to produce more text with some add-on tools (e.g.\
   information messages with \<^emph>\<open>sendback\<close> markup by automated provers or
   disprovers in the background). \<close>
 
 
 subsection \<open>Auxiliary files \label{sec:aux-files}\<close>
 
 text \<open>
   Special load commands like @{command_ref ML_file} and @{command_ref
-  SML_file} @{cite "isabelle-isar-ref"} refer to auxiliary files within some
+  SML_file} \<^cite>\<open>"isabelle-isar-ref"\<close> refer to auxiliary files within some
   theory. Conceptually, the file argument of the command extends the theory
   source by the content of the file, but its editor buffer may be loaded~/
   changed~/ saved separately. The PIDE document model propagates changes of
   auxiliary file content to the corresponding load command in the theory, to
   update and process it accordingly: changes of auxiliary file content are
   treated as changes of the corresponding load command.
 
   \<^medskip>
   As a concession to the massive amount of ML files in Isabelle/HOL itself,
   the content of auxiliary files is only added to the PIDE document-model on
   demand, the first time when opened explicitly in the editor. There are
   further tricks to manage markup of ML files, such that Isabelle/HOL may be
   edited conveniently in the Prover IDE on small machines with only 8\,GB of
   main memory. Using \<^verbatim>\<open>Pure\<close> as logic session image, the exploration may start
   at the top \<^file>\<open>$ISABELLE_HOME/src/HOL/Main.thy\<close> or the bottom
   \<^file>\<open>$ISABELLE_HOME/src/HOL/HOL.thy\<close>, for example. It is also possible to
   explore the Isabelle/Pure bootstrap process (a virtual copy) by opening
   \<^file>\<open>$ISABELLE_HOME/src/Pure/ROOT.ML\<close> like a theory in the Prover IDE.
 
   Initially, before an auxiliary file is opened in the editor, the prover
   reads its content from the physical file-system. After the file is opened
   for the first time in the editor, e.g.\ by following the hyperlink
   (\secref{sec:tooltips-hyperlinks}) for the argument of its @{command
   ML_file} command, the content is taken from the jEdit buffer.
 
   The change of responsibility from prover to editor counts as an update of
   the document content, so subsequent theory sources need to be re-checked.
   When the buffer is closed, the responsibility remains to the editor: the
   file may be opened again without causing another document update.
 
   A file that is opened in the editor, but its theory with the load command is
   not, is presently inactive in the document model. A file that is loaded via
   multiple load commands is associated to an arbitrary one: this situation is
   morally unsupported and might lead to confusion.
 
   \<^medskip>
   Output that refers to an auxiliary file is combined with that of the
   corresponding load command, and shown whenever the file or the command are
   active (see also \secref{sec:output}).
 
   Warnings, errors, and other useful markup is attached directly to the
   positions in the auxiliary file buffer, in the manner of standard IDEs. By
   using the load command @{command SML_file} as explained in
   \<^file>\<open>$ISABELLE_HOME/src/Tools/SML/Examples.thy\<close>, Isabelle/jEdit may be used as
   fully-featured IDE for Standard ML, independently of theory or proof
   development: the required theory merely serves as some kind of project file
   for a collection of SML source modules.
 \<close>
 
 
 section \<open>Output \label{sec:output}\<close>
 
 text \<open>
   Prover output consists of \<^emph>\<open>markup\<close> and \<^emph>\<open>messages\<close>. Both are directly
   attached to the corresponding positions in the original source text, and
   visualized in the text area, e.g.\ as text colours for free and bound
   variables, or as squiggly underlines for warnings, errors etc.\ (see also
   \figref{fig:output}). In the latter case, the corresponding messages are
   shown by hovering with the mouse over the highlighted text --- although in
   many situations the user should already get some clue by looking at the
   position of the text highlighting, without seeing the message body itself.
 
   \begin{figure}[!htb]
   \begin{center}
   \includegraphics[scale=0.333]{output}
   \end{center}
   \caption{Multiple views on prover output: gutter with icon, text area with
   popup, text overview column, \<^emph>\<open>Theories\<close> panel, \<^emph>\<open>Output\<close> panel}
   \label{fig:output}
   \end{figure}
 
   The ``gutter'' on the left-hand-side of the text area uses icons to
   provide a summary of the messages within the adjacent text line. Message
   priorities are used to prefer errors over warnings, warnings over
   information messages; other output is ignored.
 
   The ``text overview column'' on the right-hand-side of the text area uses
   similar information to paint small rectangles for the overall status of the
   whole text buffer. The graphics is scaled to fit the logical buffer length
   into the given window height. Mouse clicks on the overview area move the
   cursor approximately to the corresponding text line in the buffer.
 
   The \<^emph>\<open>Theories\<close> panel provides another course-grained overview, but without
   direct correspondence to text positions. The coloured rectangles represent
   the amount of messages of a certain kind (warnings, errors, etc.) and the
   execution status of commands. The border of each rectangle indicates the
   overall status of processing: a thick border means it is \<^emph>\<open>finished\<close> or
   \<^emph>\<open>failed\<close> (with color for errors). A double-click on one of the theory
   entries with their status overview opens the corresponding text buffer,
   without moving the cursor to a specific point.
 
   \<^medskip>
   The \<^emph>\<open>Output\<close> panel displays prover messages that correspond to a given
   command, within a separate window. The cursor position in the presently
   active text area determines the prover command whose cumulative message
   output is appended and shown in that window (in canonical order according to
   the internal execution of the command). There are also control elements to
   modify the update policy of the output wrt.\ continued editor movements:
   \<^emph>\<open>Auto update\<close> and \<^emph>\<open>Update\<close>. This is particularly useful for multiple
   instances of the \<^emph>\<open>Output\<close> panel to look at different situations.
   Alternatively, the panel can be turned into a passive \<^emph>\<open>Info\<close> window via the
   \<^emph>\<open>Detach\<close> menu item.
 
   Proof state is handled separately (\secref{sec:state-output}), but it is
   also possible to tick the corresponding checkbox to append it to regular
   output (\figref{fig:output-including-state}). This is a globally persistent
   option: it affects all open panels and future editor sessions.
 
   \begin{figure}[!htb]
   \begin{center}
   \includegraphics[scale=0.333]{output-including-state}
   \end{center}
   \caption{Proof state display within the regular output panel}
   \label{fig:output-including-state}
   \end{figure}
 
   \<^medskip>
   Following the IDE principle, regular messages are attached to the original
   source in the proper place and may be inspected on demand via popups. This
   excludes messages that are somehow internal to the machinery of proof
   checking, notably \<^emph>\<open>proof state\<close> and \<^emph>\<open>tracing\<close>.
 
   In any case, the same display technology is used for small popups and big
   output windows. The formal text contains markup that may be explored
   recursively via further popups and hyperlinks (see
   \secref{sec:tooltips-hyperlinks}), or clicked directly to initiate certain
   actions (see \secref{sec:auto-tools} and \secref{sec:sledgehammer}).
 
   \<^medskip>
   Alternatively, the subsequent actions (with keyboard shortcuts) allow to
   show tooltip messages or navigate error positions:
 
   \<^medskip>
   \begin{tabular}[t]{l}
   @{action_ref "isabelle.tooltip"} (\<^verbatim>\<open>CS+b\<close>) \\
   @{action_ref "isabelle.message"} (\<^verbatim>\<open>CS+m\<close>) \\
   \end{tabular}\quad
   \begin{tabular}[t]{l}
   @{action_ref "isabelle.first-error"} (\<^verbatim>\<open>CS+a\<close>) \\
   @{action_ref "isabelle.last-error"} (\<^verbatim>\<open>CS+z\<close>) \\
   @{action_ref "isabelle.next-error"} (\<^verbatim>\<open>CS+n\<close>) \\
   @{action_ref "isabelle.prev-error"} (\<^verbatim>\<open>CS+p\<close>) \\
   \end{tabular}
   \<^medskip>
 \<close>
 
 
 section \<open>Proof state \label{sec:state-output}\<close>
 
 text \<open>
   The main purpose of the Prover IDE is to help the user editing proof
   documents, with ongoing formal checking by the prover in the background.
   This can be done to some extent in the main text area alone, especially for
   well-structured Isar proofs.
 
   Nonetheless, internal proof state needs to be inspected in many situations
   of exploration and ``debugging''. The \<^emph>\<open>State\<close> panel shows exclusively such
   proof state messages without further distraction, while all other messages
   are displayed in \<^emph>\<open>Output\<close> (\secref{sec:output}).
   \Figref{fig:output-and-state} shows a typical GUI layout where both panels
   are open.
 
   \begin{figure}[!htb]
   \begin{center}
   \includegraphics[scale=0.333]{output-and-state}
   \end{center}
   \caption{Separate proof state display (right) and other output (bottom).}
   \label{fig:output-and-state}
   \end{figure}
 
   Another typical arrangement has more than one \<^emph>\<open>State\<close> panel open (as
   floating windows), with \<^emph>\<open>Auto update\<close> disabled to look at an old situation
   while the proof text in the vicinity is changed. The \<^emph>\<open>Update\<close> button
   triggers an explicit one-shot update; this operation is also available via
   the action @{action "isabelle.update-state"} (keyboard shortcut \<^verbatim>\<open>S+ENTER\<close>).
 
   On small screens, it is occasionally useful to have all messages
   concatenated in the regular \<^emph>\<open>Output\<close> panel, e.g.\ see
   \figref{fig:output-including-state}.
 
   \<^medskip>
   The mechanics of \<^emph>\<open>Output\<close> versus \<^emph>\<open>State\<close> are slightly different:
 
     \<^item> \<^emph>\<open>Output\<close> shows information that is continuously produced and already
     present when the GUI wants to show it. This is implicitly controlled by
     the visible perspective on the text.
 
     \<^item> \<^emph>\<open>State\<close> initiates a real-time query on demand, with a full round trip
     including a fresh print operation on the prover side. This is controlled
     explicitly when the cursor is moved to the next command (\<^emph>\<open>Auto update\<close>)
     or the \<^emph>\<open>Update\<close> operation is triggered.
 
   This can make a difference in GUI responsibility and resource usage within
   the prover process. Applications with very big proof states that are only
   inspected in isolation work better with the \<^emph>\<open>State\<close> panel.
 \<close>
 
 
 section \<open>Query \label{sec:query}\<close>
 
 text \<open>
   The \<^emph>\<open>Query\<close> panel provides various GUI forms to request extra information
   from the prover, as a replacement of old-style diagnostic commands like
   @{command find_theorems}. There are input fields and buttons for a
   particular query command, with output in a dedicated text area.
 
   The main query modes are presented as separate tabs: \<^emph>\<open>Find Theorems\<close>,
   \<^emph>\<open>Find Constants\<close>, \<^emph>\<open>Print Context\<close>, e.g.\ see \figref{fig:query}. As usual
   in jEdit, multiple \<^emph>\<open>Query\<close> windows may be active at the same time: any
   number of floating instances, but at most one docked instance (which is used
   by default).
 
   \begin{figure}[!htb]
   \begin{center}
   \includegraphics[scale=0.333]{query}
   \end{center}
   \caption{An instance of the Query panel: find theorems}
   \label{fig:query}
   \end{figure}
 
   \<^medskip>
   The following GUI elements are common to all query modes:
 
     \<^item> The spinning wheel provides feedback about the status of a pending query
     wrt.\ the evaluation of its context and its own operation.
 
     \<^item> The \<^emph>\<open>Apply\<close> button attaches a fresh query invocation to the current
     context of the command where the cursor is pointing in the text.
 
     \<^item> The \<^emph>\<open>Search\<close> field allows to highlight query output according to some
     regular expression, in the notation that is commonly used on the Java
     platform.\<^footnote>\<open>\<^url>\<open>https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/util/regex/Pattern.html\<close>\<close>
     This may serve as an additional visual filter of the result.
 
     \<^item> The \<^emph>\<open>Zoom\<close> box controls the font size of the output area.
 
   All query operations are asynchronous: there is no need to wait for the
   evaluation of the document for the query context, nor for the query
   operation itself. Query output may be detached as independent \<^emph>\<open>Info\<close>
   window, using a menu operation of the dockable window manager. The printed
   result usually provides sufficient clues about the original query, with some
   hyperlink to its context (via markup of its head line).
 \<close>
 
 
 subsection \<open>Find theorems\<close>
 
 text \<open>
   The \<^emph>\<open>Query\<close> panel in \<^emph>\<open>Find Theorems\<close> mode retrieves facts from the theory
   or proof context matching all of given criteria in the \<^emph>\<open>Find\<close> text field. A
   single criterion has the following syntax:
 
   \<^rail>\<open>
     ('-'?) ('name' ':' @{syntax name} | 'intro' | 'elim' | 'dest' |
       'solves' | 'simp' ':' @{syntax term} | @{syntax term})
   \<close>
 
-  See also the Isar command @{command_ref find_theorems} in @{cite
-  "isabelle-isar-ref"}.
+  See also the Isar command @{command_ref find_theorems} in \<^cite>\<open>"isabelle-isar-ref"\<close>.
 \<close>
 
 
 subsection \<open>Find constants\<close>
 
 text \<open>
   The \<^emph>\<open>Query\<close> panel in \<^emph>\<open>Find Constants\<close> mode prints all constants whose type
   meets all of the given criteria in the \<^emph>\<open>Find\<close> text field. A single
   criterion has the following syntax:
 
   \<^rail>\<open>
     ('-'?)
       ('name' ':' @{syntax name} | 'strict' ':' @{syntax type} | @{syntax type})
   \<close>
 
-  See also the Isar command @{command_ref find_consts} in @{cite
-  "isabelle-isar-ref"}.
+  See also the Isar command @{command_ref find_consts} in \<^cite>\<open>"isabelle-isar-ref"\<close>.
 \<close>
 
 
 subsection \<open>Print context\<close>
 
 text \<open>
   The \<^emph>\<open>Query\<close> panel in \<^emph>\<open>Print Context\<close> mode prints information from the
   theory or proof context, or proof state. See also the Isar commands
   @{command_ref print_context}, @{command_ref print_cases}, @{command_ref
-  print_term_bindings}, @{command_ref print_theorems}, described in @{cite
-  "isabelle-isar-ref"}.
+  print_term_bindings}, @{command_ref print_theorems}, described in \<^cite>\<open>"isabelle-isar-ref"\<close>.
 \<close>
 
 
 section \<open>Tooltips and hyperlinks \label{sec:tooltips-hyperlinks}\<close>
 
 text \<open>
   Formally processed text (prover input or output) contains rich markup that
   can be explored by using the \<^verbatim>\<open>CONTROL\<close> modifier key on Linux and Windows,
   or \<^verbatim>\<open>COMMAND\<close> on macOS. Hovering with the mouse while the modifier is
   pressed reveals a \<^emph>\<open>tooltip\<close> (grey box over the text with a yellow popup)
   and/or a \<^emph>\<open>hyperlink\<close> (black rectangle over the text with change of mouse
   pointer); see also \figref{fig:tooltip}.
 
   \begin{figure}[!htb]
   \begin{center}
   \includegraphics[scale=0.333]{popup1}
   \end{center}
   \caption{Tooltip and hyperlink for some formal entity}
   \label{fig:tooltip}
   \end{figure}
 
   Tooltip popups use the same rendering technology as the main text area, and
   further tooltips and/or hyperlinks may be exposed recursively by the same
   mechanism; see \figref{fig:nested-tooltips}.
 
   \begin{figure}[!htb]
   \begin{center}
   \includegraphics[scale=0.333]{popup2}
   \end{center}
   \caption{Nested tooltips over formal entities}
   \label{fig:nested-tooltips}
   \end{figure}
 
   The tooltip popup window provides some controls to \<^emph>\<open>close\<close> or \<^emph>\<open>detach\<close> the
   window, turning it into a separate \<^emph>\<open>Info\<close> window managed by jEdit. The
   \<^verbatim>\<open>ESCAPE\<close> key closes \<^emph>\<open>all\<close> popups, which is particularly relevant when
   nested tooltips are stacking up.
 
   \<^medskip>
   A black rectangle in the text indicates a hyperlink that may be followed by
   a mouse click (while the \<^verbatim>\<open>CONTROL\<close> or \<^verbatim>\<open>COMMAND\<close> modifier key is still
   pressed). Such jumps to other text locations are recorded by the
   \<^emph>\<open>Navigator\<close> plugin, which is bundled with Isabelle/jEdit and enabled by
   default. There are usually navigation arrows in the main jEdit toolbar.
 
   Note that the link target may be a file that is itself not subject to formal
   document processing of the editor session and thus prevents further
   exploration: the chain of hyperlinks may end in some source file of the
   underlying logic image, or within the ML bootstrap sources of Isabelle/Pure.
 \<close>
 
 
 section \<open>Formal scopes and semantic selection\<close>
 
 text \<open>
   Formal entities are semantically annotated in the source text as explained
   in \secref{sec:tooltips-hyperlinks}. A \<^emph>\<open>formal scope\<close> consists of the
   defining position with all its referencing positions. This correspondence is
   highlighted in the text according to the cursor position, see also
   \figref{fig:scope1}. Here the referencing positions are rendered with an
   additional border, in reminiscence to a hyperlink. A mouse click with \<^verbatim>\<open>C\<close>
   modifier, or the action @{action_def "isabelle.goto-entity"} (shortcut
   \<^verbatim>\<open>CS+d\<close>) jumps to the original defining position.
 
   \begin{figure}[!htb]
   \begin{center}
   \includegraphics[scale=0.333]{scope1}
   \end{center}
   \caption{Scope of formal entity: defining vs.\ referencing positions}
   \label{fig:scope1}
   \end{figure}
 
   The action @{action_def "isabelle.select-entity"} (shortcut \<^verbatim>\<open>CS+ENTER\<close>)
   supports semantic selection of all occurrences of the formal entity at the
   caret position, with a defining position in the current editor buffer. This
   facilitates systematic renaming, using regular jEdit editing of a
   multi-selection, see also \figref{fig:scope2}.
 
   \begin{figure}[!htb]
   \begin{center}
   \includegraphics[scale=0.333]{scope2}
   \end{center}
   \caption{The result of semantic selection and systematic renaming}
   \label{fig:scope2}
   \end{figure}
 
   By default, the visual feedback on scopes is restricted to definitions
   within the visible text area. The keyboard modifier \<^verbatim>\<open>CS\<close> overrides this:
   then all defining and referencing positions are shown. This modifier may be
   configured via option @{system_option jedit_focus_modifier}; the default
   coincides with the modifier for the above keyboard actions. The empty string
   means to disable this additional visual feedback.
 \<close>
 
 
 section \<open>Completion \label{sec:completion}\<close>
 
 text \<open>
   Smart completion of partial input is the IDE functionality \<^emph>\<open>par
   excellance\<close>. Isabelle/jEdit combines several sources of information to
   achieve that. Despite its complexity, it should be possible to get some idea
   how completion works by experimentation, based on the overview of completion
   varieties in \secref{sec:completion-varieties}. The remaining subsections
   explain concepts around completion more systematically.
 
   \<^medskip>
   \<^emph>\<open>Explicit completion\<close> is triggered by the action @{action_ref
   "isabelle.complete"}, which is bound to the keyboard shortcut \<^verbatim>\<open>C+b\<close>, and
   thus overrides the jEdit default for @{action_ref "complete-word"}.
 
   \<^emph>\<open>Implicit completion\<close> hooks into the regular keyboard input stream of the
   editor, with some event filtering and optional delays.
 
   \<^medskip>
   Completion options may be configured in \<^emph>\<open>Plugin Options~/ Isabelle~/
   General~/ Completion\<close>. These are explained in further detail below, whenever
   relevant. There is also a summary of options in
   \secref{sec:completion-options}.
 
   The asynchronous nature of PIDE interaction means that information from the
   prover is delayed --- at least by a full round-trip of the document update
   protocol. The default options already take this into account, with a
   sufficiently long completion delay to speculate on the availability of all
   relevant information from the editor and the prover, before completing text
   immediately or producing a popup. Although there is an inherent danger of
   non-deterministic behaviour due to such real-time parameters, the general
   completion policy aims at determined results as far as possible.
 \<close>
 
 
 subsection \<open>Varieties of completion \label{sec:completion-varieties}\<close>
 
 subsubsection \<open>Built-in templates\<close>
 
 text \<open>
   Isabelle is ultimately a framework of nested sub-languages of different
   kinds and purposes. The completion mechanism supports this by the following
   built-in templates:
 
     \<^descr> \<^verbatim>\<open>`\<close> (single ASCII back-quote) or \<^verbatim>\<open>"\<close> (double ASCII quote) support
     \<^emph>\<open>quotations\<close> via text cartouches. There are three selections, which are
     always presented in the same order and do not depend on any context
     information. The default choice produces a template ``\<open>\<open>\<box>\<close>\<close>'', where the
     box indicates the cursor position after insertion; the other choices help
     to repair the block structure of unbalanced text cartouches.
 
     \<^descr> \<^verbatim>\<open>@{\<close> is completed to the template ``\<open>@{\<box>}\<close>'', where the box indicates
     the cursor position after insertion. Here it is convenient to use the
     wildcard ``\<^verbatim>\<open>__\<close>'' or a more specific name prefix to let semantic
     completion of name-space entries propose antiquotation names.
 
   With some practice, input of quoted sub-languages and antiquotations of
   embedded languages should work smoothly. Note that national keyboard layouts
   might cause problems with back-quote as dead key, but double quote can be
   used instead.
 \<close>
 
 
 subsubsection \<open>Syntax keywords\<close>
 
 text \<open>
   Syntax completion tables are determined statically from the keywords of the
   ``outer syntax'' of the underlying edit mode: for theory files this is the
   syntax of Isar commands according to the cumulative theory imports.
 
   Keywords are usually plain words, which means the completion mechanism only
   inserts them directly into the text for explicit completion
   (\secref{sec:completion-input}), but produces a popup
   (\secref{sec:completion-popup}) otherwise.
 
   At the point where outer syntax keywords are defined, it is possible to
   specify an alternative replacement string to be inserted instead of the
   keyword itself. An empty string means to suppress the keyword altogether,
   which is occasionally useful to avoid confusion, e.g.\ the rare keyword
   @{command simproc_setup} vs.\ the frequent name-space entry \<open>simp\<close>.
 \<close>
 
 
 subsubsection \<open>Isabelle symbols\<close>
 
 text \<open>
   The completion tables for Isabelle symbols (\secref{sec:symbols}) are
   determined statically from \<^file>\<open>$ISABELLE_HOME/etc/symbols\<close> and
   \<^path>\<open>$ISABELLE_HOME_USER/etc/symbols\<close> for each symbol specification as
   follows:
 
   \<^medskip>
   \begin{tabular}{ll}
   \<^bold>\<open>completion entry\<close> & \<^bold>\<open>example\<close> \\\hline
   literal symbol & \<^verbatim>\<open>\<forall>\<close> \\
   symbol name with backslash & \<^verbatim>\<open>\\<close>\<^verbatim>\<open>forall\<close> \\
   symbol abbreviation & \<^verbatim>\<open>ALL\<close> or \<^verbatim>\<open>!\<close> \\
   \end{tabular}
   \<^medskip>
 
   When inserted into the text, the above examples all produce the same Unicode
   rendering \<open>\<forall>\<close> of the underlying symbol \<^verbatim>\<open>\<forall>\<close>.
 
   A symbol abbreviation that is a plain word, like \<^verbatim>\<open>ALL\<close>, is treated like a
   syntax keyword. Non-word abbreviations like \<^verbatim>\<open>-->\<close> are inserted more
   aggressively, except for single-character abbreviations like \<^verbatim>\<open>!\<close> above.
 
   Completion via abbreviations like \<^verbatim>\<open>ALL\<close> or \<^verbatim>\<open>-->\<close> depends on the semantic
   language context (\secref{sec:completion-context}). In contrast, backslash
   sequences like \<^verbatim>\<open>\forall\<close> \<^verbatim>\<open>\<forall>\<close> are always possible, but require additional
   interaction to confirm (via popup). This is important in ambiguous
   situations, e.g.\ for Isabelle document source, which may contain formal
   symbols or informal {\LaTeX} macros. Backslash sequences also help when
   input is broken, and thus escapes its normal semantic context: e.g.\
   antiquotations or string literals in ML, which do not allow arbitrary
   backslash sequences.
 
   Special symbols like \<^verbatim>\<open>\<comment>\<close> or control symbols like \<^verbatim>\<open>\<^cancel>\<close>,
   \<^verbatim>\<open>\<^latex>\<close>, \<^verbatim>\<open>\<^binding>\<close> can have an argument: completing on a name
   prefix offers a template with an empty cartouche. Thus completion of \<^verbatim>\<open>\co\<close>
   or \<^verbatim>\<open>\ca\<close> allows to compose formal document comments quickly.\<^footnote>\<open>It is
   customary to put a space between \<^verbatim>\<open>\<comment>\<close> and its argument, while
   control symbols do \<^emph>\<open>not\<close> allow extra space here.\<close>
 \<close>
 
 
 subsubsection \<open>User-defined abbreviations\<close>
 
 text \<open>
   The theory header syntax supports abbreviations via the \<^theory_text>\<open>abbrevs\<close> keyword
-  @{cite "isabelle-isar-ref"}. This is a slight generalization of built-in
+  \<^cite>\<open>"isabelle-isar-ref"\<close>. This is a slight generalization of built-in
   templates and abbreviations for Isabelle symbols, as explained above.
   Examples may be found in the Isabelle sources, by searching for
   ``\<^verbatim>\<open>abbrevs\<close>'' in \<^verbatim>\<open>*.thy\<close> files.
 
   The \<^emph>\<open>Symbols\<close> panel shows the abbreviations that are available in the
   current theory buffer (according to its \<^theory_text>\<open>imports\<close>) in the \<^verbatim>\<open>Abbrevs\<close> tab.
 \<close>
 
 
 subsubsection \<open>Name-space entries\<close>
 
 text \<open>
   This is genuine semantic completion, using information from the prover, so
   it requires some delay. A \<^emph>\<open>failed name-space lookup\<close> produces an error
   message that is annotated with a list of alternative names that are legal.
   The list of results is truncated according to the system option
   @{system_option_ref completion_limit}. The completion mechanism takes this
   into account when collecting information on the prover side.
 
   Already recognized names are \<^emph>\<open>not\<close> completed further, but completion may be
   extended by appending a suffix of underscores. This provokes a failed
   lookup, and another completion attempt (ignoring the underscores). For
   example, in a name space where \<^verbatim>\<open>foo\<close> and \<^verbatim>\<open>foobar\<close> are known, the input
   \<^verbatim>\<open>foo\<close> remains unchanged, but \<^verbatim>\<open>foo_\<close> may be completed to \<^verbatim>\<open>foo\<close> or
   \<^verbatim>\<open>foobar\<close>.
 
   The special identifier ``\<^verbatim>\<open>__\<close>'' serves as a wild-card for arbitrary
   completion: it exposes the name-space content to the completion mechanism
   (truncated according to @{system_option completion_limit}). This is
   occasionally useful to explore an unknown name-space, e.g.\ in some
   template.
 \<close>
 
 
 subsubsection \<open>File-system paths\<close>
 
 text \<open>
   Depending on prover markup about file-system paths in the source text, e.g.\
   for the argument of a load command (\secref{sec:aux-files}), the completion
   mechanism explores the directory content and offers the result as completion
   popup. Relative path specifications are understood wrt.\ the \<^emph>\<open>master
   directory\<close> of the document node (\secref{sec:buffer-node}) of the enclosing
   editor buffer; this requires a proper theory, not an auxiliary file.
 
   A suffix of slashes may be used to continue the exploration of an already
   recognized directory name.
 \<close>
 
 
 subsubsection \<open>Spell-checking\<close>
 
 text \<open>
   The spell-checker combines semantic markup from the prover (regions of plain
   words) with static dictionaries (word lists) that are known to the editor.
 
   Unknown words are underlined in the text, using @{system_option_ref
   spell_checker_color} (blue by default). This is not an error, but a hint to
   the user that some action may be taken. The jEdit context menu provides
   various actions, as far as applicable:
 
   \<^medskip>
   \begin{tabular}{l}
   @{action_ref "isabelle.complete-word"} \\
   @{action_ref "isabelle.exclude-word"} \\
   @{action_ref "isabelle.exclude-word-permanently"} \\
   @{action_ref "isabelle.include-word"} \\
   @{action_ref "isabelle.include-word-permanently"} \\
   \end{tabular}
   \<^medskip>
 
   Instead of the specific @{action_ref "isabelle.complete-word"}, it is also
   possible to use the generic @{action_ref "isabelle.complete"} with its
   default keyboard shortcut \<^verbatim>\<open>C+b\<close>.
 
   \<^medskip>
   Dictionary lookup uses some educated guesses about lower-case, upper-case,
   and capitalized words. This is oriented on common use in English, where this
   aspect is not decisive for proper spelling (in contrast to German, for
   example).
 \<close>
 
 
 subsection \<open>Semantic completion context \label{sec:completion-context}\<close>
 
 text \<open>
   Completion depends on a semantic context that is provided by the prover,
   although with some delay, because at least a full PIDE protocol round-trip
   is required. Until that information becomes available in the PIDE
   document-model, the default context is given by the outer syntax of the
   editor mode (see also \secref{sec:buffer-node}).
 
   The semantic \<^emph>\<open>language context\<close> provides information about nested
   sub-languages of Isabelle: keywords are only completed for outer syntax, and
   antiquotations for languages that support them. Symbol abbreviations only
   work for specific sub-languages: e.g.\ ``\<^verbatim>\<open>=>\<close>'' is \<^emph>\<open>not\<close> completed in
   regular ML source, but is completed within ML strings, comments,
   antiquotations. Backslash representations of symbols like ``\<^verbatim>\<open>\foobar\<close>'' or
   ``\<^verbatim>\<open>\<foobar>\<close>'' work in any context --- after additional confirmation.
 
   The prover may produce \<^emph>\<open>no completion\<close> markup in exceptional situations, to
   tell that some language keywords should be excluded from further completion
   attempts. For example, ``\<^verbatim>\<open>:\<close>'' within accepted Isar syntax looses its
   meaning as abbreviation for symbol ``\<open>\<in>\<close>''.
 \<close>
 
 
 subsection \<open>Input events \label{sec:completion-input}\<close>
 
 text \<open>
   Completion is triggered by certain events produced by the user, with
   optional delay after keyboard input according to @{system_option
   jedit_completion_delay}.
 
   \<^descr>[Explicit completion] works via action @{action_ref "isabelle.complete"}
   with keyboard shortcut \<^verbatim>\<open>C+b\<close>. This overrides the shortcut for @{action_ref
   "complete-word"} in jEdit, but it is possible to restore the original jEdit
   keyboard mapping of @{action "complete-word"} via \<^emph>\<open>Global Options~/
   Shortcuts\<close> and invent a different one for @{action "isabelle.complete"}.
 
   \<^descr>[Explicit spell-checker completion] works via @{action_ref
   "isabelle.complete-word"}, which is exposed in the jEdit context menu, if
   the mouse points to a word that the spell-checker can complete.
 
   \<^descr>[Implicit completion] works via regular keyboard input of the editor. It
   depends on further side-conditions:
 
     \<^enum> The system option @{system_option_ref jedit_completion} needs to be
     enabled (default).
 
     \<^enum> Completion of syntax keywords requires at least 3 relevant characters in
     the text.
 
     \<^enum> The system option @{system_option_ref jedit_completion_delay} determines
     an additional delay (0.5 by default), before opening a completion popup.
     The delay gives the prover a chance to provide semantic completion
     information, notably the context (\secref{sec:completion-context}).
 
     \<^enum> The system option @{system_option_ref jedit_completion_immediate}
     (enabled by default) controls whether replacement text should be inserted
     immediately without popup, regardless of @{system_option
     jedit_completion_delay}. This aggressive mode of completion is restricted
     to symbol abbreviations that are not plain words (\secref{sec:symbols}).
 
     \<^enum> Completion of symbol abbreviations with only one relevant character in
     the text always enforces an explicit popup, regardless of
     @{system_option_ref jedit_completion_immediate}.
 \<close>
 
 
 subsection \<open>Completion popup \label{sec:completion-popup}\<close>
 
 text \<open>
   A \<^emph>\<open>completion popup\<close> is a minimally invasive GUI component over the text
   area that offers a selection of completion items to be inserted into the
   text, e.g.\ by mouse clicks. Items are sorted dynamically, according to the
   frequency of selection, with persistent history. The popup may interpret
   special keys \<^verbatim>\<open>ENTER\<close>, \<^verbatim>\<open>TAB\<close>, \<^verbatim>\<open>ESCAPE\<close>, \<^verbatim>\<open>UP\<close>, \<^verbatim>\<open>DOWN\<close>, \<^verbatim>\<open>PAGE_UP\<close>,
   \<^verbatim>\<open>PAGE_DOWN\<close>, but all other key events are passed to the underlying text
   area. This allows to ignore unwanted completions most of the time and
   continue typing quickly. Thus the popup serves as a mechanism of
   confirmation of proposed items, while the default is to continue without
   completion.
 
   The meaning of special keys is as follows:
 
   \<^medskip>
   \begin{tabular}{ll}
   \<^bold>\<open>key\<close> & \<^bold>\<open>action\<close> \\\hline
   \<^verbatim>\<open>ENTER\<close> & select completion (if @{system_option jedit_completion_select_enter}) \\
   \<^verbatim>\<open>TAB\<close> & select completion (if @{system_option jedit_completion_select_tab}) \\
   \<^verbatim>\<open>ESCAPE\<close> & dismiss popup \\
   \<^verbatim>\<open>UP\<close> & move up one item \\
   \<^verbatim>\<open>DOWN\<close> & move down one item \\
   \<^verbatim>\<open>PAGE_UP\<close> & move up one page of items \\
   \<^verbatim>\<open>PAGE_DOWN\<close> & move down one page of items \\
   \end{tabular}
   \<^medskip>
 
   Movement within the popup is only active for multiple items. Otherwise the
   corresponding key event retains its standard meaning within the underlying
   text area.
 \<close>
 
 
 subsection \<open>Insertion \label{sec:completion-insert}\<close>
 
 text \<open>
   Completion may first propose replacements to be selected (via a popup), or
   replace text immediately in certain situations and depending on certain
   options like @{system_option jedit_completion_immediate}. In any case,
   insertion works uniformly, by imitating normal jEdit text insertion,
   depending on the state of the \<^emph>\<open>text selection\<close>. Isabelle/jEdit tries to
   accommodate the most common forms of advanced selections in jEdit, but not
   all combinations make sense. At least the following important cases are
   well-defined:
 
     \<^descr>[No selection.] The original is removed and the replacement inserted,
     depending on the caret position.
 
     \<^descr>[Rectangular selection of zero width.] This special case is treated by
     jEdit as ``tall caret'' and insertion of completion imitates its normal
     behaviour: separate copies of the replacement are inserted for each line
     of the selection.
 
     \<^descr>[Other rectangular selection or multiple selections.] Here the original
     is removed and the replacement is inserted for each line (or segment) of
     the selection.
 
   Support for multiple selections is particularly useful for \<^emph>\<open>HyperSearch\<close>:
   clicking on one of the items in the \<^emph>\<open>HyperSearch Results\<close> window makes
   jEdit select all its occurrences in the corresponding line of text. Then
   explicit completion can be invoked via \<^verbatim>\<open>C+b\<close>, e.g.\ to replace occurrences
   of \<^verbatim>\<open>-->\<close> by \<open>\<longrightarrow>\<close>.
 
   \<^medskip>
   Insertion works by removing and inserting pieces of text from the buffer.
   This counts as one atomic operation on the jEdit history. Thus unintended
   completions may be reverted by the regular @{action undo} action of jEdit.
   According to normal jEdit policies, the recovered text after @{action undo}
   is selected: \<^verbatim>\<open>ESCAPE\<close> is required to reset the selection and to continue
   typing more text.
 \<close>
 
 
 subsection \<open>Options \label{sec:completion-options}\<close>
 
 text \<open>
   This is a summary of Isabelle/Scala system options that are relevant for
   completion. They may be configured in \<^emph>\<open>Plugin Options~/ Isabelle~/ General\<close>
   as usual.
 
   \<^item> @{system_option_def completion_limit} specifies the maximum number of
   items for various semantic completion operations (name-space entries etc.)
 
   \<^item> @{system_option_def jedit_completion} guards implicit completion via
   regular jEdit key events (\secref{sec:completion-input}): it allows to
   disable implicit completion altogether.
 
   \<^item> @{system_option_def jedit_completion_select_enter} and @{system_option_def
   jedit_completion_select_tab} enable keys to select a completion item from
   the popup (\secref{sec:completion-popup}). Note that a regular mouse click
   on the list of items is always possible.
 
   \<^item> @{system_option_def jedit_completion_context} specifies whether the
   language context provided by the prover should be used at all. Disabling
   that option makes completion less ``semantic''. Note that incomplete or
   severely broken input may cause some disagreement of the prover and the user
   about the intended language context.
 
   \<^item> @{system_option_def jedit_completion_delay} and @{system_option_def
   jedit_completion_immediate} determine the handling of keyboard events for
   implicit completion (\secref{sec:completion-input}).
 
   A @{system_option jedit_completion_delay}~\<^verbatim>\<open>> 0\<close> postpones the processing of
   key events, until after the user has stopped typing for the given time span,
   but @{system_option jedit_completion_immediate}~\<^verbatim>\<open>= true\<close> means that
   abbreviations of Isabelle symbols are handled nonetheless.
 
   \<^item> @{system_option_def completion_path_ignore} specifies ``glob''
   patterns to ignore in file-system path completion (separated by colons),
   e.g.\ backup files ending with tilde.
 
   \<^item> @{system_option_def spell_checker} is a global guard for all spell-checker
   operations: it allows to disable that mechanism altogether.
 
   \<^item> @{system_option_def spell_checker_dictionary} determines the current
   dictionary, taken from the colon-separated list in the settings variable
   @{setting_def JORTHO_DICTIONARIES}. There are jEdit actions to specify local
   updates to a dictionary, by including or excluding words. The result of
   permanent dictionary updates is stored in the directory
   \<^path>\<open>$ISABELLE_HOME_USER/dictionaries\<close>, in a separate file for each
   dictionary.
 
   \<^item> @{system_option_def spell_checker_include} specifies a comma-separated
   list of markup elements that delimit words in the source that is subject to
   spell-checking, including various forms of comments.
 
   \<^item> @{system_option_def spell_checker_exclude} specifies a comma-separated
   list of markup elements that disable spell-checking (e.g.\ in nested
   antiquotations).
 \<close>
 
 
 section \<open>Automatically tried tools \label{sec:auto-tools}\<close>
 
 text \<open>
   Continuous document processing works asynchronously in the background.
   Visible document source that has been evaluated may get augmented by
   additional results of \<^emph>\<open>asynchronous print functions\<close>. An example for that
   is proof state output, if that is enabled in the Output panel
   (\secref{sec:output}). More heavy-weight print functions may be applied as
   well, e.g.\ to prove or disprove parts of the formal text by other means.
 
   Isabelle/HOL provides various automatically tried tools that operate on
   outermost goal statements (e.g.\ @{command lemma}, @{command theorem}),
   independently of the state of the current proof attempt. They work
   implicitly without any arguments. Results are output as \<^emph>\<open>information
   messages\<close>, which are indicated in the text area by blue squiggles and a blue
   information sign in the gutter (see \figref{fig:auto-tools}). The message
   content may be shown as for other output (see also \secref{sec:output}).
   Some tools produce output with \<^emph>\<open>sendback\<close> markup, which means that clicking
   on certain parts of the text inserts that into the source in the proper
   place.
 
   \begin{figure}[!htb]
   \begin{center}
   \includegraphics[scale=0.333]{auto-tools}
   \end{center}
   \caption{Result of automatically tried tools}
   \label{fig:auto-tools}
   \end{figure}
 
   \<^medskip>
   The following Isabelle system options control the behavior of automatically
   tried tools (see also the jEdit dialog window \<^emph>\<open>Plugin Options~/ Isabelle~/
   General~/ Automatically tried tools\<close>):
 
   \<^item> @{system_option_ref auto_methods} controls automatic use of a combination
   of standard proof methods (@{method auto}, @{method simp}, @{method blast},
-  etc.). This corresponds to the Isar command @{command_ref "try0"} @{cite
-  "isabelle-isar-ref"}.
+  etc.). This corresponds to the Isar command @{command_ref "try0"} \<^cite>\<open>"isabelle-isar-ref"\<close>.
 
   The tool is disabled by default, since unparameterized invocation of
   standard proof methods often consumes substantial CPU resources without
   leading to success.
 
   \<^item> @{system_option_ref auto_nitpick} controls a slightly reduced version of
   @{command_ref nitpick}, which tests for counterexamples using first-order
-  relational logic. See also the Nitpick manual @{cite "isabelle-nitpick"}.
+  relational logic. See also the Nitpick manual \<^cite>\<open>"isabelle-nitpick"\<close>.
 
   This tool is disabled by default, due to the extra overhead of invoking an
   external Java process for each attempt to disprove a subgoal.
 
   \<^item> @{system_option_ref auto_quickcheck} controls automatic use of
   @{command_ref quickcheck}, which tests for counterexamples using a series of
   assignments for free variables of a subgoal.
 
   This tool is \<^emph>\<open>enabled\<close> by default. It requires little overhead, but is a
   bit weaker than @{command nitpick}.
 
   \<^item> @{system_option_ref auto_sledgehammer} controls a significantly reduced
   version of @{command_ref sledgehammer}, which attempts to prove a subgoal
-  using external automatic provers. See also the Sledgehammer manual @{cite
-  "isabelle-sledgehammer"}.
+  using external automatic provers. See also the Sledgehammer manual \<^cite>\<open>"isabelle-sledgehammer"\<close>.
 
   This tool is disabled by default, due to the relatively heavy nature of
   Sledgehammer.
 
   \<^item> @{system_option_ref auto_solve_direct} controls automatic use of
   @{command_ref solve_direct}, which checks whether the current subgoals can
   be solved directly by an existing theorem. This also helps to detect
   duplicate lemmas.
 
   This tool is \<^emph>\<open>enabled\<close> by default.
 
 
   Invocation of automatically tried tools is subject to some global policies
   of parallel execution, which may be configured as follows:
 
   \<^item> @{system_option_ref auto_time_limit} (default 2.0) determines the timeout
   (in seconds) for each tool execution.
 
   \<^item> @{system_option_ref auto_time_start} (default 1.0) determines the start
   delay (in seconds) for automatically tried tools, after the main command
   evaluation is finished.
 
 
   Each tool is submitted independently to the pool of parallel execution tasks
   in Isabelle/ML, using hardwired priorities according to its relative
   ``heaviness''. The main stages of evaluation and printing of proof states
   take precedence, but an already running tool is not canceled and may thus
   reduce reactivity of proof document processing.
 
   Users should experiment how the available CPU resources (number of cores)
   are best invested to get additional feedback from prover in the background,
   by using a selection of weaker or stronger tools.
 \<close>
 
 
 section \<open>Sledgehammer \label{sec:sledgehammer}\<close>
 
 text \<open>
   The \<^emph>\<open>Sledgehammer\<close> panel (\figref{fig:sledgehammer}) provides a view on
   some independent execution of the Isar command @{command_ref sledgehammer},
   with process indicator (spinning wheel) and GUI elements for important
   Sledgehammer arguments and options. Any number of Sledgehammer panels may be
   active, according to the standard policies of Dockable Window Management in
   jEdit. Closing such windows also cancels the corresponding prover tasks.
 
   \begin{figure}[!htb]
   \begin{center}
   \includegraphics[scale=0.333]{sledgehammer}
   \end{center}
   \caption{An instance of the Sledgehammer panel}
   \label{fig:sledgehammer}
   \end{figure}
 
   The \<^emph>\<open>Apply\<close> button attaches a fresh invocation of @{command sledgehammer}
   to the command where the cursor is pointing in the text --- this should be
   some pending proof problem. Further buttons like \<^emph>\<open>Cancel\<close> and \<^emph>\<open>Locate\<close>
   help to manage the running process.
 
   Results appear incrementally in the output window of the panel. Proposed
   proof snippets are marked-up as \<^emph>\<open>sendback\<close>, which means a single mouse
   click inserts the text into a suitable place of the original source. Some
   manual editing may be required nonetheless, say to remove earlier proof
   attempts.
 \<close>
 
 
 chapter \<open>Isabelle document preparation\<close>
 
 text \<open>
   The ultimate purpose of Isabelle is to produce nicely rendered documents
   with the Isabelle document preparation system, which is based on {\LaTeX};
-  see also @{cite "isabelle-system" and "isabelle-isar-ref"}. Isabelle/jEdit
+  see also \<^cite>\<open>"isabelle-system" and "isabelle-isar-ref"\<close>. Isabelle/jEdit
   provides some additional support for document editing.
 \<close>
 
 
 section \<open>Document outline\<close>
 
 text \<open>
   Theory sources may contain document markup commands, such as @{command_ref
   chapter}, @{command_ref section}, @{command subsection}. The Isabelle
   SideKick parser (\secref{sec:sidekick}) represents this document outline as
   structured tree view, with formal statements and proofs nested inside; see
   \figref{fig:sidekick-document}.
 
   \begin{figure}[!htb]
   \begin{center}
   \includegraphics[scale=0.333]{sidekick-document}
   \end{center}
   \caption{Isabelle document outline via SideKick tree view}
   \label{fig:sidekick-document}
   \end{figure}
 
   It is also possible to use text folding according to this structure, by
   adjusting \<^emph>\<open>Utilities / Buffer Options / Folding mode\<close> of jEdit. The default
   mode \<^verbatim>\<open>isabelle\<close> uses the structure of formal definitions, statements, and
   proofs. The alternative mode \<^verbatim>\<open>sidekick\<close> uses the document structure of the
   SideKick parser, as explained above.
 \<close>
 
 
 section \<open>Markdown structure\<close>
 
 text \<open>
   Document text is internally structured in paragraphs and nested lists, using
   notation that is similar to Markdown\<^footnote>\<open>\<^url>\<open>https://commonmark.org\<close>\<close>. There are
   special control symbols for items of different kinds of lists, corresponding
   to \<^verbatim>\<open>itemize\<close>, \<^verbatim>\<open>enumerate\<close>, \<^verbatim>\<open>description\<close> in {\LaTeX}. This is illustrated
   in for \<^verbatim>\<open>itemize\<close> in \figref{fig:markdown-document}.
 
   \begin{figure}[!htb]
   \begin{center}
   \includegraphics[scale=0.333]{markdown-document}
   \end{center}
   \caption{Markdown structure within document text}
   \label{fig:markdown-document}
   \end{figure}
 
   Items take colour according to the depth of nested lists. This helps to
   explore the implicit rules for list structure interactively. There is also
   markup for individual items and paragraphs in the text: it may be explored
   via mouse hovering with \<^verbatim>\<open>CONTROL\<close> / \<^verbatim>\<open>COMMAND\<close> as usual
   (\secref{sec:tooltips-hyperlinks}).
 \<close>
 
 
 section \<open>Citations and Bib{\TeX} entries \label{sec:bibtex}\<close>
 
 text \<open>
   Citations are managed by {\LaTeX} and Bib{\TeX} in \<^verbatim>\<open>.bib\<close> files. The
-  Isabelle session build process and the @{tool document} tool @{cite
-  "isabelle-system"} are smart enough to assemble the result, based on the
+  Isabelle session build process and the @{tool document} tool \<^cite>\<open>"isabelle-system"\<close> are smart enough to assemble the result, based on the
   session directory layout.
 
-  The document antiquotation \<open>@{cite}\<close> is described in @{cite
-  "isabelle-isar-ref"}. Within the Prover IDE it provides semantic markup for
+  The document antiquotation \<open>@{cite}\<close> is described in \<^cite>\<open>"isabelle-isar-ref"\<close>. Within the Prover IDE it provides semantic markup for
   tooltips, hyperlinks, and completion for Bib{\TeX} database entries.
   Isabelle/jEdit does \<^emph>\<open>not\<close> know about the actual Bib{\TeX} environment used
   in {\LaTeX} batch-mode, but it can take citations from those \<^verbatim>\<open>.bib\<close> files
   that happen to be open in the editor; see \figref{fig:cite-completion}.
 
   \begin{figure}[!htb]
   \begin{center}
   \includegraphics[scale=0.333]{cite-completion}
   \end{center}
   \caption{Semantic completion of citations from open Bib{\TeX} files}
   \label{fig:cite-completion}
   \end{figure}
 
   Isabelle/jEdit also provides IDE support for editing \<^verbatim>\<open>.bib\<close> files
   themselves. There is syntax highlighting based on entry types (according to
   standard Bib{\TeX} styles), a context-menu to compose entries
   systematically, and a SideKick tree view of the overall content; see
   \figref{fig:bibtex-mode}. Semantic checking with errors and warnings is
   performed by the original \<^verbatim>\<open>bibtex\<close> tool using style \<^verbatim>\<open>plain\<close>: different
   Bib{\TeX} styles may produce slightly different results.
 
   \begin{figure}[!htb]
   \begin{center}
   \includegraphics[scale=0.333]{bibtex-mode}
   \end{center}
   \caption{Bib{\TeX} mode with context menu, SideKick tree view, and
     semantic output from the \<^verbatim>\<open>bibtex\<close> tool}
   \label{fig:bibtex-mode}
   \end{figure}
 
   Regular document preview (\secref{sec:document-preview}) of \<^verbatim>\<open>.bib\<close> files
   approximates the usual {\LaTeX} bibliography output in HTML (using style
   \<^verbatim>\<open>unsort\<close>).
 \<close>
 
 
 section \<open>Document preview and printing \label{sec:document-preview}\<close>
 
 text \<open>
   The action @{action_def isabelle.preview} opens an HTML preview of the
   current document node in the default web browser. The content is derived
   from the semantic markup produced by the prover, and thus depends on the
   status of formal processing.
 
   Action @{action_def isabelle.draft} is similar to @{action
   isabelle.preview}, but shows a plain-text document draft.
 
   Both actions show document sources in a regular Web browser, which may be
   also used to print the result in a more portable manner than the Java
   printer dialog of the jEdit @{action_ref print} action.
 \<close>
 
 
 chapter \<open>ML debugging within the Prover IDE\<close>
 
 text \<open>
   Isabelle/ML is based on Poly/ML\<^footnote>\<open>\<^url>\<open>https://www.polyml.org\<close>\<close> and thus
   benefits from the source-level debugger of that implementation of Standard
   ML. The Prover IDE provides the \<^emph>\<open>Debugger\<close> dockable to connect to running
   ML threads, inspect the stack frame with local ML bindings, and evaluate ML
   expressions in a particular run-time context. A typical debugger session is
   shown in \figref{fig:ml-debugger}.
 
   ML debugging depends on the following pre-requisites.
 
     \<^enum> ML source needs to be compiled with debugging enabled. This may be
     controlled for particular chunks of ML sources using any of the subsequent
     facilities.
 
       \<^enum> The system option @{system_option_ref ML_debugger} as implicit state
       of the Isabelle process. It may be changed in the menu \<^emph>\<open>Plugins /
       Plugin Options / Isabelle / General\<close>. ML modules need to be reloaded and
       recompiled to pick up that option as intended.
 
       \<^enum> The configuration option @{attribute_ref ML_debugger}, with an
       attribute of the same name, to update a global or local context (e.g.\
       with the @{command declare} command).
 
       \<^enum> Commands that modify @{attribute ML_debugger} state for individual
       files: @{command_ref ML_file_debug}, @{command_ref ML_file_no_debug},
       @{command_ref SML_file_debug}, @{command_ref SML_file_no_debug}.
 
     The instrumentation of ML code for debugging causes minor run-time
     overhead. ML modules that implement critical system infrastructure may
     lead to deadlocks or other undefined behaviour, when put under debugger
     control!
 
     \<^enum> The \<^emph>\<open>Debugger\<close> panel needs to be active, otherwise the program ignores
     debugger instrumentation of the compiler and runs unmanaged. It is also
     possible to start debugging with the panel open, and later undock it, to
     let the program continue unhindered.
 
     \<^enum> The ML program needs to be stopped at a suitable breakpoint, which may
     be activated individually or globally as follows.
 
     For ML sources that have been compiled with debugger support, the IDE
     visualizes possible breakpoints in the text. A breakpoint may be toggled
     by pointing accurately with the mouse, with a right-click to activate
     jEdit's context menu and its \<^emph>\<open>Toggle Breakpoint\<close> item. Alternatively, the
     \<^emph>\<open>Break\<close> checkbox in the \<^emph>\<open>Debugger\<close> panel may be enabled to stop ML
     threads always at the next possible breakpoint.
 
   Note that the state of individual breakpoints \<^emph>\<open>gets lost\<close> when the
   coresponding ML source is re-compiled! This may happen unintentionally,
   e.g.\ when following hyperlinks into ML modules that have not been loaded
   into the IDE before.
 
   \begin{figure}[!htb]
   \begin{center}
   \includegraphics[scale=0.333]{ml-debugger}
   \end{center}
   \caption{ML debugger session}
   \label{fig:ml-debugger}
   \end{figure}
 
   The debugger panel (\figref{fig:ml-debugger}) shows a list of all threads
   that are presently stopped. Each thread shows a stack of all function
   invocations that lead to the current breakpoint at the top.
 
   It is possible to jump between stack positions freely, by clicking on this
   list. The current situation is displayed in the big output window, as a
   local ML environment with names and printed values.
 
   ML expressions may be evaluated in the current context by entering snippets
   of source into the text fields labeled \<open>Context\<close> and \<open>ML\<close>, and pushing the
   \<open>Eval\<close> button. By default, the source is interpreted as Isabelle/ML with the
   usual support for antiquotations (like @{command ML}, @{command ML_file}).
   Alternatively, strict Standard ML may be enforced via the \<^emph>\<open>SML\<close> checkbox
   (like @{command SML_file}).
 
   The context for Isabelle/ML is optional, it may evaluate to a value of type
   \<^ML_type>\<open>theory\<close>, \<^ML_type>\<open>Proof.context\<close>, or \<^ML_type>\<open>Context.generic\<close>.
   Thus the given ML expression (with its antiquotations) may be subject to the
   intended dynamic run-time context, instead of the static compile-time
   context.
 
   \<^medskip>
   The buttons labeled \<^emph>\<open>Continue\<close>, \<^emph>\<open>Step\<close>, \<^emph>\<open>Step over\<close>, \<^emph>\<open>Step out\<close>
   recommence execution of the program, with different policies concerning
   nested function invocations. The debugger always moves the cursor within the
   ML source to the next breakpoint position, and offers new stack frames as
   before.
 \<close>
 
 
 chapter \<open>Miscellaneous tools\<close>
 
 section \<open>Timing and monitoring\<close>
 
 text \<open>
   Managed evaluation of commands within PIDE documents includes timing
   information, which consists of elapsed (wall-clock) time, CPU time, and GC
   (garbage collection) time. Note that in a multithreaded system it is
   difficult to measure execution time precisely: elapsed time is closer to the
   real requirements of runtime resources than CPU or GC time, which are both
   subject to influences from the parallel environment that are outside the
   scope of the current command transaction.
 
   The \<^emph>\<open>Timing\<close> panel provides an overview of cumulative command timings for
   each document node. Commands with elapsed time below the given threshold are
   ignored in the grand total. Nodes are sorted according to their overall
   timing. For the document node that corresponds to the current buffer,
   individual command timings are shown as well. A double-click on a theory
   node or command moves the editor focus to that particular source position.
 
   It is also possible to reveal individual timing information via some tooltip
   for the corresponding command keyword, using the technique of mouse hovering
   with \<^verbatim>\<open>CONTROL\<close>~/ \<^verbatim>\<open>COMMAND\<close> modifier (\secref{sec:tooltips-hyperlinks}).
   Actual display of timing depends on the global option @{system_option_ref
   jedit_timing_threshold}, which can be configured in \<^emph>\<open>Plugin Options~/
   Isabelle~/ General\<close>.
 
   \<^medskip>
   The jEdit status line includes a monitor widget for the current heap usage
   of the Isabelle/ML process; this includes information about ongoing garbage
   collection (shown as ``ML cleanup''). A double-click opens a new instance of
   the \<^emph>\<open>Monitor\<close> panel, as explained below. There is a similar widget for the
   JVM: a double-click opens an external Java monitor process with detailed
   information and controls for the Java process underlying
   Isabelle/Scala/jEdit (this is based on \<^verbatim>\<open>jconsole\<close>).
 
   \<^medskip>
   The \<^emph>\<open>Monitor\<close> panel visualizes various data collections about recent
   activity of the runtime system of Isabelle/ML and Java. There are buttons to
   request a full garbage collection and sharing of live data on the ML heap.
   The display is continuously updated according to @{system_option_ref
   editor_chart_delay}. Note that the painting of the chart takes considerable
   runtime itself --- on the Java Virtual Machine that runs Isabelle/Scala, not
   Isabelle/ML.
 \<close>
 
 
 section \<open>Low-level output\<close>
 
 text \<open>
   Prover output is normally shown directly in the main text area or specific
   panels like \<^emph>\<open>Output\<close> (\secref{sec:output}) or \<^emph>\<open>State\<close>
   (\secref{sec:state-output}). Beyond this, it is occasionally useful to
   inspect low-level output channels via some of the following additional
   panels:
 
   \<^item> \<^emph>\<open>Protocol\<close> shows internal messages between the Isabelle/Scala and
   Isabelle/ML side of the PIDE document editing protocol. Recording of
   messages starts with the first activation of the corresponding dockable
   window; earlier messages are lost.
 
   Display of protocol messages causes considerable slowdown, so it is
   important to undock all \<^emph>\<open>Protocol\<close> panels for production work.
 
   \<^item> \<^emph>\<open>Raw Output\<close> shows chunks of text from the \<^verbatim>\<open>stdout\<close> and \<^verbatim>\<open>stderr\<close>
   channels of the prover process. Recording of output starts with the first
   activation of the corresponding dockable window; earlier output is lost.
 
   The implicit stateful nature of physical I/O channels makes it difficult to
   relate raw output to the actual command from where it was originating.
   Parallel execution may add to the confusion. Peeking at physical process I/O
   is only the last resort to diagnose problems with tools that are not PIDE
   compliant.
 
   Under normal circumstances, prover output always works via managed message
   channels (corresponding to \<^ML>\<open>writeln\<close>, \<^ML>\<open>warning\<close>,
   \<^ML>\<open>Output.error_message\<close> in Isabelle/ML), which are displayed by regular
   means within the document model (\secref{sec:output}). Unhandled Isabelle/ML
   exceptions are printed by the system via \<^ML>\<open>Output.error_message\<close>.
 
   \<^item> \<^emph>\<open>Syslog\<close> shows system messages that might be relevant to diagnose
   problems with the startup or shutdown phase of the prover process; this also
   includes raw output on \<^verbatim>\<open>stderr\<close>. Isabelle/ML also provides an explicit
   \<^ML>\<open>Output.system_message\<close> operation, which is occasionally useful for
   diagnostic purposes within the system infrastructure itself.
 
   A limited amount of syslog messages are buffered, independently of the
   docking state of the \<^emph>\<open>Syslog\<close> panel. This allows to diagnose serious
   problems with Isabelle/PIDE process management, outside of the actual
   protocol layer.
 
   Under normal situations, such low-level system output can be ignored.
 \<close>
 
 
 chapter \<open>Known problems and workarounds \label{sec:problems}\<close>
 
 text \<open>
   \<^item> \<^bold>\<open>Problem:\<close> Keyboard shortcuts \<^verbatim>\<open>C+PLUS\<close> and \<^verbatim>\<open>C+MINUS\<close> for adjusting the
   editor font size depend on platform details and national keyboards.
 
   \<^bold>\<open>Workaround:\<close> Rebind keys via \<^emph>\<open>Global Options~/ Shortcuts\<close>.
 
   \<^item> \<^bold>\<open>Problem:\<close> The macOS key sequence \<^verbatim>\<open>COMMAND+COMMA\<close> for application
   \<^emph>\<open>Preferences\<close> is in conflict with the jEdit default keyboard shortcut for
   \<^emph>\<open>Incremental Search Bar\<close> (action @{action_ref "quick-search"}).
 
   \<^bold>\<open>Workaround:\<close> Rebind key via \<^emph>\<open>Global Options~/ Shortcuts\<close> according to the
   national keyboard layout, e.g.\ \<^verbatim>\<open>COMMAND+SLASH\<close> on English ones.
 
   \<^item> \<^bold>\<open>Problem:\<close> On macOS with native Apple look-and-feel, some exotic
   national keyboards may cause a conflict of menu accelerator keys with
   regular jEdit key bindings. This leads to duplicate execution of the
   corresponding jEdit action.
 
   \<^bold>\<open>Workaround:\<close> Disable the native Apple menu bar via Java runtime option
   \<^verbatim>\<open>-Dapple.laf.useScreenMenuBar=false\<close>.
 
   \<^item> \<^bold>\<open>Problem:\<close> macOS system fonts sometimes lead to character drop-outs in
   the main text area.
 
   \<^bold>\<open>Workaround:\<close> Use the default \<^verbatim>\<open>Isabelle DejaVu\<close> fonts.
 
   \<^item> \<^bold>\<open>Problem:\<close> On macOS the Java printer dialog sometimes does not work.
 
   \<^bold>\<open>Workaround:\<close> Use action @{action isabelle.draft} and print via the Web
   browser.
 
   \<^item> \<^bold>\<open>Problem:\<close> Antialiased text rendering may show bad performance or bad
   visual quality, notably on Linux/X11.
 
   \<^bold>\<open>Workaround:\<close> The property \<^verbatim>\<open>view.antiAlias\<close> (via menu item Utilities /
   Global Options / Text Area / Anti Aliased smooth text) has the main impact
   on text rendering, but some related properties may also change the
   behaviour. The default is \<^verbatim>\<open>view.antiAlias=subpixel HRGB\<close>: it can be much
   faster than \<^verbatim>\<open>standard\<close>, but occasionally causes problems with odd color
   shades. An alternative is to have \<^verbatim>\<open>view.antiAlias=standard\<close> and set a Java
   system property like this:\<^footnote>\<open>See also
   \<^url>\<open>https://docs.oracle.com/javase/10/troubleshoot/java-2d-pipeline-rendering-and-properties.htm\<close>.\<close>
   @{verbatim [display] \<open>isabelle jedit -Dsun.java2d.opengl=true\<close>}
 
   If this works reliably, it can be made persistent via @{setting
   JEDIT_JAVA_OPTIONS} within \<^path>\<open>$ISABELLE_HOME_USER/etc/settings\<close>. For
   the Isabelle desktop ``app'', there is a corresponding file with Java
   runtime options in the main directory (name depends on the OS platform).
 
   \<^item> \<^bold>\<open>Problem:\<close> Some Linux/X11 input methods such as IBus tend to disrupt key
   event handling of Java/AWT/Swing.
 
   \<^bold>\<open>Workaround:\<close> Do not use X11 input methods. Note that environment variable
   \<^verbatim>\<open>XMODIFIERS\<close> is reset by default within Isabelle settings.
 
   \<^item> \<^bold>\<open>Problem:\<close> Some Linux/X11 window managers that are not ``re-parenting''
   cause problems with additional windows opened by Java. This affects either
   historic or neo-minimalistic window managers like \<^verbatim>\<open>awesome\<close> or \<^verbatim>\<open>xmonad\<close>.
 
   \<^bold>\<open>Workaround:\<close> Use a regular re-parenting X11 window manager.
 
   \<^item> \<^bold>\<open>Problem:\<close> Various forks of Linux/X11 window managers and desktop
   environments (like Gnome) disrupt the handling of menu popups and mouse
   positions of Java/AWT/Swing.
 
   \<^bold>\<open>Workaround:\<close> Use suitable version of Linux desktops.
 
   \<^item> \<^bold>\<open>Problem:\<close> Full-screen mode via jEdit action @{action_ref
   "toggle-full-screen"} (default keyboard shortcut \<^verbatim>\<open>F11\<close> or \<^verbatim>\<open>S+F11\<close>) works
   robustly on Windows, but not on macOS or various Linux/X11 window managers.
   For the latter platforms, it is approximated by educated guesses on the
   window size (excluding the macOS menu bar).
 
   \<^bold>\<open>Workaround:\<close> Use native full-screen control of the macOS window manager.
 
   \<^item> \<^bold>\<open>Problem:\<close> Heap space of the JVM may fill up and render the Prover IDE
   unresponsive, e.g.\ when editing big Isabelle sessions with many theories.
 
   \<^bold>\<open>Workaround:\<close> Increase JVM heap parameters by editing platform-specific
   files (for ``properties'' or ``options'') that are associated with the main
   app bundle.
 \<close>
 
 end
diff --git a/src/Doc/Locales/Examples.thy b/src/Doc/Locales/Examples.thy
--- a/src/Doc/Locales/Examples.thy
+++ b/src/Doc/Locales/Examples.thy
@@ -1,763 +1,763 @@
 theory Examples
 imports Main
 begin
 
 (*
 text {* The following presentation will use notation of
   Isabelle's meta logic, hence a few sentences to explain this.
   The logical
   primitives are universal quantification (@{text "\<And>"}), entailment
   (@{text "\<Longrightarrow>"}) and equality (@{text "\<equiv>"}).  Variables (not bound
   variables) are sometimes preceded by a question mark.  The logic is
   typed.  Type variables are denoted by~@{text "'a"},~@{text "'b"}
   etc., and~@{text "\<Rightarrow>"} is the function type.  Double brackets~@{text
   "\<lbrakk>"} and~@{text "\<rbrakk>"} are used to abbreviate nested entailment.
 *}
 *)
 
 section \<open>Introduction\<close>
 
 text \<open>
   Locales are based on contexts.  A \emph{context} can be seen as a
   formula schema
 \[
   \<open>\<And>x\<^sub>1\<dots>x\<^sub>n. \<lbrakk> A\<^sub>1; \<dots> ;A\<^sub>m \<rbrakk> \<Longrightarrow> \<dots>\<close>
 \]
   where the variables~\<open>x\<^sub>1\<close>, \ldots,~\<open>x\<^sub>n\<close> are called
   \emph{parameters} and the premises $\<open>A\<^sub>1\<close>, \ldots,~\<open>A\<^sub>m\<close>$ \emph{assumptions}.  A formula~\<open>C\<close>
   is a \emph{theorem} in the context if it is a conclusion
 \[
   \<open>\<And>x\<^sub>1\<dots>x\<^sub>n. \<lbrakk> A\<^sub>1; \<dots> ;A\<^sub>m \<rbrakk> \<Longrightarrow> C\<close>.
 \]
   Isabelle/Isar's notion of context goes beyond this logical view.
   Its contexts record, in a consecutive order, proved
   conclusions along with \emph{attributes}, which can provide context
   specific configuration information for proof procedures and concrete
   syntax.  From a logical perspective, locales are just contexts that
   have been made persistent.  To the user, though, they provide
   powerful means for declaring and combining contexts, and for the
   reuse of theorems proved in these contexts.
 \<close>
 
 section \<open>Simple Locales\<close>
 
 text \<open>
   In its simplest form, a
   \emph{locale declaration} consists of a sequence of context elements
   declaring parameters (keyword \isakeyword{fixes}) and assumptions
   (keyword \isakeyword{assumes}).  The following is the specification of
   partial orders, as locale \<open>partial_order\<close>.
 \<close>
 
   locale partial_order =
     fixes le :: "'a \<Rightarrow> 'a \<Rightarrow> bool" (infixl "\<sqsubseteq>" 50)
     assumes refl [intro, simp]: "x \<sqsubseteq> x"
       and anti_sym [intro]: "\<lbrakk> x \<sqsubseteq> y; y \<sqsubseteq> x \<rbrakk> \<Longrightarrow> x = y"
       and trans [trans]: "\<lbrakk> x \<sqsubseteq> y; y \<sqsubseteq> z \<rbrakk> \<Longrightarrow> x \<sqsubseteq> z"
 
 text (in partial_order) \<open>The parameter of this locale is~\<open>le\<close>,
   which is a binary predicate with infix syntax~\<open>\<sqsubseteq>\<close>.  The
   parameter syntax is available in the subsequent
   assumptions, which are the familiar partial order axioms.
 
   Isabelle recognises unbound names as free variables.  In locale
   assumptions, these are implicitly universally quantified.  That is,
   \<^term>\<open>\<lbrakk> x \<sqsubseteq> y; y \<sqsubseteq> z \<rbrakk> \<Longrightarrow> x \<sqsubseteq> z\<close> in fact means
   \<^term>\<open>\<And>x y z. \<lbrakk> x \<sqsubseteq> y; y \<sqsubseteq> z \<rbrakk> \<Longrightarrow> x \<sqsubseteq> z\<close>.
 
   Two commands are provided to inspect locales:
   \isakeyword{print\_locales} lists the names of all locales of the
   current theory; \isakeyword{print\_locale}~$n$ prints the parameters
   and assumptions of locale $n$; the variation \isakeyword{print\_locale!}~$n$
   additionally outputs the conclusions that are stored in the locale.
   We may inspect the new locale
   by issuing \isakeyword{print\_locale!} \<^term>\<open>partial_order\<close>.  The output
   is the following list of context elements.
 \begin{small}
 \begin{alltt}
   \isakeyword{fixes} le :: "'a \(\Rightarrow\) 'a \(\Rightarrow\)  bool" (\isakeyword{infixl} "\(\sqsubseteq\)" 50)
   \isakeyword{assumes} "partial_order (\(\sqsubseteq\))"
   \isakeyword{notes} assumption
     refl [intro, simp] = `?x \(\sqsubseteq\) ?x`
     \isakeyword{and}
     anti_sym [intro] = `\(\isasymlbrakk\)?x \(\sqsubseteq\) ?y; ?y \(\sqsubseteq\) ?x\(\isasymrbrakk\) \(\Longrightarrow\) ?x = ?y`
     \isakeyword{and}
     trans [trans] = `\(\isasymlbrakk\)?x \(\sqsubseteq\) ?y; ?y \(\sqsubseteq\) ?z\(\isasymrbrakk\) \(\Longrightarrow\) ?x \(\sqsubseteq\) ?z`
 \end{alltt}
 \end{small}
 
   This differs from the declaration.  The assumptions have turned into
   conclusions, denoted by the keyword \isakeyword{notes}.  Also,
   there is only one assumption, namely \<^term>\<open>partial_order le\<close>.
   The locale declaration has introduced the predicate \<^term>\<open>partial_order\<close> to the theory.  This predicate is the
   \emph{locale predicate}.  Its definition may be inspected by
   issuing \isakeyword{thm} @{thm [source] partial_order_def}.
   @{thm [display, indent=2] partial_order_def}
   In our example, this is a unary predicate over the parameter of the
   locale.  It is equivalent to the original assumptions, which have
   been turned into conclusions and are
   available as theorems in the context of the locale.  The names and
   attributes from the locale declaration are associated to these
   theorems and are effective in the context of the locale.
 
   Each conclusion has a \emph{foundational theorem} as counterpart
   in the theory.  Technically, this is simply the theorem composed
   of context and conclusion.  For the transitivity theorem, this is
   @{thm [source] partial_order.trans}:
   @{thm [display, indent=2] partial_order.trans}
 \<close>
 
 subsection \<open>Targets: Extending Locales\<close>
 
 text \<open>
   The specification of a locale is fixed, but its list of conclusions
   may be extended through Isar commands that take a \emph{target} argument.
   In the following, \isakeyword{definition} and 
   \isakeyword{theorem} are illustrated.
   Table~\ref{tab:commands-with-target} lists Isar commands that accept
   a target.  Isar provides various ways of specifying the target.  A
   target for a single command may be indicated with keyword
   \isakeyword{in} in the following way:
 
 \begin{table}
 \hrule
 \vspace{2ex}
 \begin{center}
 \begin{tabular}{ll}
   \isakeyword{definition} & definition through an equation \\
   \isakeyword{inductive} & inductive definition \\
   \isakeyword{primrec} & primitive recursion \\
   \isakeyword{fun}, \isakeyword{function} & general recursion \\
   \isakeyword{abbreviation} & syntactic abbreviation \\
   \isakeyword{theorem}, etc.\ & theorem statement with proof \\
   \isakeyword{theorems}, etc.\ & redeclaration of theorems \\
   \isakeyword{text}, etc.\ & document markup
 \end{tabular}
 \end{center}
 \hrule
 \caption{Isar commands that accept a target.}
 \label{tab:commands-with-target}
 \end{table}
 \<close>
 
   definition (in partial_order)
     less :: "'a \<Rightarrow> 'a \<Rightarrow> bool" (infixl "\<sqsubset>" 50)
     where "(x \<sqsubset> y) = (x \<sqsubseteq> y \<and> x \<noteq> y)"
 
 text (in partial_order) \<open>The strict order \<open>less\<close> with infix
   syntax~\<open>\<sqsubset>\<close> is
   defined in terms of the locale parameter~\<open>le\<close> and the general
   equality of the object logic we work in.  The definition generates a
   \emph{foundational constant}
   \<^term>\<open>partial_order.less\<close> with definition @{thm [source]
   partial_order.less_def}:
   @{thm [display, indent=2] partial_order.less_def}
   At the same time, the locale is extended by syntax transformations
   hiding this construction in the context of the locale.  Here, the
   abbreviation \<open>less\<close> is available for
   \<open>partial_order.less le\<close>, and it is printed
   and parsed as infix~\<open>\<sqsubset>\<close>.  Finally, the conclusion @{thm [source]
   less_def} is added to the locale:
   @{thm [display, indent=2] less_def}
 \<close>
 
 text \<open>The treatment of theorem statements is more straightforward.
   As an example, here is the derivation of a transitivity law for the
   strict order relation.\<close>
 
   lemma (in partial_order) less_le_trans [trans]:
     "\<lbrakk> x \<sqsubset> y; y \<sqsubseteq> z \<rbrakk> \<Longrightarrow> x \<sqsubset> z"
     unfolding %visible less_def by %visible (blast intro: trans)
 
 text \<open>In the context of the proof, conclusions of the
   locale may be used like theorems.  Attributes are effective: \<open>anti_sym\<close> was
   declared as introduction rule, hence it is in the context's set of
   rules used by the classical reasoner by default.\<close>
 
 subsection \<open>Context Blocks\<close>
 
 text \<open>When working with locales, sequences of commands with the same
   target are frequent.  A block of commands, delimited by
   \isakeyword{begin} and \isakeyword{end}, makes a theory-like style
   of working possible.  All commands inside the block refer to the
   same target.  A block may immediately follow a locale
   declaration, which makes that locale the target.  Alternatively the
   target for a block may be given with the \isakeyword{context}
   command.
 
   This style of working is illustrated in the block below, where
   notions of infimum and supremum for partial orders are introduced,
   together with theorems about their uniqueness.\<close>
 
   context partial_order
   begin
 
   definition
     is_inf where "is_inf x y i =
       (i \<sqsubseteq> x \<and> i \<sqsubseteq> y \<and> (\<forall>z. z \<sqsubseteq> x \<and> z \<sqsubseteq> y \<longrightarrow> z \<sqsubseteq> i))"
 
   definition
     is_sup where "is_sup x y s =
       (x \<sqsubseteq> s \<and> y \<sqsubseteq> s \<and> (\<forall>z. x \<sqsubseteq> z \<and> y \<sqsubseteq> z \<longrightarrow> s \<sqsubseteq> z))"
 
   lemma %invisible is_infI [intro?]: "i \<sqsubseteq> x \<Longrightarrow> i \<sqsubseteq> y \<Longrightarrow>
       (\<And>z. z \<sqsubseteq> x \<Longrightarrow> z \<sqsubseteq> y \<Longrightarrow> z \<sqsubseteq> i) \<Longrightarrow> is_inf x y i"
     by (unfold is_inf_def) blast
 
   lemma %invisible is_inf_lower [elim?]:
     "is_inf x y i \<Longrightarrow> (i \<sqsubseteq> x \<Longrightarrow> i \<sqsubseteq> y \<Longrightarrow> C) \<Longrightarrow> C"
     by (unfold is_inf_def) blast
 
   lemma %invisible is_inf_greatest [elim?]:
       "is_inf x y i \<Longrightarrow> z \<sqsubseteq> x \<Longrightarrow> z \<sqsubseteq> y \<Longrightarrow> z \<sqsubseteq> i"
     by (unfold is_inf_def) blast
 
   theorem is_inf_uniq: "\<lbrakk>is_inf x y i; is_inf x y i'\<rbrakk> \<Longrightarrow> i = i'"
     proof -
     assume inf: "is_inf x y i"
     assume inf': "is_inf x y i'"
     show ?thesis
     proof (rule anti_sym)
       from inf' show "i \<sqsubseteq> i'"
       proof (rule is_inf_greatest)
         from inf show "i \<sqsubseteq> x" ..
         from inf show "i \<sqsubseteq> y" ..
       qed
       from inf show "i' \<sqsubseteq> i"
       proof (rule is_inf_greatest)
         from inf' show "i' \<sqsubseteq> x" ..
         from inf' show "i' \<sqsubseteq> y" ..
       qed
     qed
   qed
 
   theorem %invisible is_inf_related [elim?]: "x \<sqsubseteq> y \<Longrightarrow> is_inf x y x"
   proof -
     assume "x \<sqsubseteq> y"
     show ?thesis
     proof
       show "x \<sqsubseteq> x" ..
       show "x \<sqsubseteq> y" by fact
       fix z assume "z \<sqsubseteq> x" and "z \<sqsubseteq> y" show "z \<sqsubseteq> x" by fact
     qed
   qed
 
   lemma %invisible is_supI [intro?]: "x \<sqsubseteq> s \<Longrightarrow> y \<sqsubseteq> s \<Longrightarrow>
       (\<And>z. x \<sqsubseteq> z \<Longrightarrow> y \<sqsubseteq> z \<Longrightarrow> s \<sqsubseteq> z) \<Longrightarrow> is_sup x y s"
     by (unfold is_sup_def) blast
 
   lemma %invisible is_sup_least [elim?]:
       "is_sup x y s \<Longrightarrow> x \<sqsubseteq> z \<Longrightarrow> y \<sqsubseteq> z \<Longrightarrow> s \<sqsubseteq> z"
     by (unfold is_sup_def) blast
 
   lemma %invisible is_sup_upper [elim?]:
       "is_sup x y s \<Longrightarrow> (x \<sqsubseteq> s \<Longrightarrow> y \<sqsubseteq> s \<Longrightarrow> C) \<Longrightarrow> C"
     by (unfold is_sup_def) blast
 
   theorem is_sup_uniq: "\<lbrakk>is_sup x y s; is_sup x y s'\<rbrakk> \<Longrightarrow> s = s'"
     proof -
     assume sup: "is_sup x y s"
     assume sup': "is_sup x y s'"
     show ?thesis
     proof (rule anti_sym)
       from sup show "s \<sqsubseteq> s'"
       proof (rule is_sup_least)
         from sup' show "x \<sqsubseteq> s'" ..
         from sup' show "y \<sqsubseteq> s'" ..
       qed
       from sup' show "s' \<sqsubseteq> s"
       proof (rule is_sup_least)
         from sup show "x \<sqsubseteq> s" ..
         from sup show "y \<sqsubseteq> s" ..
       qed
     qed
   qed
 
   theorem %invisible is_sup_related [elim?]: "x \<sqsubseteq> y \<Longrightarrow> is_sup x y y"
   proof -
     assume "x \<sqsubseteq> y"
     show ?thesis
     proof
       show "x \<sqsubseteq> y" by fact
       show "y \<sqsubseteq> y" ..
       fix z assume "x \<sqsubseteq> z" and "y \<sqsubseteq> z"
       show "y \<sqsubseteq> z" by fact
     qed
   qed
 
   end
 
 text \<open>The syntax of the locale commands discussed in this tutorial is
   shown in Table~\ref{tab:commands}.  The grammar is complete with the
   exception of the context elements \isakeyword{constrains} and
   \isakeyword{defines}, which are provided for backward
   compatibility.  See the Isabelle/Isar Reference
-  Manual @{cite IsarRef} for full documentation.\<close>
+  Manual \<^cite>\<open>IsarRef\<close> for full documentation.\<close>
 
 
 section \<open>Import \label{sec:import}\<close>
 
 text \<open>
   Algebraic structures are commonly defined by adding operations and
   properties to existing structures.  For example, partial orders
   are extended to lattices and total orders.  Lattices are extended to
   distributive lattices.\<close>
 
 text \<open>
   With locales, this kind of inheritance is achieved through
   \emph{import} of locales.  The import part of a locale declaration,
   if present, precedes the context elements.  Here is an example,
   where partial orders are extended to lattices.
 \<close>
 
   locale lattice = partial_order +
     assumes ex_inf: "\<exists>inf. is_inf x y inf"
       and ex_sup: "\<exists>sup. is_sup x y sup"
   begin
 
 text \<open>These assumptions refer to the predicates for infimum
   and supremum defined for \<open>partial_order\<close> in the previous
   section.  We now introduce the notions of meet and join,
   together with an example theorem.\<close>
 
   definition
     meet (infixl "\<sqinter>" 70) where "x \<sqinter> y = (THE inf. is_inf x y inf)"
   definition
     join (infixl "\<squnion>" 65) where "x \<squnion> y = (THE sup. is_sup x y sup)"
 
   lemma %invisible meet_equality [elim?]: "is_inf x y i \<Longrightarrow> x \<sqinter> y = i"
   proof (unfold meet_def)
     assume "is_inf x y i"
     then show "(THE i. is_inf x y i) = i"
       by (rule the_equality) (rule is_inf_uniq [OF _ \<open>is_inf x y i\<close>])
   qed
 
   lemma %invisible meetI [intro?]:
       "i \<sqsubseteq> x \<Longrightarrow> i \<sqsubseteq> y \<Longrightarrow> (\<And>z. z \<sqsubseteq> x \<Longrightarrow> z \<sqsubseteq> y \<Longrightarrow> z \<sqsubseteq> i) \<Longrightarrow> x \<sqinter> y = i"
     by (rule meet_equality, rule is_infI) blast+
 
   lemma %invisible is_inf_meet [intro?]: "is_inf x y (x \<sqinter> y)"
   proof (unfold meet_def)
     from ex_inf obtain i where "is_inf x y i" ..
     then show "is_inf x y (THE i. is_inf x y i)"
       by (rule theI) (rule is_inf_uniq [OF _ \<open>is_inf x y i\<close>])
   qed
 
   lemma meet_left(*<*)[intro?](*>*): "x \<sqinter> y \<sqsubseteq> x"
     by (rule is_inf_lower) (rule is_inf_meet)
 
   lemma %invisible meet_right [intro?]:
     "x \<sqinter> y \<sqsubseteq> y"
     by (rule is_inf_lower) (rule is_inf_meet)
 
   lemma %invisible meet_le [intro?]:
     "\<lbrakk> z \<sqsubseteq> x; z \<sqsubseteq> y \<rbrakk> \<Longrightarrow> z \<sqsubseteq> x \<sqinter> y"
     by (rule is_inf_greatest) (rule is_inf_meet)
 
   lemma %invisible join_equality [elim?]: "is_sup x y s \<Longrightarrow> x \<squnion> y = s"
   proof (unfold join_def)
     assume "is_sup x y s"
     then show "(THE s. is_sup x y s) = s"
       by (rule the_equality) (rule is_sup_uniq [OF _ \<open>is_sup x y s\<close>])
   qed
 
   lemma %invisible joinI [intro?]: "x \<sqsubseteq> s \<Longrightarrow> y \<sqsubseteq> s \<Longrightarrow>
       (\<And>z. x \<sqsubseteq> z \<Longrightarrow> y \<sqsubseteq> z \<Longrightarrow> s \<sqsubseteq> z) \<Longrightarrow> x \<squnion> y = s"
     by (rule join_equality, rule is_supI) blast+
 
   lemma %invisible is_sup_join [intro?]: "is_sup x y (x \<squnion> y)"
   proof (unfold join_def)
     from ex_sup obtain s where "is_sup x y s" ..
     then show "is_sup x y (THE s. is_sup x y s)"
       by (rule theI) (rule is_sup_uniq [OF _ \<open>is_sup x y s\<close>])
   qed
 
   lemma %invisible join_left [intro?]:
     "x \<sqsubseteq> x \<squnion> y"
     by (rule is_sup_upper) (rule is_sup_join)
 
   lemma %invisible join_right [intro?]:
     "y \<sqsubseteq> x \<squnion> y"
     by (rule is_sup_upper) (rule is_sup_join)
 
   lemma %invisible join_le [intro?]:
     "\<lbrakk> x \<sqsubseteq> z; y \<sqsubseteq> z \<rbrakk> \<Longrightarrow> x \<squnion> y \<sqsubseteq> z"
     by (rule is_sup_least) (rule is_sup_join)
 
   theorem %invisible meet_assoc: "(x \<sqinter> y) \<sqinter> z = x \<sqinter> (y \<sqinter> z)"
   proof (rule meetI)
     show "x \<sqinter> (y \<sqinter> z) \<sqsubseteq> x \<sqinter> y"
     proof
       show "x \<sqinter> (y \<sqinter> z) \<sqsubseteq> x" ..
       show "x \<sqinter> (y \<sqinter> z) \<sqsubseteq> y"
       proof -
         have "x \<sqinter> (y \<sqinter> z) \<sqsubseteq> y \<sqinter> z" ..
         also have "\<dots> \<sqsubseteq> y" ..
         finally show ?thesis .
       qed
     qed
     show "x \<sqinter> (y \<sqinter> z) \<sqsubseteq> z"
     proof -
       have "x \<sqinter> (y \<sqinter> z) \<sqsubseteq> y \<sqinter> z" ..
       also have "\<dots> \<sqsubseteq> z" ..
       finally show ?thesis .
     qed
     fix w assume "w \<sqsubseteq> x \<sqinter> y" and "w \<sqsubseteq> z"
     show "w \<sqsubseteq> x \<sqinter> (y \<sqinter> z)"
     proof
       show "w \<sqsubseteq> x"
       proof -
         have "w \<sqsubseteq> x \<sqinter> y" by fact
         also have "\<dots> \<sqsubseteq> x" ..
         finally show ?thesis .
       qed
       show "w \<sqsubseteq> y \<sqinter> z"
       proof
         show "w \<sqsubseteq> y"
         proof -
           have "w \<sqsubseteq> x \<sqinter> y" by fact
           also have "\<dots> \<sqsubseteq> y" ..
           finally show ?thesis .
         qed
         show "w \<sqsubseteq> z" by fact
       qed
     qed
   qed
 
   theorem %invisible meet_commute: "x \<sqinter> y = y \<sqinter> x"
   proof (rule meetI)
     show "y \<sqinter> x \<sqsubseteq> x" ..
     show "y \<sqinter> x \<sqsubseteq> y" ..
     fix z assume "z \<sqsubseteq> y" and "z \<sqsubseteq> x"
     then show "z \<sqsubseteq> y \<sqinter> x" ..
   qed
 
   theorem %invisible meet_join_absorb: "x \<sqinter> (x \<squnion> y) = x"
   proof (rule meetI)
     show "x \<sqsubseteq> x" ..
     show "x \<sqsubseteq> x \<squnion> y" ..
     fix z assume "z \<sqsubseteq> x" and "z \<sqsubseteq> x \<squnion> y"
     show "z \<sqsubseteq> x" by fact
   qed
 
   theorem %invisible join_assoc: "(x \<squnion> y) \<squnion> z = x \<squnion> (y \<squnion> z)"
   proof (rule joinI)
     show "x \<squnion> y \<sqsubseteq> x \<squnion> (y \<squnion> z)"
     proof
       show "x \<sqsubseteq> x \<squnion> (y \<squnion> z)" ..
       show "y \<sqsubseteq> x \<squnion> (y \<squnion> z)"
       proof -
         have "y \<sqsubseteq> y \<squnion> z" ..
         also have "... \<sqsubseteq> x \<squnion> (y \<squnion> z)" ..
         finally show ?thesis .
       qed
     qed
     show "z \<sqsubseteq> x \<squnion> (y \<squnion> z)"
     proof -
       have "z \<sqsubseteq> y \<squnion> z"  ..
       also have "... \<sqsubseteq> x \<squnion> (y \<squnion> z)" ..
       finally show ?thesis .
     qed
     fix w assume "x \<squnion> y \<sqsubseteq> w" and "z \<sqsubseteq> w"
     show "x \<squnion> (y \<squnion> z) \<sqsubseteq> w"
     proof
       show "x \<sqsubseteq> w"
       proof -
         have "x \<sqsubseteq> x \<squnion> y" ..
         also have "\<dots> \<sqsubseteq> w" by fact
         finally show ?thesis .
       qed
       show "y \<squnion> z \<sqsubseteq> w"
       proof
         show "y \<sqsubseteq> w"
         proof -
           have "y \<sqsubseteq> x \<squnion> y" ..
           also have "... \<sqsubseteq> w" by fact
           finally show ?thesis .
         qed
         show "z \<sqsubseteq> w" by fact
       qed
     qed
   qed
 
   theorem %invisible join_commute: "x \<squnion> y = y \<squnion> x"
   proof (rule joinI)
     show "x \<sqsubseteq> y \<squnion> x" ..
     show "y \<sqsubseteq> y \<squnion> x" ..
     fix z assume "y \<sqsubseteq> z" and "x \<sqsubseteq> z"
     then show "y \<squnion> x \<sqsubseteq> z" ..
   qed
 
   theorem %invisible join_meet_absorb: "x \<squnion> (x \<sqinter> y) = x"
   proof (rule joinI)
     show "x \<sqsubseteq> x" ..
     show "x \<sqinter> y \<sqsubseteq> x" ..
     fix z assume "x \<sqsubseteq> z" and "x \<sqinter> y \<sqsubseteq> z"
     show "x \<sqsubseteq> z" by fact
   qed
 
   theorem %invisible meet_idem: "x \<sqinter> x = x"
   proof -
     have "x \<sqinter> (x \<squnion> (x \<sqinter> x)) = x" by (rule meet_join_absorb)
     also have "x \<squnion> (x \<sqinter> x) = x" by (rule join_meet_absorb)
     finally show ?thesis .
   qed
 
   theorem %invisible meet_related [elim?]: "x \<sqsubseteq> y \<Longrightarrow> x \<sqinter> y = x"
   proof (rule meetI)
     assume "x \<sqsubseteq> y"
     show "x \<sqsubseteq> x" ..
     show "x \<sqsubseteq> y" by fact
     fix z assume "z \<sqsubseteq> x" and "z \<sqsubseteq> y"
     show "z \<sqsubseteq> x" by fact
   qed
 
   theorem %invisible meet_related2 [elim?]: "y \<sqsubseteq> x \<Longrightarrow> x \<sqinter> y = y"
     by (drule meet_related) (simp add: meet_commute)
 
   theorem %invisible join_related [elim?]: "x \<sqsubseteq> y \<Longrightarrow> x \<squnion> y = y"
   proof (rule joinI)
     assume "x \<sqsubseteq> y"
     show "y \<sqsubseteq> y" ..
     show "x \<sqsubseteq> y" by fact
     fix z assume "x \<sqsubseteq> z" and "y \<sqsubseteq> z"
     show "y \<sqsubseteq> z" by fact
   qed
 
   theorem %invisible join_related2 [elim?]: "y \<sqsubseteq> x \<Longrightarrow> x \<squnion> y = x"
     by (drule join_related) (simp add: join_commute)
 
   theorem %invisible meet_connection: "(x \<sqsubseteq> y) = (x \<sqinter> y = x)"
   proof
     assume "x \<sqsubseteq> y"
     then have "is_inf x y x" ..
     then show "x \<sqinter> y = x" ..
   next
     have "x \<sqinter> y \<sqsubseteq> y" ..
     also assume "x \<sqinter> y = x"
     finally show "x \<sqsubseteq> y" .
   qed
 
   theorem %invisible join_connection: "(x \<sqsubseteq> y) = (x \<squnion> y = y)"
   proof
     assume "x \<sqsubseteq> y"
     then have "is_sup x y y" ..
     then show "x \<squnion> y = y" ..
   next
     have "x \<sqsubseteq> x \<squnion> y" ..
     also assume "x \<squnion> y = y"
     finally show "x \<sqsubseteq> y" .
   qed
 
   theorem %invisible meet_connection2: "(x \<sqsubseteq> y) = (y \<sqinter> x = x)"
     using meet_commute meet_connection by simp
 
   theorem %invisible join_connection2: "(x \<sqsubseteq> y) = (x \<squnion> y = y)"
     using join_commute join_connection by simp
 
   text %invisible \<open>Naming according to Jacobson I, p.\ 459.\<close>
   lemmas %invisible L1 = join_commute meet_commute
   lemmas %invisible L2 = join_assoc meet_assoc
   (* lemmas L3 = join_idem meet_idem *)
   lemmas %invisible L4 = join_meet_absorb meet_join_absorb
 
   end
 
 text \<open>Locales for total orders and distributive lattices follow to
   establish a sufficiently rich landscape of locales for
   further examples in this tutorial.\<close>
 
   locale total_order = partial_order +
     assumes total: "x \<sqsubseteq> y \<or> y \<sqsubseteq> x"
 
   lemma (in total_order) less_total: "x \<sqsubset> y \<or> x = y \<or> y \<sqsubset> x"
     using total
     by (unfold less_def) blast
 
   locale distrib_lattice = lattice +
     assumes meet_distr: "x \<sqinter> (y \<squnion> z) = x \<sqinter> y \<squnion> x \<sqinter> z"
 
   lemma (in distrib_lattice) join_distr:
     "x \<squnion> (y \<sqinter> z) = (x \<squnion> y) \<sqinter> (x \<squnion> z)"  (* txt {* Jacobson I, p.\ 462 *} *)
     proof -
     have "x \<squnion> (y \<sqinter> z) = (x \<squnion> (x \<sqinter> z)) \<squnion> (y \<sqinter> z)" by (simp add: L4)
     also have "... = x \<squnion> ((x \<sqinter> z) \<squnion> (y \<sqinter> z))" by (simp add: L2)
     also have "... = x \<squnion> ((x \<squnion> y) \<sqinter> z)" by (simp add: L1 meet_distr)
     also have "... = ((x \<squnion> y) \<sqinter> x) \<squnion> ((x \<squnion> y) \<sqinter> z)" by (simp add: L1 L4)
     also have "... = (x \<squnion> y) \<sqinter> (x \<squnion> z)" by (simp add: meet_distr)
     finally show ?thesis .
   qed
 
 text \<open>
   The locale hierarchy obtained through these declarations is shown in
   Figure~\ref{fig:lattices}(a).
 
 \begin{figure}
 \hrule \vspace{2ex}
 \begin{center}
 \subfigure[Declared hierarchy]{
 \begin{tikzpicture}
   \node (po) at (0,0) {\<open>partial_order\<close>};
   \node (lat) at (-1.5,-1) {\<open>lattice\<close>};
   \node (dlat) at (-1.5,-2) {\<open>distrib_lattice\<close>};
   \node (to) at (1.5,-1) {\<open>total_order\<close>};
   \draw (po) -- (lat);
   \draw (lat) -- (dlat);
   \draw (po) -- (to);
 %  \draw[->, dashed] (lat) -- (to);
 \end{tikzpicture}
 } \\
 \subfigure[Total orders are lattices]{
 \begin{tikzpicture}
   \node (po) at (0,0) {\<open>partial_order\<close>};
   \node (lat) at (0,-1) {\<open>lattice\<close>};
   \node (dlat) at (-1.5,-2) {\<open>distrib_lattice\<close>};
   \node (to) at (1.5,-2) {\<open>total_order\<close>};
   \draw (po) -- (lat);
   \draw (lat) -- (dlat);
   \draw (lat) -- (to);
 %  \draw[->, dashed] (dlat) -- (to);
 \end{tikzpicture}
 } \quad
 \subfigure[Total orders are distributive lattices]{
 \begin{tikzpicture}
   \node (po) at (0,0) {\<open>partial_order\<close>};
   \node (lat) at (0,-1) {\<open>lattice\<close>};
   \node (dlat) at (0,-2) {\<open>distrib_lattice\<close>};
   \node (to) at (0,-3) {\<open>total_order\<close>};
   \draw (po) -- (lat);
   \draw (lat) -- (dlat);
   \draw (dlat) -- (to);
 \end{tikzpicture}
 }
 \end{center}
 \hrule
 \caption{Hierarchy of Lattice Locales.}
 \label{fig:lattices}
 \end{figure}
 \<close>
 
 section \<open>Changing the Locale Hierarchy
   \label{sec:changing-the-hierarchy}\<close>
 
 text \<open>
   Locales enable to prove theorems abstractly, relative to
   sets of assumptions.  These theorems can then be used in other
   contexts where the assumptions themselves, or
   instances of the assumptions, are theorems.  This form of theorem
   reuse is called \emph{interpretation}.  Locales generalise
   interpretation from theorems to conclusions, enabling the reuse of
   definitions and other constructs that are not part of the
   specifications of the locales.
 
   The first form of interpretation we will consider in this tutorial
   is provided by the \isakeyword{sublocale} command.  It enables to
   modify the import hierarchy to reflect the \emph{logical} relation
   between locales.
 
   Consider the locale hierarchy from Figure~\ref{fig:lattices}(a).
   Total orders are lattices, although this is not reflected here, and
   definitions, theorems and other conclusions
   from \<^term>\<open>lattice\<close> are not available in \<^term>\<open>total_order\<close>.  To
   obtain the situation in Figure~\ref{fig:lattices}(b), it is
   sufficient to add the conclusions of the latter locale to the former.
   The \isakeyword{sublocale} command does exactly this.
   The declaration \isakeyword{sublocale} $l_1
   \subseteq l_2$ causes locale $l_2$ to be \emph{interpreted} in the
   context of $l_1$.  This means that all conclusions of $l_2$ are made
   available in $l_1$.
 
   Of course, the change of hierarchy must be supported by a theorem
   that reflects, in our example, that total orders are indeed
   lattices.  Therefore the \isakeyword{sublocale} command generates a
   goal, which must be discharged by the user.  This is illustrated in
   the following paragraphs.  First the sublocale relation is stated.
 \<close>
 
   sublocale %visible total_order \<subseteq> lattice
 
 txt \<open>\normalsize
   This enters the context of locale \<open>total_order\<close>, in
   which the goal @{subgoals [display]} must be shown.
   Now the
   locale predicate needs to be unfolded --- for example, using its
   definition or by introduction rules
   provided by the locale package.  For automation, the locale package
   provides the methods \<open>intro_locales\<close> and \<open>unfold_locales\<close>.  They are aware of the
   current context and dependencies between locales and automatically
   discharge goals implied by these.  While \<open>unfold_locales\<close>
   always unfolds locale predicates to assumptions, \<open>intro_locales\<close> only unfolds definitions along the locale
   hierarchy, leaving a goal consisting of predicates defined by the
   locale package.  Occasionally the latter is of advantage since the goal
   is smaller.
 
   For the current goal, we would like to get hold of
   the assumptions of \<open>lattice\<close>, which need to be shown, hence
   \<open>unfold_locales\<close> is appropriate.\<close>
 
   proof unfold_locales
 
 txt \<open>\normalsize
   Since the fact that both lattices and total orders are partial
   orders is already reflected in the locale hierarchy, the assumptions
   of \<open>partial_order\<close> are discharged automatically, and only the
   assumptions introduced in \<open>lattice\<close> remain as subgoals
   @{subgoals [display]}
   The proof for the first subgoal is obtained by constructing an
   infimum, whose existence is implied by totality.\<close>
 
     fix x y
     from total have "is_inf x y (if x \<sqsubseteq> y then x else y)"
       by (auto simp: is_inf_def)
     then show "\<exists>inf. is_inf x y inf" ..
 txt \<open>\normalsize
    The proof for the second subgoal is analogous and not
   reproduced here.\<close>
   next %invisible
     fix x y
     from total have "is_sup x y (if x \<sqsubseteq> y then y else x)"
       by (auto simp: is_sup_def)
     then show "\<exists>sup. is_sup x y sup" .. qed %visible
 
 text \<open>Similarly, we may establish that total orders are distributive
   lattices with a second \isakeyword{sublocale} statement.\<close>
 
   sublocale total_order \<subseteq> distrib_lattice
     proof unfold_locales
     fix %"proof" x y z
     show "x \<sqinter> (y \<squnion> z) = x \<sqinter> y \<squnion> x \<sqinter> z" (is "?l = ?r")
       txt \<open>Jacobson I, p.\ 462\<close>
     proof -
       { assume c: "y \<sqsubseteq> x" "z \<sqsubseteq> x"
         from c have "?l = y \<squnion> z"
           by (metis c join_connection2 join_related2 meet_related2 total)
         also from c have "... = ?r" by (metis meet_related2)
         finally have "?l = ?r" . }
       moreover
       { assume c: "x \<sqsubseteq> y \<or> x \<sqsubseteq> z"
         from c have "?l = x"
           by (metis join_connection2 join_related2 meet_connection total trans)
         also from c have "... = ?r"
           by (metis join_commute join_related2 meet_connection meet_related2 total)
         finally have "?l = ?r" . }
       moreover note total
       ultimately show ?thesis by blast
     qed
   qed
 
 text \<open>The locale hierarchy is now as shown in
   Figure~\ref{fig:lattices}(c).\<close>
 
 text \<open>
   Locale interpretation is \emph{dynamic}.  The statement
   \isakeyword{sublocale} $l_1 \subseteq l_2$ will not just add the
   current conclusions of $l_2$ to $l_1$.  Rather the dependency is
   stored, and conclusions that will be
   added to $l_2$ in future are automatically propagated to $l_1$.
   The sublocale relation is transitive --- that is, propagation takes
   effect along chains of sublocales.  Even cycles in the sublocale relation are
   supported, as long as these cycles do not lead to infinite chains.
-  Details are discussed in the technical report @{cite Ballarin2006a}.
+  Details are discussed in the technical report \<^cite>\<open>Ballarin2006a\<close>.
   See also Section~\ref{sec:infinite-chains} of this tutorial.\<close>
 
 end
diff --git a/src/Doc/Locales/Examples3.thy b/src/Doc/Locales/Examples3.thy
--- a/src/Doc/Locales/Examples3.thy
+++ b/src/Doc/Locales/Examples3.thy
@@ -1,644 +1,644 @@
 theory Examples3
 imports Examples
 begin
 
 subsection \<open>Third Version: Local Interpretation
   \label{sec:local-interpretation}\<close>
 
 text \<open>In the above example, the fact that \<^term>\<open>(\<le>)\<close> is a partial
   order for the integers was used in the second goal to
   discharge the premise in the definition of \<open>(\<sqsubset>)\<close>.  In
   general, proofs of the equations not only may involve definitions
   from the interpreted locale but arbitrarily complex arguments in the
   context of the locale.  Therefore it would be convenient to have the
   interpreted locale conclusions temporarily available in the proof.
   This can be achieved by a locale interpretation in the proof body.
   The command for local interpretations is \isakeyword{interpret}.  We
   repeat the example from the previous section to illustrate this.\<close>
 
   interpretation %visible int: partial_order "(\<le>) :: int \<Rightarrow> int \<Rightarrow> bool"
     rewrites "int.less x y = (x < y)"
   proof -
     show "partial_order ((\<le>) :: int \<Rightarrow> int \<Rightarrow> bool)"
       by unfold_locales auto
     then interpret int: partial_order "(\<le>) :: [int, int] \<Rightarrow> bool" .
     show "int.less x y = (x < y)"
       unfolding int.less_def by auto
   qed
 
 text \<open>The inner interpretation is immediate from the preceding fact
   and proved by assumption (Isar short hand ``.'').  It enriches the
   local proof context by the theorems
   also obtained in the interpretation from Section~\ref{sec:po-first},
   and \<open>int.less_def\<close> may directly be used to unfold the
   definition.  Theorems from the local interpretation disappear after
   leaving the proof context --- that is, after the succeeding
   \isakeyword{next} or \isakeyword{qed} statement.\<close>
 
 
 subsection \<open>Further Interpretations\<close>
 
 text \<open>Further interpretations are necessary for
   the other locales.  In \<open>lattice\<close> the operations~\<open>\<sqinter>\<close>
   and~\<open>\<squnion>\<close> are substituted by \<^term>\<open>min :: int \<Rightarrow> int \<Rightarrow> int\<close>
   and \<^term>\<open>max :: int \<Rightarrow> int \<Rightarrow> int\<close>.  The entire proof for the
   interpretation is reproduced to give an example of a more
   elaborate interpretation proof.  Note that the equations are named
   so they can be used in a later example.\<close>
 
   interpretation %visible int: lattice "(\<le>) :: int \<Rightarrow> int \<Rightarrow> bool"
     rewrites int_min_eq: "int.meet x y = min x y"
       and int_max_eq: "int.join x y = max x y"
   proof -
     show "lattice ((\<le>) :: int \<Rightarrow> int \<Rightarrow> bool)"
       txt \<open>\normalsize We have already shown that this is a partial
         order,\<close>
       apply unfold_locales
       txt \<open>\normalsize hence only the lattice axioms remain to be
         shown.
         @{subgoals [display]}
         By \<open>is_inf\<close> and \<open>is_sup\<close>,\<close>
       apply (unfold int.is_inf_def int.is_sup_def)
       txt \<open>\normalsize the goals are transformed to these
         statements:
         @{subgoals [display]}
         This is Presburger arithmetic, which can be solved by the
         method \<open>arith\<close>.\<close>
       by arith+
     txt \<open>\normalsize In order to show the equations, we put ourselves
       in a situation where the lattice theorems can be used in a
       convenient way.\<close>
     then interpret int: lattice "(\<le>) :: int \<Rightarrow> int \<Rightarrow> bool" .
     show "int.meet x y = min x y"
       by (bestsimp simp: int.meet_def int.is_inf_def)
     show "int.join x y = max x y"
       by (bestsimp simp: int.join_def int.is_sup_def)
   qed
 
 text \<open>Next follows that \<open>(\<le>)\<close> is a total order, again for
   the integers.\<close>
 
   interpretation %visible int: total_order "(\<le>) :: int \<Rightarrow> int \<Rightarrow> bool"
     by unfold_locales arith
 
 text \<open>Theorems that are available in the theory at this point are shown in
   Table~\ref{tab:int-lattice}.  Two points are worth noting:
 
 \begin{table}
 \hrule
 \vspace{2ex}
 \begin{center}
 \begin{tabular}{l}
   @{thm [source] int.less_def} from locale \<open>partial_order\<close>: \\
   \quad @{thm int.less_def} \\
   @{thm [source] int.meet_left} from locale \<open>lattice\<close>: \\
   \quad @{thm int.meet_left} \\
   @{thm [source] int.join_distr} from locale \<open>distrib_lattice\<close>: \\
   \quad @{thm int.join_distr} \\
   @{thm [source] int.less_total} from locale \<open>total_order\<close>: \\
   \quad @{thm int.less_total}
 \end{tabular}
 \end{center}
 \hrule
 \caption{Interpreted theorems for~\<open>\<le>\<close> on the integers.}
 \label{tab:int-lattice}
 \end{table}
 
 \begin{itemize}
 \item
   Locale \<open>distrib_lattice\<close> was also interpreted.  Since the
   locale hierarchy reflects that total orders are distributive
   lattices, the interpretation of the latter was inserted
   automatically with the interpretation of the former.  In general,
   interpretation traverses the locale hierarchy upwards and interprets
   all encountered locales, regardless whether imported or proved via
   the \isakeyword{sublocale} command.  Existing interpretations are
   skipped avoiding duplicate work.
 \item
   The predicate \<^term>\<open>(<)\<close> appears in theorem @{thm [source]
   int.less_total}
   although an equation for the replacement of \<open>(\<sqsubset>)\<close> was only
   given in the interpretation of \<open>partial_order\<close>.  The
   interpretation equations are pushed downwards the hierarchy for
   related interpretations --- that is, for interpretations that share
   the instances of parameters they have in common.
 \end{itemize}
 \<close>
 
 text \<open>The interpretations for a locale $n$ within the current
   theory may be inspected with \isakeyword{print\_interps}~$n$.  This
   prints the list of instances of $n$, for which interpretations exist.
   For example, \isakeyword{print\_interps} \<^term>\<open>partial_order\<close>
   outputs the following:
 \begin{small}
 \begin{alltt}
   int : partial_order "(\(\le\))"
 \end{alltt}
 \end{small}
   Of course, there is only one interpretation.
   The interpretation qualifier on the left is mandatory.  Qualifiers
   can either be \emph{mandatory} or \emph{optional}.  Optional qualifiers
   are designated by ``?''.  Mandatory qualifiers must occur in
   name references while optional ones need not.  Mandatory qualifiers
   prevent accidental hiding of names, while optional qualifiers can be
   more convenient to use.  The default is mandatory.
 \<close>
 
 
 section \<open>Locale Expressions \label{sec:expressions}\<close>
 
 text \<open>
   A map~\<^term>\<open>\<phi>\<close> between partial orders~\<open>\<sqsubseteq>\<close> and~\<open>\<preceq>\<close>
   is called order preserving if \<open>x \<sqsubseteq> y\<close> implies \<open>\<phi> x \<preceq>
   \<phi> y\<close>.  This situation is more complex than those encountered so
   far: it involves two partial orders, and it is desirable to use the
   existing locale for both.
 
   A locale for order preserving maps requires three parameters: \<open>le\<close>~(\isakeyword{infixl}~\<open>\<sqsubseteq>\<close>) and \<open>le'\<close>~(\isakeyword{infixl}~\<open>\<preceq>\<close>) for the orders and~\<open>\<phi>\<close>
   for the map.
 
   In order to reuse the existing locale for partial orders, which has
   the single parameter~\<open>le\<close>, it must be imported twice, once
   mapping its parameter to~\<open>le\<close> from the new locale and once
   to~\<open>le'\<close>.  This can be achieved with a compound locale
   expression.
 
   In general, a locale expression is a sequence of \emph{locale instances}
   separated by~``$\textbf{+}$'' and followed by a \isakeyword{for}
   clause.
   An instance has the following format:
 \begin{quote}
   \textit{qualifier} \textbf{:} \textit{locale-name}
   \textit{parameter-instantiation}
 \end{quote}
   We have already seen locale instances as arguments to
   \isakeyword{interpretation} in Section~\ref{sec:interpretation}.
   As before, the qualifier serves to disambiguate names from
   different instances of the same locale, and unless designated with a
   ``?'' it must occur in name references.
 
   Since the parameters~\<open>le\<close> and~\<open>le'\<close> are to be partial
   orders, our locale for order preserving maps will import the these
   instances:
 \begin{small}
 \begin{alltt}
   le: partial_order le
   le': partial_order le'
 \end{alltt}
 \end{small}
   For matter of convenience we choose to name parameter names and
   qualifiers alike.  This is an arbitrary decision.  Technically, qualifiers
   and parameters are unrelated.
 
   Having determined the instances, let us turn to the \isakeyword{for}
   clause.  It serves to declare locale parameters in the same way as
   the context element \isakeyword{fixes} does.  Context elements can
   only occur after the import section, and therefore the parameters
   referred to in the instances must be declared in the \isakeyword{for}
   clause.  The \isakeyword{for} clause is also where the syntax of these
   parameters is declared.
 
   Two context elements for the map parameter~\<open>\<phi>\<close> and the
   assumptions that it is order preserving complete the locale
   declaration.\<close>
 
   locale order_preserving =
     le: partial_order le + le': partial_order le'
       for le (infixl "\<sqsubseteq>" 50) and le' (infixl "\<preceq>" 50) +
     fixes \<phi>
     assumes hom_le: "x \<sqsubseteq> y \<Longrightarrow> \<phi> x \<preceq> \<phi> y"
 
 text (in order_preserving) \<open>Here are examples of theorems that are
   available in the locale:
 
   \hspace*{1em}@{thm [source] hom_le}: @{thm hom_le}
 
   \hspace*{1em}@{thm [source] le.less_le_trans}: @{thm le.less_le_trans}
 
   \hspace*{1em}@{thm [source] le'.less_le_trans}:
   @{thm [display, indent=4] le'.less_le_trans}
   While there is infix syntax for the strict operation associated with
   \<^term>\<open>(\<sqsubseteq>)\<close>, there is none for the strict version of \<^term>\<open>(\<preceq>)\<close>.  The syntax \<open>\<sqsubset>\<close> for \<open>less\<close> is only
   available for the original instance it was declared for.  We may
   introduce infix syntax for \<open>le'.less\<close> with the following declaration:\<close>
 
   notation (in order_preserving) le'.less (infixl "\<prec>" 50)
 
 text (in order_preserving) \<open>Now the theorem is displayed nicely as
   @{thm [source]  le'.less_le_trans}:
   @{thm [display, indent=2] le'.less_le_trans}\<close>
 
 text \<open>There are short notations for locale expressions.  These are
   discussed in the following.\<close>
 
 
 subsection \<open>Default Instantiations\<close>
 
 text \<open>
   It is possible to omit parameter instantiations.  The
   instantiation then defaults to the name of
   the parameter itself.  For example, the locale expression \<open>partial_order\<close> is short for \<open>partial_order le\<close>, since the
   locale's single parameter is~\<open>le\<close>.  We took advantage of this
   in the \isakeyword{sublocale} declarations of
   Section~\ref{sec:changing-the-hierarchy}.\<close>
 
 
 subsection \<open>Implicit Parameters \label{sec:implicit-parameters}\<close>
 
 text \<open>In a locale expression that occurs within a locale
   declaration, omitted parameters additionally extend the (possibly
   empty) \isakeyword{for} clause.
 
   The \isakeyword{for} clause is a general construct of Isabelle/Isar
   to mark names occurring in the preceding declaration as ``arbitrary
   but fixed''.  This is necessary for example, if the name is already
   bound in a surrounding context.  In a locale expression, names
   occurring in parameter instantiations should be bound by a
   \isakeyword{for} clause whenever these names are not introduced
   elsewhere in the context --- for example, on the left hand side of a
   \isakeyword{sublocale} declaration.
 
   There is an exception to this rule in locale declarations, where the
   \isakeyword{for} clause serves to declare locale parameters.  Here,
   locale parameters for which no parameter instantiation is given are
   implicitly added, with their mixfix syntax, at the beginning of the
   \isakeyword{for} clause.  For example, in a locale declaration, the
   expression \<open>partial_order\<close> is short for
 \begin{small}
 \begin{alltt}
   partial_order le \isakeyword{for} le (\isakeyword{infixl} "\(\sqsubseteq\)" 50)\textrm{.}
 \end{alltt}
 \end{small}
   This short hand was used in the locale declarations throughout
   Section~\ref{sec:import}.
 \<close>
 
 text\<open>
   The following locale declarations provide more examples.  A
   map~\<open>\<phi>\<close> is a lattice homomorphism if it preserves meet and
   join.\<close>
 
   locale lattice_hom =
     le: lattice + le': lattice le' for le' (infixl "\<preceq>" 50) +
     fixes \<phi>
     assumes hom_meet: "\<phi> (x \<sqinter> y) = le'.meet (\<phi> x) (\<phi> y)"
       and hom_join: "\<phi> (x \<squnion> y) = le'.join (\<phi> x) (\<phi> y)"
 
 text \<open>The parameter instantiation in the first instance of \<^term>\<open>lattice\<close> is omitted.  This causes the parameter~\<open>le\<close> to be
   added to the \isakeyword{for} clause, and the locale has
   parameters~\<open>le\<close>,~\<open>le'\<close> and, of course,~\<open>\<phi>\<close>.
 
   Before turning to the second example, we complete the locale by
   providing infix syntax for the meet and join operations of the
   second lattice.
 \<close>
 
   context lattice_hom
   begin
   notation le'.meet (infixl "\<sqinter>''" 50)
   notation le'.join (infixl "\<squnion>''" 50)
   end
 
 text \<open>The next example makes radical use of the short hand
   facilities.  A homomorphism is an endomorphism if both orders
   coincide.\<close>
 
   locale lattice_end = lattice_hom _ le
 
 text \<open>The notation~\<open>_\<close> enables to omit a parameter in a
   positional instantiation.  The omitted parameter,~\<open>le\<close> becomes
   the parameter of the declared locale and is, in the following
   position, used to instantiate the second parameter of \<open>lattice_hom\<close>.  The effect is that of identifying the first in second
   parameter of the homomorphism locale.\<close>
 
 text \<open>The inheritance diagram of the situation we have now is shown
   in Figure~\ref{fig:hom}, where the dashed line depicts an
   interpretation which is introduced below.  Parameter instantiations
   are indicated by $\sqsubseteq \mapsto \preceq$ etc.  By looking at
   the inheritance diagram it would seem
   that two identical copies of each of the locales \<open>partial_order\<close> and \<open>lattice\<close> are imported by \<open>lattice_end\<close>.  This is not the case!  Inheritance paths with
   identical morphisms are automatically detected and
   the conclusions of the respective locales appear only once.
 
 \begin{figure}
 \hrule \vspace{2ex}
 \begin{center}
 \begin{tikzpicture}
   \node (o) at (0,0) {\<open>partial_order\<close>};
   \node (oh) at (1.5,-2) {\<open>order_preserving\<close>};
   \node (oh1) at (1.5,-0.7) {$\scriptscriptstyle \sqsubseteq \mapsto \sqsubseteq$};
   \node (oh2) at (0,-1.3) {$\scriptscriptstyle \sqsubseteq \mapsto \preceq$};
   \node (l) at (-1.5,-2) {\<open>lattice\<close>};
   \node (lh) at (0,-4) {\<open>lattice_hom\<close>};
   \node (lh1) at (0,-2.7) {$\scriptscriptstyle \sqsubseteq \mapsto \sqsubseteq$};
   \node (lh2) at (-1.5,-3.3) {$\scriptscriptstyle \sqsubseteq \mapsto \preceq$};
   \node (le) at (0,-6) {\<open>lattice_end\<close>};
   \node (le1) at (0,-4.8)
     [anchor=west]{$\scriptscriptstyle \sqsubseteq \mapsto \sqsubseteq$};
   \node (le2) at (0,-5.2)
     [anchor=west]{$\scriptscriptstyle \preceq \mapsto \sqsubseteq$};
   \draw (o) -- (l);
   \draw[dashed] (oh) -- (lh);
   \draw (lh) -- (le);
   \draw (o) .. controls (oh1.south west) .. (oh);
   \draw (o) .. controls (oh2.north east) .. (oh);
   \draw (l) .. controls (lh1.south west) .. (lh);
   \draw (l) .. controls (lh2.north east) .. (lh);
 \end{tikzpicture}
 \end{center}
 \hrule
 \caption{Hierarchy of Homomorphism Locales.}
 \label{fig:hom}
 \end{figure}
 \<close>
 
 text \<open>It can be shown easily that a lattice homomorphism is order
   preserving.  As the final example of this section, a locale
   interpretation is used to assert this:\<close>
 
   sublocale lattice_hom \<subseteq> order_preserving
   proof unfold_locales
     fix x y
     assume "x \<sqsubseteq> y"
     then have "y = (x \<squnion> y)" by (simp add: le.join_connection)
     then have "\<phi> y = (\<phi> x \<squnion>' \<phi> y)" by (simp add: hom_join [symmetric])
     then show "\<phi> x \<preceq> \<phi> y" by (simp add: le'.join_connection)
   qed
 
 text (in lattice_hom) \<open>
   Theorems and other declarations --- syntax, in particular --- from
   the locale \<open>order_preserving\<close> are now active in \<open>lattice_hom\<close>, for example
   @{thm [source] hom_le}:
   @{thm [display, indent=2] hom_le}
   This theorem will be useful in the following section.
 \<close>
 
 
 section \<open>Conditional Interpretation\<close>
 
 text \<open>There are situations where an interpretation is not possible
   in the general case since the desired property is only valid if
   certain conditions are fulfilled.  Take, for example, the function
   \<open>\<lambda>i. n * i\<close> that scales its argument by a constant factor.
   This function is order preserving (and even a lattice endomorphism)
   with respect to \<^term>\<open>(\<le>)\<close> provided \<open>n \<ge> 0\<close>.
 
   It is not possible to express this using a global interpretation,
   because it is in general unspecified whether~\<^term>\<open>n\<close> is
   non-negative, but one may make an interpretation in an inner context
   of a proof where full information is available.
   This is not fully satisfactory either, since potentially
   interpretations may be required to make interpretations in many
   contexts.  What is
   required is an interpretation that depends on the condition --- and
   this can be done with the \isakeyword{sublocale} command.  For this
   purpose, we introduce a locale for the condition.\<close>
 
   locale non_negative =
     fixes n :: int
     assumes non_neg: "0 \<le> n"
 
 text \<open>It is again convenient to make the interpretation in an
   incremental fashion, first for order preserving maps, then for
   lattice endomorphisms.\<close>
 
   sublocale non_negative \<subseteq>
       order_preserving "(\<le>)" "(\<le>)" "\<lambda>i. n * i"
     using non_neg by unfold_locales (rule mult_left_mono)
 
 text \<open>While the proof of the previous interpretation
   is straightforward from monotonicity lemmas for~\<^term>\<open>(*)\<close>, the
   second proof follows a useful pattern.\<close>
 
   sublocale %visible non_negative \<subseteq> lattice_end "(\<le>)" "\<lambda>i. n * i"
   proof (unfold_locales, unfold int_min_eq int_max_eq)
     txt \<open>\normalsize Unfolding the locale predicates \emph{and} the
       interpretation equations immediately yields two subgoals that
       reflect the core conjecture.
       @{subgoals [display]}
       It is now necessary to show, in the context of \<^term>\<open>non_negative\<close>, that multiplication by~\<^term>\<open>n\<close> commutes with
       \<^term>\<open>min\<close> and \<^term>\<open>max\<close>.\<close>
   qed (auto simp: hom_le)
 
 text (in order_preserving) \<open>The lemma @{thm [source] hom_le}
   simplifies a proof that would have otherwise been lengthy and we may
   consider making it a default rule for the simplifier:\<close>
 
   lemmas (in order_preserving) hom_le [simp]
 
 
 subsection \<open>Avoiding Infinite Chains of Interpretations
   \label{sec:infinite-chains}\<close>
 
 text \<open>Similar situations arise frequently in formalisations of
   abstract algebra where it is desirable to express that certain
   constructions preserve certain properties.  For example, polynomials
   over rings are rings, or --- an example from the domain where the
   illustrations of this tutorial are taken from --- a partial order
   may be obtained for a function space by point-wise lifting of the
   partial order of the co-domain.  This corresponds to the following
   interpretation:\<close>
 
   sublocale %visible partial_order \<subseteq> f: partial_order "\<lambda>f g. \<forall>x. f x \<sqsubseteq> g x"
     oops
 
 text \<open>Unfortunately this is a cyclic interpretation that leads to an
   infinite chain, namely
   @{text [display, indent=2] "partial_order \<subseteq> partial_order (\<lambda>f g. \<forall>x. f x \<sqsubseteq> g x) \<subseteq>
   partial_order (\<lambda>f g. \<forall>x y. f x y \<sqsubseteq> g x y) \<subseteq>  \<dots>"}
   and the interpretation is rejected.
 
   Instead it is necessary to declare a locale that is logically
   equivalent to \<^term>\<open>partial_order\<close> but serves to collect facts
   about functions spaces where the co-domain is a partial order, and
   to make the interpretation in its context:\<close>
 
   locale fun_partial_order = partial_order
 
   sublocale fun_partial_order \<subseteq>
       f: partial_order "\<lambda>f g. \<forall>x. f x \<sqsubseteq> g x"
     by unfold_locales (fast,rule,fast,blast intro: trans)
 
 text \<open>It is quite common in abstract algebra that such a construction
   maps a hierarchy of algebraic structures (or specifications) to a
   related hierarchy.  By means of the same lifting, a function space
   is a lattice if its co-domain is a lattice:\<close>
 
   locale fun_lattice = fun_partial_order + lattice
 
   sublocale fun_lattice \<subseteq> f: lattice "\<lambda>f g. \<forall>x. f x \<sqsubseteq> g x"
   proof unfold_locales
     fix f g
     have "partial_order.is_inf (\<lambda>f g. \<forall>x. f x \<sqsubseteq> g x) f g (\<lambda>x. f x \<sqinter> g x)"
       apply (rule f.is_infI) apply rule+ apply (drule spec, assumption)+ done
     then show "\<exists>inf. partial_order.is_inf (\<lambda>f g. \<forall>x. f x \<sqsubseteq> g x) f g inf"
       by fast
   next
     fix f g
     have "partial_order.is_sup (\<lambda>f g. \<forall>x. f x \<sqsubseteq> g x) f g (\<lambda>x. f x \<squnion> g x)"
       apply (rule f.is_supI) apply rule+ apply (drule spec, assumption)+ done
     then show "\<exists>sup. partial_order.is_sup (\<lambda>f g. \<forall>x. f x \<sqsubseteq> g x) f g sup"
       by fast
   qed
 
 
 section \<open>Further Reading\<close>
 
 text \<open>More information on locales and their interpretation is
   available.  For the locale hierarchy of import and interpretation
-  dependencies see~@{cite Ballarin2006a}; interpretations in theories
-  and proofs are covered in~@{cite Ballarin2006b}.  In the latter, I
+  dependencies see~\<^cite>\<open>Ballarin2006a\<close>; interpretations in theories
+  and proofs are covered in~\<^cite>\<open>Ballarin2006b\<close>.  In the latter, I
   show how interpretation in proofs enables to reason about families
   of algebraic structures, which cannot be expressed with locales
   directly.
 
-  Haftmann and Wenzel~@{cite HaftmannWenzel2007} overcome a restriction
+  Haftmann and Wenzel~\<^cite>\<open>HaftmannWenzel2007\<close> overcome a restriction
   of axiomatic type classes through a combination with locale
   interpretation.  The result is a Haskell-style class system with a
   facility to generate ML and Haskell code.  Classes are sufficient for
   simple specifications with a single type parameter.  The locales for
   orders and lattices presented in this tutorial fall into this
   category.  Order preserving maps, homomorphisms and vector spaces,
   on the other hand, do not.
 
   The locales reimplementation for Isabelle 2009 provides, among other
   improvements, a clean integration with Isabelle/Isar's local theory
   mechanisms, which are described in another paper by Haftmann and
-  Wenzel~@{cite HaftmannWenzel2009}.
+  Wenzel~\<^cite>\<open>HaftmannWenzel2009\<close>.
 
-  The original work of Kammüller on locales~@{cite KammullerEtAl1999}
+  The original work of Kammüller on locales~\<^cite>\<open>KammullerEtAl1999\<close>
   may be of interest from a historical perspective.  My previous
-  report on locales and locale expressions~@{cite Ballarin2004a}
+  report on locales and locale expressions~\<^cite>\<open>Ballarin2004a\<close>
   describes a simpler form of expressions than available now and is
   outdated. The mathematical background on orders and lattices is
-  taken from Jacobson's textbook on algebra~@{cite \<open>Chapter~8\<close> Jacobson1985}.
+  taken from Jacobson's textbook on algebra~\<^cite>\<open>\<open>Chapter~8\<close> in Jacobson1985\<close>.
 
   The sources of this tutorial, which include all proofs, are
   available with the Isabelle distribution at
   \<^url>\<open>https://isabelle.in.tum.de\<close>.
 \<close>
 
 text \<open>
 \begin{table}
 \hrule
 \vspace{2ex}
 \begin{center}
 \begin{tabular}{l>$c<$l}
   \multicolumn{3}{l}{Miscellaneous} \\
 
   \textit{attr-name} & ::=
   & \textit{name} $|$ \textit{attribute} $|$
     \textit{name} \textit{attribute} \\
   \textit{qualifier} & ::=
   & \textit{name} [``\textbf{?}''] \\[2ex]
 
   \multicolumn{3}{l}{Context Elements} \\
 
   \textit{fixes} & ::=
   & \textit{name} [ ``\textbf{::}'' \textit{type} ]
     [ ``\textbf{(}'' \textbf{structure} ``\textbf{)}'' $|$
     \textit{mixfix} ] \\
 \begin{comment}
   \textit{constrains} & ::=
   & \textit{name} ``\textbf{::}'' \textit{type} \\
 \end{comment}
   \textit{assumes} & ::=
   & [ \textit{attr-name} ``\textbf{:}'' ] \textit{proposition} \\
 \begin{comment}
   \textit{defines} & ::=
   & [ \textit{attr-name} ``\textbf{:}'' ] \textit{proposition} \\
   \textit{notes} & ::=
   & [ \textit{attr-name} ``\textbf{=}'' ]
     ( \textit{qualified-name} [ \textit{attribute} ] )$^+$ \\
 \end{comment}
 
   \textit{element} & ::=
   & \textbf{fixes} \textit{fixes} ( \textbf{and} \textit{fixes} )$^*$ \\
 \begin{comment}
   & |
   & \textbf{constrains} \textit{constrains}
     ( \textbf{and} \textit{constrains} )$^*$ \\
 \end{comment}
   & |
   & \textbf{assumes} \textit{assumes} ( \textbf{and} \textit{assumes} )$^*$ \\[2ex]
 %\begin{comment}
 %  & |
 %  & \textbf{defines} \textit{defines} ( \textbf{and} \textit{defines} )$^*$ \\
 %  & |
 %  & \textbf{notes} \textit{notes} ( \textbf{and} \textit{notes} )$^*$ \\
 %\end{comment}
 
   \multicolumn{3}{l}{Locale Expressions} \\
 
   \textit{pos-insts} & ::=
   & ( \textit{term} $|$ ``\textbf{\_}'' )$^*$ \\
   \textit{named-insts} & ::=
   & \textbf{where} \textit{name} ``\textbf{=}'' \textit{term}
   ( \textbf{and} \textit{name} ``\textbf{=}'' \textit{term} )$^*$ \\
   \textit{instance} & ::=
   & [ \textit{qualifier} ``\textbf{:}'' ]
     \textit{name} ( \textit{pos-insts} $|$ \textit{named-inst} ) \\
   \textit{expression}  & ::= 
   & \textit{instance} ( ``\textbf{+}'' \textit{instance} )$^*$
     [ \textbf{for} \textit{fixes} ( \textbf{and} \textit{fixes} )$^*$ ] \\[2ex]
 
   \multicolumn{3}{l}{Declaration of Locales} \\
 
   \textit{locale} & ::=
   & \textit{element}$^+$ \\
   & | & \textit{expression} [ ``\textbf{+}'' \textit{element}$^+$ ] \\
   \textit{toplevel} & ::=
   & \textbf{locale} \textit{name} [ ``\textbf{=}''
     \textit{locale} ] \\[2ex]
 
   \multicolumn{3}{l}{Interpretation} \\
 
   \textit{equation} & ::= & [ \textit{attr-name} ``\textbf{:}'' ]
     \textit{prop} \\
   \textit{equations} & ::= &  \textbf{rewrites} \textit{equation} ( \textbf{and}
     \textit{equation} )$^*$  \\
   \textit{toplevel} & ::=
   & \textbf{sublocale} \textit{name} ( ``$<$'' $|$
     ``$\subseteq$'' ) \textit{expression} \textit{proof} \\
   & |
   & \textbf{interpretation}
     \textit{expression} [ \textit{equations} ] \textit{proof} \\
   & |
   & \textbf{interpret}
     \textit{expression} \textit{proof} \\[2ex]
 
   \multicolumn{3}{l}{Diagnostics} \\
 
   \textit{toplevel} & ::=
   & \textbf{print\_locales} \\
   & | & \textbf{print\_locale} [ ``\textbf{!}'' ] \textit{name} \\
   & | & \textbf{print\_interps} \textit{name}
 \end{tabular}
 \end{center}
 \hrule
 \caption{Syntax of Locale Commands.}
 \label{tab:commands}
 \end{table}
 \<close>
 
 text \<open>\textbf{Revision History.}  The present fourth revision of the
   tutorial accommodates minor updates to the syntax of the locale commands
   and the handling of notation under morphisms introduced with Isabelle 2016.
   For the third revision of the tutorial, which corresponds to the published
   version, much of the explanatory text was rewritten.  Inheritance of
   interpretation equations was made available with Isabelle 2009-1.
   The second revision accommodates changes introduced by the locales
   reimplementation for Isabelle 2009.  Most notably locale expressions
   were generalised from renaming to instantiation.\<close>
 
 text \<open>\textbf{Acknowledgements.}  Alexander Krauss, Tobias Nipkow,
   Randy Pollack, Andreas Schropp, Christian Sternagel and Makarius Wenzel
   have made
   useful comments on earlier versions of this document.  The section
   on conditional interpretation was inspired by a number of e-mail
   enquiries the author received from locale users, and which suggested
   that this use case is important enough to deserve explicit
   explanation.  The term \emph{conditional interpretation} is due to
   Larry Paulson.\<close>
 
 end
diff --git a/src/Doc/Logics_ZF/ZF_Isar.thy b/src/Doc/Logics_ZF/ZF_Isar.thy
--- a/src/Doc/Logics_ZF/ZF_Isar.thy
+++ b/src/Doc/Logics_ZF/ZF_Isar.thy
@@ -1,137 +1,137 @@
 theory ZF_Isar
 imports ZF
 begin
 
 (*<*)
 ML_file \<open>../antiquote_setup.ML\<close>
 (*>*)
 
 chapter \<open>Some Isar language elements\<close>
 
 section \<open>Type checking\<close>
 
 text \<open>
   The ZF logic is essentially untyped, so the concept of ``type
   checking'' is performed as logical reasoning about set-membership
   statements.  A special method assists users in this task; a version
   of this is already declared as a ``solver'' in the standard
   Simplifier setup.
 
   \begin{matharray}{rcl}
     @{command_def (ZF) "print_tcset"}\<open>\<^sup>*\<close> & : & \<open>context \<rightarrow>\<close> \\
     @{method_def (ZF) typecheck} & : & \<open>method\<close> \\
     @{attribute_def (ZF) TC} & : & \<open>attribute\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     @@{attribute (ZF) TC} (() | 'add' | 'del')
   \<close>
 
   \begin{description}
   
   \item @{command (ZF) "print_tcset"} prints the collection of
   typechecking rules of the current context.
   
   \item @{method (ZF) typecheck} attempts to solve any pending
   type-checking problems in subgoals.
   
   \item @{attribute (ZF) TC} adds or deletes type-checking rules from
   the context.
 
   \end{description}
 \<close>
 
 
 section \<open>(Co)Inductive sets and datatypes\<close>
 
 subsection \<open>Set definitions\<close>
 
 text \<open>
   In ZF everything is a set.  The generic inductive package also
   provides a specific view for ``datatype'' specifications.
   Coinductive definitions are available in both cases, too.
 
   \begin{matharray}{rcl}
     @{command_def (ZF) "inductive"} & : & \<open>theory \<rightarrow> theory\<close> \\
     @{command_def (ZF) "coinductive"} & : & \<open>theory \<rightarrow> theory\<close> \\
     @{command_def (ZF) "datatype"} & : & \<open>theory \<rightarrow> theory\<close> \\
     @{command_def (ZF) "codatatype"} & : & \<open>theory \<rightarrow> theory\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     (@@{command (ZF) inductive} | @@{command (ZF) coinductive}) domains intros hints
     ;
 
     domains: @'domains' (@{syntax term} + '+') ('<=' | '\<subseteq>') @{syntax term}
     ;
     intros: @'intros' (@{syntax thmdecl}? @{syntax prop} +)
     ;
     hints: @{syntax (ZF) "monos"}? condefs? \<newline>
       @{syntax (ZF) typeintros}? @{syntax (ZF) typeelims}?
     ;
     @{syntax_def (ZF) "monos"}: @'monos' @{syntax thms}
     ;
     condefs: @'con_defs' @{syntax thms}
     ;
     @{syntax_def (ZF) typeintros}: @'type_intros' @{syntax thms}
     ;
     @{syntax_def (ZF) typeelims}: @'type_elims' @{syntax thms}
   \<close>
 
   In the following syntax specification \<open>monos\<close>, \<open>typeintros\<close>, and \<open>typeelims\<close> are the same as above.
 
   \<^rail>\<open>
     (@@{command (ZF) datatype} | @@{command (ZF) codatatype}) domain? (dtspec + @'and') hints
     ;
 
     domain: ('<=' | '\<subseteq>') @{syntax term}
     ;
     dtspec: @{syntax term} '=' (con + '|')
     ;
     con: @{syntax name} ('(' (@{syntax term} ',' +) ')')?
     ;
     hints: @{syntax (ZF) "monos"}? @{syntax (ZF) typeintros}? @{syntax (ZF) typeelims}?
   \<close>
 
-  See @{cite "isabelle-ZF"} for further information on inductive
+  See \<^cite>\<open>"isabelle-ZF"\<close> for further information on inductive
   definitions in ZF, but note that this covers the old-style theory
   format.
 \<close>
 
 
 subsection \<open>Primitive recursive functions\<close>
 
 text \<open>
   \begin{matharray}{rcl}
     @{command_def (ZF) "primrec"} & : & \<open>theory \<rightarrow> theory\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     @@{command (ZF) primrec} (@{syntax thmdecl}? @{syntax prop} +)
   \<close>
 \<close>
 
 
 subsection \<open>Cases and induction: emulating tactic scripts\<close>
 
 text \<open>
   The following important tactical tools of Isabelle/ZF have been
   ported to Isar.  These should not be used in proper proof texts.
 
   \begin{matharray}{rcl}
     @{method_def (ZF) case_tac}\<open>\<^sup>*\<close> & : & \<open>method\<close> \\
     @{method_def (ZF) induct_tac}\<open>\<^sup>*\<close> & : & \<open>method\<close> \\
     @{method_def (ZF) ind_cases}\<open>\<^sup>*\<close> & : & \<open>method\<close> \\
     @{command_def (ZF) "inductive_cases"} & : & \<open>theory \<rightarrow> theory\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     (@@{method (ZF) case_tac} | @@{method (ZF) induct_tac}) @{syntax goal_spec}? @{syntax name}
     ;
     @@{method (ZF) ind_cases} (@{syntax prop} +)
     ;
     @@{command (ZF) inductive_cases} (@{syntax thmdecl}? (@{syntax prop} +) + @'and')
   \<close>
 \<close>
 
 end
diff --git a/src/Doc/Prog_Prove/Isar.thy b/src/Doc/Prog_Prove/Isar.thy
--- a/src/Doc/Prog_Prove/Isar.thy
+++ b/src/Doc/Prog_Prove/Isar.thy
@@ -1,1242 +1,1242 @@
 (*<*)
 theory Isar
 imports LaTeXsugar
 begin
 declare [[quick_and_dirty]]
 (*>*)
 text\<open>
 Apply-scripts are unreadable and hard to maintain. The language of choice
 for larger proofs is \concept{Isar}. The two key features of Isar are:
 \begin{itemize}
 \item It is structured, not linear.
 \item It is readable without its being run because
 you need to state what you are proving at any given point.
 \end{itemize}
 Whereas apply-scripts are like assembly language programs, Isar proofs
 are like structured programs with comments. A typical Isar proof looks like this:
 \<close>text\<open>
 \begin{tabular}{@ {}l}
 \isacom{proof}\\
 \quad\isacom{assume} \<open>"\<close>$\mathit{formula}_0$\<open>"\<close>\\
 \quad\isacom{have} \<open>"\<close>$\mathit{formula}_1$\<open>"\<close> \quad\isacom{by} \<open>simp\<close>\\
 \quad\vdots\\
 \quad\isacom{have} \<open>"\<close>$\mathit{formula}_n$\<open>"\<close> \quad\isacom{by} \<open>blast\<close>\\
 \quad\isacom{show} \<open>"\<close>$\mathit{formula}_{n+1}$\<open>"\<close> \quad\isacom{by} \<open>\<dots>\<close>\\
 \isacom{qed}
 \end{tabular}
 \<close>text\<open>
 It proves $\mathit{formula}_0 \Longrightarrow \mathit{formula}_{n+1}$
 (provided each proof step succeeds).
 The intermediate \isacom{have} statements are merely stepping stones
 on the way towards the \isacom{show} statement that proves the actual
 goal. In more detail, this is the Isar core syntax:
 \medskip
 
 \begin{tabular}{@ {}lcl@ {}}
 \textit{proof} &=& \indexed{\isacom{by}}{by} \textit{method}\\
       &$\mid$& \indexed{\isacom{proof}}{proof} [\textit{method}] \ \textit{step}$^*$ \ \indexed{\isacom{qed}}{qed}
 \end{tabular}
 \medskip
 
 \begin{tabular}{@ {}lcl@ {}}
 \textit{step} &=& \indexed{\isacom{fix}}{fix} \textit{variables} \\
       &$\mid$& \indexed{\isacom{assume}}{assume} \textit{proposition} \\
       &$\mid$& [\indexed{\isacom{from}}{from} \textit{fact}$^+$] (\indexed{\isacom{have}}{have} $\mid$ \indexed{\isacom{show}}{show}) \ \textit{proposition} \ \textit{proof}
 \end{tabular}
 \medskip
 
 \begin{tabular}{@ {}lcl@ {}}
 \textit{proposition} &=& [\textit{name}:] \<open>"\<close>\textit{formula}\<open>"\<close>
 \end{tabular}
 \medskip
 
 \begin{tabular}{@ {}lcl@ {}}
 \textit{fact} &=& \textit{name} \ $\mid$ \ \dots
 \end{tabular}
 \medskip
 
 \noindent A proof can either be an atomic \isacom{by} with a single proof
 method which must finish off the statement being proved, for example \<open>auto\<close>,  or it can be a \isacom{proof}--\isacom{qed} block of multiple
 steps. Such a block can optionally begin with a proof method that indicates
 how to start off the proof, e.g., \mbox{\<open>(induction xs)\<close>}.
 
 A step either assumes a proposition or states a proposition
 together with its proof. The optional \isacom{from} clause
 indicates which facts are to be used in the proof.
 Intermediate propositions are stated with \isacom{have}, the overall goal
 is stated with \isacom{show}. A step can also introduce new local variables with
 \isacom{fix}. Logically, \isacom{fix} introduces \<open>\<And>\<close>-quantified
 variables, \isacom{assume} introduces the assumption of an implication
 (\<open>\<Longrightarrow>\<close>) and \isacom{have}/\isacom{show} introduce the conclusion.
 
 Propositions are optionally named formulas. These names can be referred to in
 later \isacom{from} clauses. In the simplest case, a fact is such a name.
 But facts can also be composed with \<open>OF\<close> and \<open>of\<close> as shown in
 \autoref{sec:forward-proof} --- hence the \dots\ in the above grammar.  Note
 that assumptions, intermediate \isacom{have} statements and global lemmas all
 have the same status and are thus collectively referred to as
 \conceptidx{facts}{fact}.
 
 Fact names can stand for whole lists of facts. For example, if \<open>f\<close> is
 defined by command \isacom{fun}, \<open>f.simps\<close> refers to the whole list of
 recursion equations defining \<open>f\<close>. Individual facts can be selected by
 writing \<open>f.simps(2)\<close>, whole sublists by writing \<open>f.simps(2-4)\<close>.
 
 
 \section{Isar by Example}
 
 We show a number of proofs of Cantor's theorem that a function from a set to
 its powerset cannot be surjective, illustrating various features of Isar. The
 constant \<^const>\<open>surj\<close> is predefined.
 \<close>
 
 lemma "\<not> surj(f :: 'a \<Rightarrow> 'a set)"
 proof
   assume 0: "surj f"
   from 0 have 1: "\<forall>A. \<exists>a. A = f a" by(simp add: surj_def)
   from 1 have 2: "\<exists>a. {x. x \<notin> f x} = f a" by blast
   from 2 show "False" by blast
 qed
 
 text\<open>
 The \isacom{proof} command lacks an explicit method by which to perform
 the proof. In such cases Isabelle tries to use some standard introduction
 rule, in the above case for \<open>\<not>\<close>:
 \[
 \inferrule{
 \mbox{@{thm (prem 1) notI}}}
 {\mbox{@{thm (concl) notI}}}
 \]
 In order to prove \<^prop>\<open>~ P\<close>, assume \<open>P\<close> and show \<open>False\<close>.
 Thus we may assume \mbox{\noquotes{@{prop [source] "surj f"}}}. The proof shows that names of propositions
 may be (single!) digits --- meaningful names are hard to invent and are often
 not necessary. Both \isacom{have} steps are obvious. The second one introduces
 the diagonal set \<^term>\<open>{x. x \<notin> f x}\<close>, the key idea in the proof.
 If you wonder why \<open>2\<close> directly implies \<open>False\<close>: from \<open>2\<close>
 it follows that \<^prop>\<open>a \<notin> f a \<longleftrightarrow> a \<in> f a\<close>.
 
 \subsection{\indexed{\<open>this\<close>}{this}, \indexed{\isacom{then}}{then}, \indexed{\isacom{hence}}{hence} and \indexed{\isacom{thus}}{thus}}
 
 Labels should be avoided. They interrupt the flow of the reader who has to
 scan the context for the point where the label was introduced. Ideally, the
 proof is a linear flow, where the output of one step becomes the input of the
 next step, piping the previously proved fact into the next proof, like
 in a UNIX pipe. In such cases the predefined name \<open>this\<close> can be used
 to refer to the proposition proved in the previous step. This allows us to
 eliminate all labels from our proof (we suppress the \isacom{lemma} statement):
 \<close>
 (*<*)
 lemma "\<not> surj(f :: 'a \<Rightarrow> 'a set)"
 (*>*)
 proof
   assume "surj f"
   from this have "\<exists>a. {x. x \<notin> f x} = f a" by(auto simp: surj_def)
   from this show "False" by blast
 qed
 
 text\<open>We have also taken the opportunity to compress the two \isacom{have}
 steps into one.
 
 To compact the text further, Isar has a few convenient abbreviations:
 \medskip
 
 \begin{tabular}{r@ {\quad=\quad}l}
 \isacom{then} & \isacom{from} \<open>this\<close>\\
 \isacom{thus} & \isacom{then} \isacom{show}\\
 \isacom{hence} & \isacom{then} \isacom{have}
 \end{tabular}
 \medskip
 
 \noindent
 With the help of these abbreviations the proof becomes
 \<close>
 (*<*)
 lemma "\<not> surj(f :: 'a \<Rightarrow> 'a set)"
 (*>*)
 proof
   assume "surj f"
   hence "\<exists>a. {x. x \<notin> f x} = f a" by(auto simp: surj_def)
   thus "False" by blast
 qed
 text\<open>
 
 There are two further linguistic variations:
 \medskip
 
 \begin{tabular}{r@ {\quad=\quad}l}
 (\isacom{have}$\mid$\isacom{show}) \ \textit{prop} \ \indexed{\isacom{using}}{using} \ \textit{facts}
 &
 \isacom{from} \ \textit{facts} \ (\isacom{have}$\mid$\isacom{show}) \ \textit{prop}\\
 \indexed{\isacom{with}}{with} \ \textit{facts} & \isacom{from} \ \textit{facts} \isa{this}
 \end{tabular}
 \medskip
 
 \noindent The \isacom{using} idiom de-emphasizes the used facts by moving them
 behind the proposition.
 
 \subsection{Structured Lemma Statements: \indexed{\isacom{fixes}}{fixes}, \indexed{\isacom{assumes}}{assumes}, \indexed{\isacom{shows}}{shows}}
 \index{lemma@\isacom{lemma}}
 Lemmas can also be stated in a more structured fashion. To demonstrate this
 feature with Cantor's theorem, we rephrase \noquotes{@{prop[source]"\<not> surj f"}}
 a little:
 \<close>
 
 lemma
   fixes f :: "'a \<Rightarrow> 'a set"
   assumes s: "surj f"
   shows "False"
 
 txt\<open>The optional \isacom{fixes} part allows you to state the types of
 variables up front rather than by decorating one of their occurrences in the
 formula with a type constraint. The key advantage of the structured format is
 the \isacom{assumes} part that allows you to name each assumption; multiple
 assumptions can be separated by \isacom{and}. The
 \isacom{shows} part gives the goal. The actual theorem that will come out of
 the proof is \noquotes{@{prop[source]"surj f \<Longrightarrow> False"}}, but during the proof the assumption
 \noquotes{@{prop[source]"surj f"}} is available under the name \<open>s\<close> like any other fact.
 \<close>
 
 proof -
   have "\<exists> a. {x. x \<notin> f x} = f a" using s
     by(auto simp: surj_def)
   thus "False" by blast
 qed
 
 text\<open>
 \begin{warn}
 Note the hyphen after the \isacom{proof} command.
 It is the null method that does nothing to the goal. Leaving it out would be asking
 Isabelle to try some suitable introduction rule on the goal \<^const>\<open>False\<close> --- but
 there is no such rule and \isacom{proof} would fail.
 \end{warn}
 In the \isacom{have} step the assumption \noquotes{@{prop[source]"surj f"}} is now
 referenced by its name \<open>s\<close>. The duplication of \noquotes{@{prop[source]"surj f"}} in the
 above proofs (once in the statement of the lemma, once in its proof) has been
 eliminated.
 
 Stating a lemma with \isacom{assumes}-\isacom{shows} implicitly introduces the
 name \indexed{\<open>assms\<close>}{assms} that stands for the list of all assumptions. You can refer
 to individual assumptions by \<open>assms(1)\<close>, \<open>assms(2)\<close>, etc.,
 thus obviating the need to name them individually.
 
 \section{Proof Patterns}
 
 We show a number of important basic proof patterns. Many of them arise from
 the rules of natural deduction that are applied by \isacom{proof} by
 default. The patterns are phrased in terms of \isacom{show} but work for
 \isacom{have} and \isacom{lemma}, too.
 
 \ifsem\else
 \subsection{Logic}
 \fi
 
 We start with two forms of \concept{case analysis}:
 starting from a formula \<open>P\<close> we have the two cases \<open>P\<close> and
 \<^prop>\<open>~P\<close>, and starting from a fact \<^prop>\<open>P \<or> Q\<close>
 we have the two cases \<open>P\<close> and \<open>Q\<close>:
 \<close>text_raw\<open>
 \begin{tabular}{@ {}ll@ {}}
 \begin{minipage}[t]{.4\textwidth}
 \isa{%
 \<close>
 (*<*)lemma "R" proof-(*>*)
 show "R"
 proof cases
   assume "P"
   text_raw\<open>\\\mbox{}\quad$\vdots$\\\mbox{}\hspace{-1.4ex}\<close>
   show "R" (*<*)sorry(*>*)text_raw\<open>\ \isasymproof\\\<close>
 next
   assume "\<not> P"
   text_raw\<open>\\\mbox{}\quad$\vdots$\\\mbox{}\hspace{-1.4ex}\<close>
   show "R" (*<*)sorry(*>*)text_raw\<open>\ \isasymproof\\\<close>
 qed(*<*)oops(*>*)
 text_raw \<open>}
 \end{minipage}\index{cases@\<open>cases\<close>}
 &
 \begin{minipage}[t]{.4\textwidth}
 \isa{%
 \<close>
 (*<*)lemma "R" proof-(*>*)
 have "P \<or> Q" (*<*)sorry(*>*)text_raw\<open>\ \isasymproof\\\<close>
 then show "R"
 proof
   assume "P"
   text_raw\<open>\\\mbox{}\quad$\vdots$\\\mbox{}\hspace{-1.4ex}\<close>
   show "R" (*<*)sorry(*>*)text_raw\<open>\ \isasymproof\\\<close>
 next
   assume "Q"
   text_raw\<open>\\\mbox{}\quad$\vdots$\\\mbox{}\hspace{-1.4ex}\<close>
   show "R" (*<*)sorry(*>*)text_raw\<open>\ \isasymproof\\\<close>
 qed(*<*)oops(*>*)
 
 text_raw \<open>}
 \end{minipage}
 \end{tabular}
 \medskip
 \begin{isamarkuptext}%
 How to prove a logical equivalence:
 \end{isamarkuptext}%
 \isa{%
 \<close>
 (*<*)lemma "P\<longleftrightarrow>Q" proof-(*>*)
 show "P \<longleftrightarrow> Q"
 proof
   assume "P"
   text_raw\<open>\\\mbox{}\quad$\vdots$\\\mbox{}\hspace{-1.4ex}\<close>
   show "Q" (*<*)sorry(*>*) text_raw\<open>\ \isasymproof\\\<close>
 next
   assume "Q"
   text_raw\<open>\\\mbox{}\quad$\vdots$\\\mbox{}\hspace{-1.4ex}\<close>
   show "P" (*<*)sorry(*>*) text_raw\<open>\ \isasymproof\\\<close>
 qed(*<*)qed(*>*)
 text_raw \<open>}
 \medskip
 \begin{isamarkuptext}%
 Proofs by contradiction (@{thm[source] ccontr} stands for ``classical contradiction''):
 \end{isamarkuptext}%
 \begin{tabular}{@ {}ll@ {}}
 \begin{minipage}[t]{.4\textwidth}
 \isa{%
 \<close>
 (*<*)lemma "\<not> P" proof-(*>*)
 show "\<not> P"
 proof
   assume "P"
   text_raw\<open>\\\mbox{}\quad$\vdots$\\\mbox{}\hspace{-1.4ex}\<close>
   show "False" (*<*)sorry(*>*)text_raw\<open>\ \isasymproof\\\<close>
 qed(*<*)oops(*>*)
 
 text_raw \<open>}
 \end{minipage}
 &
 \begin{minipage}[t]{.4\textwidth}
 \isa{%
 \<close>
 (*<*)lemma "P" proof-(*>*)
 show "P"
 proof (rule ccontr)
   assume "\<not>P"
   text_raw\<open>\\\mbox{}\quad$\vdots$\\\mbox{}\hspace{-1.4ex}\<close>
   show "False" (*<*)sorry(*>*)text_raw\<open>\ \isasymproof\\\<close>
 qed(*<*)oops(*>*)
 
 text_raw \<open>}
 \end{minipage}
 \end{tabular}
 \medskip
 \begin{isamarkuptext}%
 How to prove quantified formulas:
 \end{isamarkuptext}%
 \begin{tabular}{@ {}ll@ {}}
 \begin{minipage}[t]{.4\textwidth}
 \isa{%
 \<close>
 (*<*)lemma "\<forall>x. P x" proof-(*>*)
 show "\<forall>x. P(x)"
 proof
   fix x
   text_raw\<open>\\\mbox{}\quad$\vdots$\\\mbox{}\hspace{-1.4ex}\<close>
   show "P(x)" (*<*)sorry(*>*)text_raw\<open>\ \isasymproof\\\<close>
 qed(*<*)oops(*>*)
 
 text_raw \<open>}
 \end{minipage}
 &
 \begin{minipage}[t]{.4\textwidth}
 \isa{%
 \<close>
 (*<*)lemma "\<exists>x. P(x)" proof-(*>*)
 show "\<exists>x. P(x)"
 proof
   text_raw\<open>\\\mbox{}\quad$\vdots$\\\mbox{}\hspace{-1.4ex}\<close>
   show "P(witness)" (*<*)sorry(*>*)text_raw\<open>\ \isasymproof\\\<close>
 qed
 (*<*)oops(*>*)
 
 text_raw \<open>}
 \end{minipage}
 \end{tabular}
 \medskip
 \begin{isamarkuptext}%
 In the proof of \noquotes{@{prop[source]"\<forall>x. P(x)"}},
 the step \indexed{\isacom{fix}}{fix}~\<open>x\<close> introduces a locally fixed variable \<open>x\<close>
 into the subproof, the proverbial ``arbitrary but fixed value''.
 Instead of \<open>x\<close> we could have chosen any name in the subproof.
 In the proof of \noquotes{@{prop[source]"\<exists>x. P(x)"}},
 \<open>witness\<close> is some arbitrary
 term for which we can prove that it satisfies \<open>P\<close>.
 
 How to reason forward from \noquotes{@{prop[source] "\<exists>x. P(x)"}}:
 \end{isamarkuptext}%
 \<close>
 (*<*)lemma True proof- assume 1: "\<exists>x. P x"(*>*)
 have "\<exists>x. P(x)" (*<*)by(rule 1)(*>*)text_raw\<open>\ \isasymproof\\\<close>
 then obtain x where p: "P(x)" by blast
 (*<*)oops(*>*)
 text\<open>
 After the \indexed{\isacom{obtain}}{obtain} step, \<open>x\<close> (we could have chosen any name)
 is a fixed local
 variable, and \<open>p\<close> is the name of the fact
 \noquotes{@{prop[source] "P(x)"}}.
 This pattern works for one or more \<open>x\<close>.
 As an example of the \isacom{obtain} command, here is the proof of
 Cantor's theorem in more detail:
 \<close>
 
 lemma "\<not> surj(f :: 'a \<Rightarrow> 'a set)"
 proof
   assume "surj f"
   hence  "\<exists>a. {x. x \<notin> f x} = f a" by(auto simp: surj_def)
   then obtain a where  "{x. x \<notin> f x} = f a"  by blast
   hence  "a \<notin> f a \<longleftrightarrow> a \<in> f a"  by blast
   thus "False" by blast
 qed
 
 text_raw\<open>
 \begin{isamarkuptext}%
 
 Finally, how to prove set equality and subset relationship:
 \end{isamarkuptext}%
 \begin{tabular}{@ {}ll@ {}}
 \begin{minipage}[t]{.4\textwidth}
 \isa{%
 \<close>
 (*<*)lemma "A = (B::'a set)" proof-(*>*)
 show "A = B"
 proof
   show "A \<subseteq> B" (*<*)sorry(*>*)text_raw\<open>\ \isasymproof\\\<close>
 next
   show "B \<subseteq> A" (*<*)sorry(*>*)text_raw\<open>\ \isasymproof\\\<close>
 qed(*<*)qed(*>*)
 
 text_raw \<open>}
 \end{minipage}
 &
 \begin{minipage}[t]{.4\textwidth}
 \isa{%
 \<close>
 (*<*)lemma "A <= (B::'a set)" proof-(*>*)
 show "A \<subseteq> B"
 proof
   fix x
   assume "x \<in> A"
   text_raw\<open>\\\mbox{}\quad$\vdots$\\\mbox{}\hspace{-1.4ex}\<close>
   show "x \<in> B" (*<*)sorry(*>*)text_raw\<open>\ \isasymproof\\\<close>
 qed(*<*)qed(*>*)
 
 text_raw \<open>}
 \end{minipage}
 \end{tabular}
 \begin{isamarkuptext}%
 
 \ifsem\else
 \subsection{Chains of (In)Equations}
 
 In textbooks, chains of equations (and inequations) are often displayed like this:
 \begin{quote}
 \begin{tabular}{@ {}l@ {\qquad}l@ {}}
 $t_1 = t_2$ & \isamath{\,\langle\mathit{justification}\rangle}\\
 $\phantom{t_1} = t_3$ & \isamath{\,\langle\mathit{justification}\rangle}\\
 \quad $\vdots$\\
 $\phantom{t_1} = t_n$ & \isamath{\,\langle\mathit{justification}\rangle}
 \end{tabular}
 \end{quote}
 The Isar equivalent is this:
 
 \begin{samepage}
 \begin{quote}
 \isacom{have} \<open>"t\<^sub>1 = t\<^sub>2"\<close> \isasymproof\\
 \isacom{also have} \<open>"... = t\<^sub>3"\<close> \isasymproof\\
 \quad $\vdots$\\
 \isacom{also have} \<open>"... = t\<^sub>n"\<close> \isasymproof \\
 \isacom{finally show} \<open>"t\<^sub>1 = t\<^sub>n"\<close>\ \texttt{.}
 \end{quote}
 \end{samepage}
 
 \noindent
 The ``\<open>...\<close>'' and ``\<open>.\<close>'' deserve some explanation:
 \begin{description}
 \item[``\<open>...\<close>''] is literally three dots. It is the name of an unknown that Isar
 automatically instantiates with the right-hand side of the previous equation.
 In general, if \<open>this\<close> is the theorem \<^term>\<open>p t\<^sub>1 t\<^sub>2\<close> then ``\<open>...\<close>''
 stands for \<open>t\<^sub>2\<close>.
 \item[``\<open>.\<close>''] (a single dot) is a proof method that solves a goal by one of the
 assumptions. This works here because the result of \isacom{finally}
 is the theorem \mbox{\<open>t\<^sub>1 = t\<^sub>n\<close>},
 \isacom{show} \<open>"t\<^sub>1 = t\<^sub>n"\<close> states the theorem explicitly,
 and ``\<open>.\<close>'' proves the theorem with the result of \isacom{finally}.
 \end{description}
 The above proof template also works for arbitrary mixtures of \<open>=\<close>, \<open>\<le>\<close> and \<open><\<close>,
 for example:
 \begin{quote}
 \isacom{have} \<open>"t\<^sub>1 < t\<^sub>2"\<close> \isasymproof\\
 \isacom{also have} \<open>"... = t\<^sub>3"\<close> \isasymproof\\
 \quad $\vdots$\\
 \isacom{also have} \<open>"... \<le> t\<^sub>n"\<close> \isasymproof \\
 \isacom{finally show} \<open>"t\<^sub>1 < t\<^sub>n"\<close>\ \texttt{.}
 \end{quote}
 The relation symbol in the \isacom{finally} step needs to be the most precise one
 possible. In the example above, you must not write \<open>t\<^sub>1 \<le> t\<^sub>n\<close> instead of \mbox{\<open>t\<^sub>1 < t\<^sub>n\<close>}.
 
 \begin{warn}
 Isabelle only supports \<open>=\<close>, \<open>\<le>\<close> and \<open><\<close> but not \<open>\<ge>\<close> and \<open>>\<close>
 in (in)equation chains (by default).
 \end{warn}
 
 If you want to go beyond merely using the above proof patterns and want to
 understand what \isacom{also} and \isacom{finally} mean, read on.
 There is an Isar theorem variable called \<open>calculation\<close>, similar to \<open>this\<close>.
 When the first \isacom{also} in a chain is encountered, Isabelle sets
 \<open>calculation := this\<close>. In each subsequent \isacom{also} step,
 Isabelle composes the theorems \<open>calculation\<close> and \<open>this\<close> (i.e.\ the two previous
 (in)equalities) using some predefined set of rules including transitivity
 of \<open>=\<close>, \<open>\<le>\<close> and \<open><\<close> but also mixed rules like \<^prop>\<open>\<lbrakk> x \<le> y; y < z \<rbrakk> \<Longrightarrow> x < z\<close>.
 The result of this composition is assigned to \<open>calculation\<close>. Consider
 \begin{quote}
 \isacom{have} \<open>"t\<^sub>1 \<le> t\<^sub>2"\<close> \isasymproof\\
 \isacom{also} \isacom{have} \<open>"... < t\<^sub>3"\<close> \isasymproof\\
 \isacom{also} \isacom{have} \<open>"... = t\<^sub>4"\<close> \isasymproof\\
 \isacom{finally show} \<open>"t\<^sub>1 < t\<^sub>4"\<close>\ \texttt{.}
 \end{quote}
 After the first \isacom{also}, \<open>calculation\<close> is \<open>"t\<^sub>1 \<le> t\<^sub>2"\<close>,
 and after the second \isacom{also}, \<open>calculation\<close> is \<open>"t\<^sub>1 < t\<^sub>3"\<close>.
 The command \isacom{finally} is short for \isacom{also from} \<open>calculation\<close>.
 Therefore the \isacom{also} hidden in \isacom{finally} sets \<open>calculation\<close>
 to \<open>t\<^sub>1 < t\<^sub>4\<close> and the final ``\texttt{.}'' succeeds.
 
-For more information on this style of proof see @{cite "BauerW-TPHOLs01"}.
+For more information on this style of proof see \<^cite>\<open>"BauerW-TPHOLs01"\<close>.
 \fi
 
 \section{Streamlining Proofs}
 
 \subsection{Pattern Matching and Quotations}
 
 In the proof patterns shown above, formulas are often duplicated.
 This can make the text harder to read, write and maintain. Pattern matching
 is an abbreviation mechanism to avoid such duplication. Writing
 \begin{quote}
 \isacom{show} \ \textit{formula} \<open>(\<close>\indexed{\isacom{is}}{is} \textit{pattern}\<open>)\<close>
 \end{quote}
 matches the pattern against the formula, thus instantiating the unknowns in
 the pattern for later use. As an example, consider the proof pattern for
 \<open>\<longleftrightarrow>\<close>:
 \end{isamarkuptext}%
 \<close>
 (*<*)lemma "formula\<^sub>1 \<longleftrightarrow> formula\<^sub>2" proof-(*>*)
 show "formula\<^sub>1 \<longleftrightarrow> formula\<^sub>2" (is "?L \<longleftrightarrow> ?R")
 proof
   assume "?L"
   text_raw\<open>\\\mbox{}\quad$\vdots$\\\mbox{}\hspace{-1.4ex}\<close>
   show "?R" (*<*)sorry(*>*) text_raw\<open>\ \isasymproof\\\<close>
 next
   assume "?R"
   text_raw\<open>\\\mbox{}\quad$\vdots$\\\mbox{}\hspace{-1.4ex}\<close>
   show "?L" (*<*)sorry(*>*) text_raw\<open>\ \isasymproof\\\<close>
 qed(*<*)qed(*>*)
 
 text\<open>Instead of duplicating \<open>formula\<^sub>i\<close> in the text, we introduce
 the two abbreviations \<open>?L\<close> and \<open>?R\<close> by pattern matching.
 Pattern matching works wherever a formula is stated, in particular
 with \isacom{have} and \isacom{lemma}.
 
 The unknown \indexed{\<open>?thesis\<close>}{thesis} is implicitly matched against any goal stated by
 \isacom{lemma} or \isacom{show}. Here is a typical example:\<close>
 
 lemma "formula"
 proof -
   text_raw\<open>\\\mbox{}\quad$\vdots$\\\mbox{}\hspace{-1.4ex}\<close>
   show ?thesis (*<*)sorry(*>*) text_raw\<open>\ \isasymproof\\\<close>
 qed
 
 text\<open>
 Unknowns can also be instantiated with \indexed{\isacom{let}}{let} commands
 \begin{quote}
 \isacom{let} \<open>?t\<close> = \<open>"\<close>\textit{some-big-term}\<open>"\<close>
 \end{quote}
 Later proof steps can refer to \<open>?t\<close>:
 \begin{quote}
 \isacom{have} \<open>"\<close>\dots \<open>?t\<close> \dots\<open>"\<close>
 \end{quote}
 \begin{warn}
 Names of facts are introduced with \<open>name:\<close> and refer to proved
 theorems. Unknowns \<open>?X\<close> refer to terms or formulas.
 \end{warn}
 
 Although abbreviations shorten the text, the reader needs to remember what
 they stand for. Similarly for names of facts. Names like \<open>1\<close>, \<open>2\<close>
 and \<open>3\<close> are not helpful and should only be used in short proofs. For
 longer proofs, descriptive names are better. But look at this example:
 \begin{quote}
 \isacom{have} \ \<open>x_gr_0: "x > 0"\<close>\\
 $\vdots$\\
 \isacom{from} \<open>x_gr_0\<close> \dots
 \end{quote}
 The name is longer than the fact it stands for! Short facts do not need names;
 one can refer to them easily by quoting them:
 \begin{quote}
 \isacom{have} \ \<open>"x > 0"\<close>\\
 $\vdots$\\
 \isacom{from} \<open>`x>0`\<close> \dots\index{$IMP053@\<open>`...`\<close>}
 \end{quote}
 Note that the quotes around \<open>x>0\<close> are \conceptnoidx{back quotes}.
 They refer to the fact not by name but by value.
 
 \subsection{\indexed{\isacom{moreover}}{moreover}}
 \index{ultimately@\isacom{ultimately}}
 
 Sometimes one needs a number of facts to enable some deduction. Of course
 one can name these facts individually, as shown on the right,
 but one can also combine them with \isacom{moreover}, as shown on the left:
 \<close>text_raw\<open>
 \begin{tabular}{@ {}ll@ {}}
 \begin{minipage}[t]{.4\textwidth}
 \isa{%
 \<close>
 (*<*)lemma "P" proof-(*>*)
 have "P\<^sub>1" (*<*)sorry(*>*)text_raw\<open>\ \isasymproof\\\<close>
 moreover have "P\<^sub>2" (*<*)sorry(*>*)text_raw\<open>\ \isasymproof\\\<close>
 moreover
 text_raw\<open>\\$\vdots$\\\hspace{-1.4ex}\<close>(*<*)have "True" ..(*>*)
 moreover have "P\<^sub>n" (*<*)sorry(*>*)text_raw\<open>\ \isasymproof\\\<close>
 ultimately have "P"  (*<*)sorry(*>*)text_raw\<open>\ \isasymproof\\\<close>
 (*<*)oops(*>*)
 
 text_raw \<open>}
 \end{minipage}
 &
 \qquad
 \begin{minipage}[t]{.4\textwidth}
 \isa{%
 \<close>
 (*<*)lemma "P" proof-(*>*)
 have lab\<^sub>1: "P\<^sub>1" (*<*)sorry(*>*)text_raw\<open>\ \isasymproof\\\<close>
 have lab\<^sub>2: "P\<^sub>2" (*<*)sorry(*>*)text_raw\<open>\ \isasymproof\<close>
 text_raw\<open>\\$\vdots$\\\hspace{-1.4ex}\<close>
 have lab\<^sub>n: "P\<^sub>n" (*<*)sorry(*>*)text_raw\<open>\ \isasymproof\\\<close>
 from lab\<^sub>1 lab\<^sub>2 text_raw\<open>\ $\dots$\\\<close>
 have "P"  (*<*)sorry(*>*)text_raw\<open>\ \isasymproof\\\<close>
 (*<*)oops(*>*)
 
 text_raw \<open>}
 \end{minipage}
 \end{tabular}
 \begin{isamarkuptext}%
 The \isacom{moreover} version is no shorter but expresses the structure
 a bit more clearly and avoids new names.
 
 \subsection{Local Lemmas}
 
 Sometimes one would like to prove some lemma locally within a proof,
 a lemma that shares the current context of assumptions but that
 has its own assumptions and is generalized over its locally fixed
 variables at the end. This is simply an extension of the basic
 \indexed{\isacom{have}}{have} construct:
 \begin{quote}
 \indexed{\isacom{have}}{have} \<open>B\<close>\
  \indexed{\isacom{if}}{if} \<open>name:\<close> \<open>A\<^sub>1 \<dots> A\<^sub>m\<close>\
  \indexed{\isacom{for}}{for} \<open>x\<^sub>1 \<dots> x\<^sub>n\<close>\\
 \isasymproof
 \end{quote}
 proves \<open>\<lbrakk> A\<^sub>1; \<dots> ; A\<^sub>m \<rbrakk> \<Longrightarrow> B\<close>
 where all \<open>x\<^sub>i\<close> have been replaced by unknowns \<open>?x\<^sub>i\<close>.
 As an example we prove a simple fact about divisibility on integers.
 The definition of \<open>dvd\<close> is @{thm dvd_def}.
 \end{isamarkuptext}%
 \<close>
 
 lemma fixes a b :: int assumes "b dvd (a+b)" shows "b dvd a"
 proof -
   have "\<exists>k'. a = b*k'" if asm: "a+b = b*k" for k
   proof
     show "a = b*(k - 1)" using asm by(simp add: algebra_simps)
   qed
   then show ?thesis using assms by(auto simp add: dvd_def)
 qed
 
 text\<open>
 
 \subsection*{Exercises}
 
 \exercise
 Give a readable, structured proof of the following lemma:
 \<close>
 lemma assumes T: "\<forall>x y. T x y \<or> T y x"
   and A: "\<forall>x y. A x y \<and> A y x \<longrightarrow> x = y"
   and TA: "\<forall>x y. T x y \<longrightarrow> A x y" and "A x y"
   shows "T x y"
 (*<*)oops(*>*)
 text\<open>
 \endexercise
 
 \exercise
 Give a readable, structured proof of the following lemma:
 \<close>
 lemma "\<exists>ys zs. xs = ys @ zs \<and>
             (length ys = length zs \<or> length ys = length zs + 1)"
 (*<*)oops(*>*)
 text\<open>
 Hint: There are predefined functions @{const_typ take} and @{const_typ drop}
 such that \<open>take k [x\<^sub>1,\<dots>] = [x\<^sub>1,\<dots>,x\<^sub>k]\<close> and
 \<open>drop k [x\<^sub>1,\<dots>] = [x\<^bsub>k+1\<^esub>,\<dots>]\<close>. Let sledgehammer find and apply
 the relevant \<^const>\<open>take\<close> and \<^const>\<open>drop\<close> lemmas for you.
 \endexercise
 
 
 \section{Case Analysis and Induction}
 
 \subsection{Datatype Case Analysis}
 \index{case analysis|(}
 
 We have seen case analysis on formulas. Now we want to distinguish
 which form some term takes: is it \<open>0\<close> or of the form \<^term>\<open>Suc n\<close>,
 is it \<^term>\<open>[]\<close> or of the form \<^term>\<open>x#xs\<close>, etc. Here is a typical example
 proof by case analysis on the form of \<open>xs\<close>:
 \<close>
 
 lemma "length(tl xs) = length xs - 1"
 proof (cases xs)
   assume "xs = []"
   thus ?thesis by simp
 next
   fix y ys assume "xs = y#ys"
   thus ?thesis by simp
 qed
 
 text\<open>\index{cases@\<open>cases\<close>|(}Function \<open>tl\<close> (''tail'') is defined by @{thm list.sel(2)} and
 @{thm list.sel(3)}. Note that the result type of \<^const>\<open>length\<close> is \<^typ>\<open>nat\<close>
 and \<^prop>\<open>0 - 1 = (0::nat)\<close>.
 
 This proof pattern works for any term \<open>t\<close> whose type is a datatype.
 The goal has to be proved for each constructor \<open>C\<close>:
 \begin{quote}
 \isacom{fix} \ \<open>x\<^sub>1 \<dots> x\<^sub>n\<close> \isacom{assume} \<open>"t = C x\<^sub>1 \<dots> x\<^sub>n"\<close>
 \end{quote}\index{case@\isacom{case}|(}
 Each case can be written in a more compact form by means of the \isacom{case}
 command:
 \begin{quote}
 \isacom{case} \<open>(C x\<^sub>1 \<dots> x\<^sub>n)\<close>
 \end{quote}
 This is equivalent to the explicit \isacom{fix}-\isacom{assume} line
 but also gives the assumption \<open>"t = C x\<^sub>1 \<dots> x\<^sub>n"\<close> a name: \<open>C\<close>,
 like the constructor.
 Here is the \isacom{case} version of the proof above:
 \<close>
 (*<*)lemma "length(tl xs) = length xs - 1"(*>*)
 proof (cases xs)
   case Nil
   thus ?thesis by simp
 next
   case (Cons y ys)
   thus ?thesis by simp
 qed
 
 text\<open>Remember that \<open>Nil\<close> and \<open>Cons\<close> are the alphanumeric names
 for \<open>[]\<close> and \<open>#\<close>. The names of the assumptions
 are not used because they are directly piped (via \isacom{thus})
 into the proof of the claim.
 \index{case analysis|)}
 
 \subsection{Structural Induction}
 \index{induction|(}
 \index{structural induction|(}
 
 We illustrate structural induction with an example based on natural numbers:
 the sum (\<open>\<Sum>\<close>) of the first \<open>n\<close> natural numbers
 (\<open>{0..n::nat}\<close>) is equal to \mbox{\<^term>\<open>n*(n+1) div 2::nat\<close>}.
 Never mind the details, just focus on the pattern:
 \<close>
 
 lemma "\<Sum>{0..n::nat} = n*(n+1) div 2"
 proof (induction n)
   show "\<Sum>{0..0::nat} = 0*(0+1) div 2" by simp
 next
   fix n assume "\<Sum>{0..n::nat} = n*(n+1) div 2"
   thus "\<Sum>{0..Suc n} = Suc n*(Suc n+1) div 2" by simp
 qed
 
 text\<open>Except for the rewrite steps, everything is explicitly given. This
 makes the proof easily readable, but the duplication means it is tedious to
 write and maintain. Here is how pattern
 matching can completely avoid any duplication:\<close>
 
 lemma "\<Sum>{0..n::nat} = n*(n+1) div 2" (is "?P n")
 proof (induction n)
   show "?P 0" by simp
 next
   fix n assume "?P n"
   thus "?P(Suc n)" by simp
 qed
 
 text\<open>The first line introduces an abbreviation \<open>?P n\<close> for the goal.
 Pattern matching \<open>?P n\<close> with the goal instantiates \<open>?P\<close> to the
 function \<^term>\<open>\<lambda>n. \<Sum>{0..n::nat} = n*(n+1) div 2\<close>.  Now the proposition to
 be proved in the base case can be written as \<open>?P 0\<close>, the induction
 hypothesis as \<open>?P n\<close>, and the conclusion of the induction step as
 \<open>?P(Suc n)\<close>.
 
 Induction also provides the \isacom{case} idiom that abbreviates
 the \isacom{fix}-\isacom{assume} step. The above proof becomes
 \<close>
 (*<*)lemma "\<Sum>{0..n::nat} = n*(n+1) div 2"(*>*)
 proof (induction n)
   case 0
   show ?case by simp
 next
   case (Suc n)
   thus ?case by simp
 qed
 
 text\<open>
 The unknown \<open>?case\<close>\index{case?@\<open>?case\<close>|(} is set in each case to the required
 claim, i.e., \<open>?P 0\<close> and \mbox{\<open>?P(Suc n)\<close>} in the above proof,
 without requiring the user to define a \<open>?P\<close>. The general
 pattern for induction over \<^typ>\<open>nat\<close> is shown on the left-hand side:
 \<close>text_raw\<open>
 \begin{tabular}{@ {}ll@ {}}
 \begin{minipage}[t]{.4\textwidth}
 \isa{%
 \<close>
 (*<*)lemma "P(n::nat)" proof -(*>*)
 show "P(n)"
 proof (induction n)
   case 0
   text_raw\<open>\\\mbox{}\ \ $\vdots$\\\mbox{}\hspace{-1ex}\<close>
   show ?case (*<*)sorry(*>*) text_raw\<open>\ \isasymproof\\\<close>
 next
   case (Suc n)
   text_raw\<open>\\\mbox{}\ \ $\vdots$\\\mbox{}\hspace{-1ex}\<close>
   show ?case (*<*)sorry(*>*) text_raw\<open>\ \isasymproof\\\<close>
 qed(*<*)qed(*>*)
 
 text_raw \<open>}
 \end{minipage}
 &
 \begin{minipage}[t]{.4\textwidth}
 ~\\
 ~\\
 \isacom{let} \<open>?case = "P(0)"\<close>\\
 ~\\
 ~\\
 ~\\[1ex]
 \isacom{fix} \<open>n\<close> \isacom{assume} \<open>Suc: "P(n)"\<close>\\
 \isacom{let} \<open>?case = "P(Suc n)"\<close>\\
 \end{minipage}
 \end{tabular}
 \medskip
 \<close>
 text\<open>
 On the right side you can see what the \isacom{case} command
 on the left stands for.
 
 In case the goal is an implication, induction does one more thing: the
 proposition to be proved in each case is not the whole implication but only
 its conclusion; the premises of the implication are immediately made
 assumptions of that case. That is, if in the above proof we replace
 \isacom{show}~\<open>"P(n)"\<close> by
 \mbox{\isacom{show}~\<open>"A(n) \<Longrightarrow> P(n)"\<close>}
 then \isacom{case}~\<open>0\<close> stands for
 \begin{quote}
 \isacom{assume} \ \<open>0: "A(0)"\<close>\\
 \isacom{let} \<open>?case = "P(0)"\<close>
 \end{quote}
 and \isacom{case}~\<open>(Suc n)\<close> stands for
 \begin{quote}
 \isacom{fix} \<open>n\<close>\\
 \isacom{assume} \<open>Suc:\<close>
   \begin{tabular}[t]{l}\<open>"A(n) \<Longrightarrow> P(n)"\<close>\\\<open>"A(Suc n)"\<close>\end{tabular}\\
 \isacom{let} \<open>?case = "P(Suc n)"\<close>
 \end{quote}
 The list of assumptions \<open>Suc\<close> is actually subdivided
 into \<open>Suc.IH\<close>, the induction hypotheses (here \<open>A(n) \<Longrightarrow> P(n)\<close>),
 and \<open>Suc.prems\<close>, the premises of the goal being proved
 (here \<open>A(Suc n)\<close>).
 
 Induction works for any datatype.
 Proving a goal \<open>\<lbrakk> A\<^sub>1(x); \<dots>; A\<^sub>k(x) \<rbrakk> \<Longrightarrow> P(x)\<close>
 by induction on \<open>x\<close> generates a proof obligation for each constructor
 \<open>C\<close> of the datatype. The command \isacom{case}~\<open>(C x\<^sub>1 \<dots> x\<^sub>n)\<close>
 performs the following steps:
 \begin{enumerate}
 \item \isacom{fix} \<open>x\<^sub>1 \<dots> x\<^sub>n\<close>
 \item \isacom{assume} the induction hypotheses (calling them \<open>C.IH\<close>\index{IH@\<open>.IH\<close>})
  and the premises \mbox{\<open>A\<^sub>i(C x\<^sub>1 \<dots> x\<^sub>n)\<close>} (calling them \<open>C.prems\<close>\index{prems@\<open>.prems\<close>})
  and calling the whole list \<open>C\<close>
 \item \isacom{let} \<open>?case = "P(C x\<^sub>1 \<dots> x\<^sub>n)"\<close>
 \end{enumerate}
 \index{structural induction|)}
 
 
 \ifsem\else
 \subsection{Computation Induction}
 \index{rule induction}
 
 In \autoref{sec:recursive-funs} we introduced computation induction and
 its realization in Isabelle: the definition
 of a recursive function \<open>f\<close> via \isacom{fun} proves the corresponding computation
 induction rule called \<open>f.induct\<close>. Induction with this rule looks like in
 \autoref{sec:recursive-funs}, but now with \isacom{proof} instead of \isacom{apply}:
 \begin{quote}
 \isacom{proof} (\<open>induction x\<^sub>1 \<dots> x\<^sub>k rule: f.induct\<close>)
 \end{quote}
 Just as for structural induction, this creates several cases, one for each
 defining equation for \<open>f\<close>. By default (if the equations have not been named
 by the user), the cases are numbered. That is, they are started by
 \begin{quote}
 \isacom{case} (\<open>i x y ...\<close>)
 \end{quote}
 where \<open>i = 1,...,n\<close>, \<open>n\<close> is the number of equations defining \<open>f\<close>,
 and \<open>x y ...\<close> are the variables in equation \<open>i\<close>. Note the following:
 \begin{itemize}
 \item
 Although \<open>i\<close> is an Isar name, \<open>i.IH\<close> (or similar) is not. You need
 double quotes: "\<open>i.IH\<close>". When indexing the name, write "\<open>i.IH\<close>"(1),
 not "\<open>i.IH\<close>(1)".
 \item
 If defining equations for \<open>f\<close> overlap, \isacom{fun} instantiates them to make
 them nonoverlapping. This means that one user-provided equation may lead to
 several equations and thus to several cases in the induction rule.
 These have names of the form "\<open>i_j\<close>", where \<open>i\<close> is the number of the original
 equation and the system-generated \<open>j\<close> indicates the subcase.
 \end{itemize}
 In Isabelle/jEdit, the \<open>induction\<close> proof method displays a proof skeleton
 with all \isacom{case}s. This is particularly useful for computation induction
 and the following rule induction.
 \fi
 
 
 \subsection{Rule Induction}
 \index{rule induction|(}
 
 Recall the inductive and recursive definitions of even numbers in
 \autoref{sec:inductive-defs}:
 \<close>
 
 inductive ev :: "nat \<Rightarrow> bool" where
 ev0: "ev 0" |
 evSS: "ev n \<Longrightarrow> ev(Suc(Suc n))"
 
 fun evn :: "nat \<Rightarrow> bool" where
 "evn 0 = True" |
 "evn (Suc 0) = False" |
 "evn (Suc(Suc n)) = evn n"
 
 text\<open>We recast the proof of \<^prop>\<open>ev n \<Longrightarrow> evn n\<close> in Isar. The
 left column shows the actual proof text, the right column shows
 the implicit effect of the two \isacom{case} commands:\<close>text_raw\<open>
 \begin{tabular}{@ {}l@ {\qquad}l@ {}}
 \begin{minipage}[t]{.5\textwidth}
 \isa{%
 \<close>
 
 lemma "ev n \<Longrightarrow> evn n"
 proof(induction rule: ev.induct)
   case ev0
   show ?case by simp
 next
   case evSS
 
 
 
   thus ?case by simp
 qed
 
 text_raw \<open>}
 \end{minipage}
 &
 \begin{minipage}[t]{.5\textwidth}
 ~\\
 ~\\
 \isacom{let} \<open>?case = "evn 0"\<close>\\
 ~\\
 ~\\
 \isacom{fix} \<open>n\<close>\\
 \isacom{assume} \<open>evSS:\<close>
   \begin{tabular}[t]{l} \<open>"ev n"\<close>\\\<open>"evn n"\<close>\end{tabular}\\
 \isacom{let} \<open>?case = "evn(Suc(Suc n))"\<close>\\
 \end{minipage}
 \end{tabular}
 \medskip
 \<close>
 text\<open>
 The proof resembles structural induction, but the induction rule is given
 explicitly and the names of the cases are the names of the rules in the
 inductive definition.
 Let us examine the two assumptions named @{thm[source]evSS}:
 \<^prop>\<open>ev n\<close> is the premise of rule @{thm[source]evSS}, which we may assume
 because we are in the case where that rule was used; \<^prop>\<open>evn n\<close>
 is the induction hypothesis.
 \begin{warn}
 Because each \isacom{case} command introduces a list of assumptions
 named like the case name, which is the name of a rule of the inductive
 definition, those rules now need to be accessed with a qualified name, here
 @{thm[source] ev.ev0} and @{thm[source] ev.evSS}.
 \end{warn}
 
 In the case @{thm[source]evSS} of the proof above we have pretended that the
 system fixes a variable \<open>n\<close>.  But unless the user provides the name
 \<open>n\<close>, the system will just invent its own name that cannot be referred
 to.  In the above proof, we do not need to refer to it, hence we do not give
 it a specific name. In case one needs to refer to it one writes
 \begin{quote}
 \isacom{case} \<open>(evSS m)\<close>
 \end{quote}
 like \isacom{case}~\<open>(Suc n)\<close> in earlier structural inductions.
 The name \<open>m\<close> is an arbitrary choice. As a result,
 case @{thm[source] evSS} is derived from a renamed version of
 rule @{thm[source] evSS}: \<open>ev m \<Longrightarrow> ev(Suc(Suc m))\<close>.
 Here is an example with a (contrived) intermediate step that refers to \<open>m\<close>:
 \<close>
 
 lemma "ev n \<Longrightarrow> evn n"
 proof(induction rule: ev.induct)
   case ev0 show ?case by simp
 next
   case (evSS m)
   have "evn(Suc(Suc m)) = evn m" by simp
   thus ?case using `evn m` by blast
 qed
 
 text\<open>
 \indent
 In general, let \<open>I\<close> be a (for simplicity unary) inductively defined
 predicate and let the rules in the definition of \<open>I\<close>
 be called \<open>rule\<^sub>1\<close>, \dots, \<open>rule\<^sub>n\<close>. A proof by rule
 induction follows this pattern:\index{inductionrule@\<open>induction ... rule:\<close>}
 \<close>
 
 (*<*)
 inductive I where rule\<^sub>1: "I()" |  rule\<^sub>2: "I()" |  rule\<^sub>n: "I()"
 lemma "I x \<Longrightarrow> P x" proof-(*>*)
 show "I x \<Longrightarrow> P x"
 proof(induction rule: I.induct)
   case rule\<^sub>1
   text_raw\<open>\\[-.4ex]\mbox{}\ \ $\vdots$\\[-.4ex]\mbox{}\hspace{-1ex}\<close>
   show ?case (*<*)sorry(*>*)text_raw\<open>\ \isasymproof\\\<close>
 next
   text_raw\<open>\\[-.4ex]$\vdots$\\[-.4ex]\mbox{}\hspace{-1ex}\<close>
 (*<*)
   case rule\<^sub>2
   show ?case sorry
 (*>*)
 next
   case rule\<^sub>n
   text_raw\<open>\\[-.4ex]\mbox{}\ \ $\vdots$\\[-.4ex]\mbox{}\hspace{-1ex}\<close>
   show ?case (*<*)sorry(*>*)text_raw\<open>\ \isasymproof\\\<close>
 qed(*<*)qed(*>*)
 
 text\<open>
 One can provide explicit variable names by writing
 \isacom{case}~\<open>(rule\<^sub>i x\<^sub>1 \<dots> x\<^sub>k)\<close>, thus renaming the first \<open>k\<close>
 free variables in rule \<open>i\<close> to \<open>x\<^sub>1 \<dots> x\<^sub>k\<close>,
 going through rule \<open>i\<close> from left to right.
 
 \subsection{Assumption Naming}
 \label{sec:assm-naming}
 
 In any induction, \isacom{case}~\<open>name\<close> sets up a list of assumptions
 also called \<open>name\<close>, which is subdivided into three parts:
 \begin{description}
 \item[\<open>name.IH\<close>]\index{IH@\<open>.IH\<close>} contains the induction hypotheses.
 \item[\<open>name.hyps\<close>]\index{hyps@\<open>.hyps\<close>} contains all the other hypotheses of this case in the
 induction rule. For rule inductions these are the hypotheses of rule
 \<open>name\<close>, for structural inductions these are empty.
 \item[\<open>name.prems\<close>]\index{prems@\<open>.prems\<close>} contains the (suitably instantiated) premises
 of the statement being proved, i.e., the \<open>A\<^sub>i\<close> when
 proving \<open>\<lbrakk> A\<^sub>1; \<dots>; A\<^sub>n \<rbrakk> \<Longrightarrow> A\<close>.
 \end{description}
 \begin{warn}
 Proof method \<open>induct\<close> differs from \<open>induction\<close>
 only in this naming policy: \<open>induct\<close> does not distinguish
 \<open>IH\<close> from \<open>hyps\<close> but subsumes \<open>IH\<close> under \<open>hyps\<close>.
 \end{warn}
 
 More complicated inductive proofs than the ones we have seen so far
 often need to refer to specific assumptions --- just \<open>name\<close> or even
 \<open>name.prems\<close> and \<open>name.IH\<close> can be too unspecific.
 This is where the indexing of fact lists comes in handy, e.g.,
 \<open>name.IH(2)\<close> or \<open>name.prems(1-2)\<close>.
 
 \subsection{Rule Inversion}
 \label{sec:rule-inversion}
 \index{rule inversion|(}
 
 Rule inversion is case analysis of which rule could have been used to
 derive some fact. The name \conceptnoidx{rule inversion} emphasizes that we are
 reasoning backwards: by which rules could some given fact have been proved?
 For the inductive definition of \<^const>\<open>ev\<close>, rule inversion can be summarized
 like this:
 @{prop[display]"ev n \<Longrightarrow> n = 0 \<or> (\<exists>k. n = Suc(Suc k) \<and> ev k)"}
 The realisation in Isabelle is a case analysis.
 A simple example is the proof that \<^prop>\<open>ev n \<Longrightarrow> ev (n - 2)\<close>. We
 already went through the details informally in \autoref{sec:Logic:even}. This
 is the Isar proof:
 \<close>
 (*<*)
 notepad
 begin fix n
 (*>*)
   assume "ev n"
   from this have "ev(n - 2)"
   proof cases
     case ev0 thus "ev(n - 2)" by (simp add: ev.ev0)
   next
     case (evSS k) thus "ev(n - 2)" by (simp add: ev.evSS)
   qed
 (*<*)
 end
 (*>*)
 
 text\<open>The key point here is that a case analysis over some inductively
 defined predicate is triggered by piping the given fact
 (here: \isacom{from}~\<open>this\<close>) into a proof by \<open>cases\<close>.
 Let us examine the assumptions available in each case. In case \<open>ev0\<close>
 we have \<open>n = 0\<close> and in case \<open>evSS\<close> we have \<^prop>\<open>n = Suc(Suc k)\<close>
 and \<^prop>\<open>ev k\<close>. In each case the assumptions are available under the name
 of the case; there is no fine-grained naming schema like there is for induction.
 
 Sometimes some rules could not have been used to derive the given fact
 because constructors clash. As an extreme example consider
 rule inversion applied to \<^prop>\<open>ev(Suc 0)\<close>: neither rule \<open>ev0\<close> nor
 rule \<open>evSS\<close> can yield \<^prop>\<open>ev(Suc 0)\<close> because \<open>Suc 0\<close> unifies
 neither with \<open>0\<close> nor with \<^term>\<open>Suc(Suc n)\<close>. Impossible cases do not
 have to be proved. Hence we can prove anything from \<^prop>\<open>ev(Suc 0)\<close>:
 \<close>
 (*<*)
 notepad begin fix P
 (*>*)
   assume "ev(Suc 0)" then have P by cases
 (*<*)
 end
 (*>*)
 
 text\<open>That is, \<^prop>\<open>ev(Suc 0)\<close> is simply not provable:\<close>
 
 lemma "\<not> ev(Suc 0)"
 proof
   assume "ev(Suc 0)" then show False by cases
 qed
 
 text\<open>Normally not all cases will be impossible. As a simple exercise,
 prove that \mbox{\<^prop>\<open>\<not> ev(Suc(Suc(Suc 0)))\<close>.}
 
 \subsection{Advanced Rule Induction}
 \label{sec:advanced-rule-induction}
 
 So far, rule induction was always applied to goals of the form \<open>I x y z \<Longrightarrow> \<dots>\<close>
 where \<open>I\<close> is some inductively defined predicate and \<open>x\<close>, \<open>y\<close>, \<open>z\<close>
 are variables. In some rare situations one needs to deal with an assumption where
 not all arguments \<open>r\<close>, \<open>s\<close>, \<open>t\<close> are variables:
 \begin{isabelle}
 \isacom{lemma} \<open>"I r s t \<Longrightarrow> \<dots>"\<close>
 \end{isabelle}
 Applying the standard form of
 rule induction in such a situation will lead to strange and typically unprovable goals.
 We can easily reduce this situation to the standard one by introducing
 new variables \<open>x\<close>, \<open>y\<close>, \<open>z\<close> and reformulating the goal like this:
 \begin{isabelle}
 \isacom{lemma} \<open>"I x y z \<Longrightarrow> x = r \<Longrightarrow> y = s \<Longrightarrow> z = t \<Longrightarrow> \<dots>"\<close>
 \end{isabelle}
 Standard rule induction will work fine now, provided the free variables in
 \<open>r\<close>, \<open>s\<close>, \<open>t\<close> are generalized via \<open>arbitrary\<close>.
 
 However, induction can do the above transformation for us, behind the curtains, so we never
 need to see the expanded version of the lemma. This is what we need to write:
 \begin{isabelle}
 \isacom{lemma} \<open>"I r s t \<Longrightarrow> \<dots>"\<close>\isanewline
 \isacom{proof}\<open>(induction "r" "s" "t" arbitrary: \<dots> rule: I.induct)\<close>\index{inductionrule@\<open>induction ... rule:\<close>}\index{arbitrary@\<open>arbitrary:\<close>}
 \end{isabelle}
 Like for rule inversion, cases that are impossible because of constructor clashes
 will not show up at all. Here is a concrete example:\<close>
 
 lemma "ev (Suc m) \<Longrightarrow> \<not> ev m"
 proof(induction "Suc m" arbitrary: m rule: ev.induct)
   fix n assume IH: "\<And>m. n = Suc m \<Longrightarrow> \<not> ev m"
   show "\<not> ev (Suc n)"
   proof \<comment> \<open>contradiction\<close>
     assume "ev(Suc n)"
     thus False
     proof cases \<comment> \<open>rule inversion\<close>
       fix k assume "n = Suc k" "ev k"
       thus False using IH by auto
     qed
   qed
 qed
 
 text\<open>
 Remarks:
 \begin{itemize}
 \item 
 Instead of the \isacom{case} and \<open>?case\<close> magic we have spelled all formulas out.
 This is merely for greater clarity.
 \item
 We only need to deal with one case because the @{thm[source] ev0} case is impossible.
 \item
 The form of the \<open>IH\<close> shows us that internally the lemma was expanded as explained
 above: \noquotes{@{prop[source]"ev x \<Longrightarrow> x = Suc m \<Longrightarrow> \<not> ev m"}}.
 \item
 The goal \<^prop>\<open>\<not> ev (Suc n)\<close> may surprise. The expanded version of the lemma
 would suggest that we have a \isacom{fix} \<open>m\<close> \isacom{assume} \<^prop>\<open>Suc(Suc n) = Suc m\<close>
 and need to show \<^prop>\<open>\<not> ev m\<close>. What happened is that Isabelle immediately
 simplified \<^prop>\<open>Suc(Suc n) = Suc m\<close> to \<^prop>\<open>Suc n = m\<close> and could then eliminate
 \<open>m\<close>. Beware of such nice surprises with this advanced form of induction.
 \end{itemize}
 \begin{warn}
 This advanced form of induction does not support the \<open>IH\<close>
 naming schema explained in \autoref{sec:assm-naming}:
 the induction hypotheses are instead found under the name \<open>hyps\<close>,
 as they are for the simpler
 \<open>induct\<close> method.
 \end{warn}
 \index{induction|)}
 \index{cases@\<open>cases\<close>|)}
 \index{case@\isacom{case}|)}
 \index{case?@\<open>?case\<close>|)}
 \index{rule induction|)}
 \index{rule inversion|)}
 
 \subsection*{Exercises}
 
 
 \exercise
 Give a structured proof by rule inversion:
 \<close>
 
 lemma assumes a: "ev(Suc(Suc n))" shows "ev n"
 (*<*)oops(*>*)
 
 text\<open>
 \endexercise
 
 \begin{exercise}
 Give a structured proof of \<^prop>\<open>\<not> ev(Suc(Suc(Suc 0)))\<close>
 by rule inversions. If there are no cases to be proved you can close
 a proof immediately with \isacom{qed}.
 \end{exercise}
 
 \begin{exercise}
 Recall predicate \<open>star\<close> from \autoref{sec:star} and \<open>iter\<close>
 from Exercise~\ref{exe:iter}. Prove \<^prop>\<open>iter r n x y \<Longrightarrow> star r x y\<close>
 in a structured style; do not just sledgehammer each case of the
 required induction.
 \end{exercise}
 
 \begin{exercise}
 Define a recursive function \<open>elems ::\<close> \<^typ>\<open>'a list \<Rightarrow> 'a set\<close>
 and prove \<^prop>\<open>x \<in> elems xs \<Longrightarrow> \<exists>ys zs. xs = ys @ x # zs \<and> x \<notin> elems ys\<close>.
 \end{exercise}
 
 \begin{exercise}
 Extend Exercise~\ref{exe:cfg} with a function that checks if some
 \mbox{\<open>alpha list\<close>} is a balanced
 string of parentheses. More precisely, define a \mbox{recursive} function
 \<open>balanced :: nat \<Rightarrow> alpha list \<Rightarrow> bool\<close> such that \<^term>\<open>balanced n w\<close>
 is true iff (informally) \<open>S (a\<^sup>n @ w)\<close>. Formally, prove that
 \<^prop>\<open>balanced n w \<longleftrightarrow> S (replicate n a @ w)\<close> where
 \<^const>\<open>replicate\<close> \<open>::\<close> \<^typ>\<open>nat \<Rightarrow> 'a \<Rightarrow> 'a list\<close> is predefined
 and \<^term>\<open>replicate n x\<close> yields the list \<open>[x, \<dots>, x]\<close> of length \<open>n\<close>.
 \end{exercise}
 \<close>
 
 (*<*)
 end
 (*>*)
diff --git a/src/Doc/Prog_Prove/Logic.thy b/src/Doc/Prog_Prove/Logic.thy
--- a/src/Doc/Prog_Prove/Logic.thy
+++ b/src/Doc/Prog_Prove/Logic.thy
@@ -1,880 +1,880 @@
 (*<*)
 theory Logic
 imports LaTeXsugar
 begin
 (*>*)
 text\<open>
 \vspace{-5ex}
 \section{Formulas}
 
 The core syntax of formulas (\textit{form} below)
 provides the standard logical constructs, in decreasing order of precedence:
 \[
 \begin{array}{rcl}
 
 \mathit{form} & ::= &
   \<open>(form)\<close> ~\mid~
   \<^const>\<open>True\<close> ~\mid~
   \<^const>\<open>False\<close> ~\mid~
   \<^prop>\<open>term = term\<close>\\
  &\mid& \<^prop>\<open>\<not> form\<close>\index{$HOL4@\isasymnot} ~\mid~
   \<^prop>\<open>form \<and> form\<close>\index{$HOL0@\isasymand} ~\mid~
   \<^prop>\<open>form \<or> form\<close>\index{$HOL1@\isasymor} ~\mid~
   \<^prop>\<open>form \<longrightarrow> form\<close>\index{$HOL2@\isasymlongrightarrow}\\
  &\mid& \<^prop>\<open>\<forall>x. form\<close>\index{$HOL6@\isasymforall} ~\mid~  \<^prop>\<open>\<exists>x. form\<close>\index{$HOL7@\isasymexists}
 \end{array}
 \]
 Terms are the ones we have seen all along, built from constants, variables,
 function application and \<open>\<lambda>\<close>-abstraction, including all the syntactic
 sugar like infix symbols, \<open>if\<close>, \<open>case\<close>, etc.
 \begin{warn}
 Remember that formulas are simply terms of type \<open>bool\<close>. Hence
 \<open>=\<close> also works for formulas. Beware that \<open>=\<close> has a higher
 precedence than the other logical operators. Hence \<^prop>\<open>s = t \<and> A\<close> means
 \<open>(s = t) \<and> A\<close>, and \<^prop>\<open>A\<and>B = B\<and>A\<close> means \<open>A \<and> (B = B) \<and> A\<close>.
 Logical equivalence can also be written with
 \<open>\<longleftrightarrow>\<close> instead of \<open>=\<close>, where \<open>\<longleftrightarrow>\<close> has the same low
 precedence as \<open>\<longrightarrow>\<close>. Hence \<open>A \<and> B \<longleftrightarrow> B \<and> A\<close> really means
 \<open>(A \<and> B) \<longleftrightarrow> (B \<and> A)\<close>.
 \end{warn}
 \begin{warn}
 Quantifiers need to be enclosed in parentheses if they are nested within
 other constructs (just like \<open>if\<close>, \<open>case\<close> and \<open>let\<close>).
 \end{warn}
 The most frequent logical symbols and their ASCII representations are shown
 in Fig.~\ref{fig:log-symbols}.
 \begin{figure}
 \begin{center}
 \begin{tabular}{l@ {\qquad}l@ {\qquad}l}
 \<open>\<forall>\<close> & \xsymbol{forall} & \texttt{ALL}\\
 \<open>\<exists>\<close> & \xsymbol{exists} & \texttt{EX}\\
 \<open>\<lambda>\<close> & \xsymbol{lambda} & \texttt{\%}\\
 \<open>\<longrightarrow>\<close> & \texttt{-{\kern0pt}->}\\
 \<open>\<longleftrightarrow>\<close> & \texttt{<->}\\
 \<open>\<and>\<close> & \texttt{/\char`\\} & \texttt{\&}\\
 \<open>\<or>\<close> & \texttt{\char`\\/} & \texttt{|}\\
 \<open>\<not>\<close> & \xsymbol{not} & \texttt{\char`~}\\
 \<open>\<noteq>\<close> & \xsymbol{noteq} & \texttt{\char`~=}
 \end{tabular}
 \end{center}
 \caption{Logical symbols and their ASCII forms}
 \label{fig:log-symbols}
 \end{figure}
 The first column shows the symbols, the other columns ASCII representations.
 The \texttt{\char`\\}\texttt{<...>} form is always converted into the symbolic form
 by the Isabelle interfaces, the treatment of the other ASCII forms
 depends on the interface. The ASCII forms \texttt{/\char`\\} and
 \texttt{\char`\\/}
 are special in that they are merely keyboard shortcuts for the interface and
 not logical symbols by themselves.
 \begin{warn}
 The implication \<open>\<Longrightarrow>\<close> is part of the Isabelle framework. It structures
 theorems and proof states, separating assumptions from conclusions.
 The implication \<open>\<longrightarrow>\<close> is part of the logic HOL and can occur inside the
 formulas that make up the assumptions and conclusion.
 Theorems should be of the form \<open>\<lbrakk> A\<^sub>1; \<dots>; A\<^sub>n \<rbrakk> \<Longrightarrow> A\<close>,
 not \<open>A\<^sub>1 \<and> \<dots> \<and> A\<^sub>n \<longrightarrow> A\<close>. Both are logically equivalent
 but the first one works better when using the theorem in further proofs.
 
 The ASCII representation of \<open>\<lbrakk>\<close> and \<open>\<rbrakk>\<close> is \texttt{[|} and \texttt{|]}.
 \end{warn}
 
 \section{Sets}
 \label{sec:Sets}
 
 Sets of elements of type \<^typ>\<open>'a\<close> have type \<^typ>\<open>'a set\<close>\index{set@\<open>set\<close>}.
 They can be finite or infinite. Sets come with the usual notation:
 \begin{itemize}
 \item \indexed{\<^term>\<open>{}\<close>}{$IMP042},\quad \<open>{e\<^sub>1,\<dots>,e\<^sub>n}\<close>
 \item \<^prop>\<open>e \<in> A\<close>\index{$HOLSet0@\isasymin},\quad \<^prop>\<open>A \<subseteq> B\<close>\index{$HOLSet2@\isasymsubseteq}
 \item \<^term>\<open>A \<union> B\<close>\index{$HOLSet4@\isasymunion},\quad \<^term>\<open>A \<inter> B\<close>\index{$HOLSet5@\isasyminter},\quad \<^term>\<open>A - B\<close>,\quad \<^term>\<open>-A\<close>
 \end{itemize}
 (where \<^term>\<open>A-B\<close> and \<open>-A\<close> are set difference and complement)
 and much more. \<^const>\<open>UNIV\<close> is the set of all elements of some type.
 Set comprehension\index{set comprehension} is written
 \<^term>\<open>{x. P}\<close>\index{$IMP042@\<^term>\<open>{x. P}\<close>} rather than \<open>{x | P}\<close>.
 \begin{warn}
 In \<^term>\<open>{x. P}\<close> the \<open>x\<close> must be a variable. Set comprehension
 involving a proper term \<open>t\<close> must be written
 \noquotes{@{term[source] "{t | x y. P}"}}\index{$IMP042@\<open>{t |x. P}\<close>},
 where \<open>x y\<close> are those free variables in \<open>t\<close>
 that occur in \<open>P\<close>.
 This is just a shorthand for \<^term>\<open>{v. \<exists>x y. v = t \<and> P}\<close>, where
 \<open>v\<close> is a new variable. For example, \<^term>\<open>{x+y|x. x \<in> A}\<close>
 is short for \noquotes{@{term[source]"{v. \<exists>x. v = x+y \<and> x \<in> A}"}}.
 \end{warn}
 
 Here are the ASCII representations of the mathematical symbols:
 \begin{center}
 \begin{tabular}{l@ {\quad}l@ {\quad}l}
 \<open>\<in>\<close> & \texttt{\char`\\\char`\<in>} & \texttt{:}\\
 \<open>\<subseteq>\<close> & \texttt{\char`\\\char`\<subseteq>} & \texttt{<=}\\
 \<open>\<union>\<close> & \texttt{\char`\\\char`\<union>} & \texttt{Un}\\
 \<open>\<inter>\<close> & \texttt{\char`\\\char`\<inter>} & \texttt{Int}
 \end{tabular}
 \end{center}
 Sets also allow bounded quantifications \<^prop>\<open>\<forall>x \<in> A. P\<close> and
 \<^prop>\<open>\<exists>x \<in> A. P\<close>.
 
 For the more ambitious, there are also \<open>\<Union>\<close>\index{$HOLSet6@\isasymUnion}
 and \<open>\<Inter>\<close>\index{$HOLSet7@\isasymInter}:
 \begin{center}
 @{thm Union_eq} \qquad @{thm Inter_eq}
 \end{center}
 The ASCII forms of \<open>\<Union>\<close> are \texttt{\char`\\\char`\<Union>} and \texttt{Union},
 those of \<open>\<Inter>\<close> are \texttt{\char`\\\char`\<Inter>} and \texttt{Inter}.
 There are also indexed unions and intersections:
 \begin{center}
 @{thm[eta_contract=false] UNION_eq} \\ @{thm[eta_contract=false] INTER_eq}
 \end{center}
 The ASCII forms are \ \texttt{UN x:A.~B} \ and \ \texttt{INT x:A. B} \
 where \texttt{x} may occur in \texttt{B}.
 If \texttt{A} is \texttt{UNIV} you can write \ \texttt{UN x.~B} \ and \ \texttt{INT x. B}.
 
 Some other frequently useful functions on sets are the following:
 \begin{center}
 \begin{tabular}{l@ {\quad}l}
 @{const_typ set}\index{set@\<^const>\<open>set\<close>} & converts a list to the set of its elements\\
 @{const_typ finite}\index{finite@\<^const>\<open>finite\<close>} & is true iff its argument is finite\\
 \noquotes{@{term[source] "card :: 'a set \<Rightarrow> nat"}}\index{card@\<^const>\<open>card\<close>} & is the cardinality of a finite set\\
  & and is \<open>0\<close> for all infinite sets\\
 @{thm image_def}\index{$IMP042@\<^term>\<open>f ` A\<close>} & is the image of a function over a set
 \end{tabular}
 \end{center}
-See @{cite "Nipkow-Main"} for the wealth of further predefined functions in theory
+See \<^cite>\<open>"Nipkow-Main"\<close> for the wealth of further predefined functions in theory
 \<^theory>\<open>Main\<close>.
 
 
 \subsection*{Exercises}
 
 \exercise
 Start from the data type of binary trees defined earlier:
 \<close>
 
 datatype 'a tree = Tip | Node "'a tree" 'a "'a tree"
 
 text\<open>
 Define a function \<open>set ::\<close> \<^typ>\<open>'a tree \<Rightarrow> 'a set\<close>
 that returns the elements in a tree and a function
 \<open>ord ::\<close> \<^typ>\<open>int tree \<Rightarrow> bool\<close>
 that tests if an \<^typ>\<open>int tree\<close> is ordered.
 
 Define a function \<open>ins\<close> that inserts an element into an ordered \<^typ>\<open>int tree\<close>
 while maintaining the order of the tree. If the element is already in the tree, the
 same tree should be returned. Prove correctness of \<open>ins\<close>:
 \<^prop>\<open>set(ins x t) = {x} \<union> set t\<close> and \<^prop>\<open>ord t \<Longrightarrow> ord(ins i t)\<close>.
 \endexercise
 
 
 \section{Proof Automation}
 
 So far we have only seen \<open>simp\<close> and \indexed{\<open>auto\<close>}{auto}: Both perform
 rewriting, both can also prove linear arithmetic facts (no multiplication),
 and \<open>auto\<close> is also able to prove simple logical or set-theoretic goals:
 \<close>
 
 lemma "\<forall>x. \<exists>y. x = y"
 by auto
 
 lemma "A \<subseteq> B \<inter> C \<Longrightarrow> A \<subseteq> B \<union> C"
 by auto
 
 text\<open>where
 \begin{quote}
 \isacom{by} \textit{proof-method}
 \end{quote}
 is short for
 \begin{quote}
 \isacom{apply} \textit{proof-method}\\
 \isacom{done}
 \end{quote}
 The key characteristics of both \<open>simp\<close> and \<open>auto\<close> are
 \begin{itemize}
 \item They show you where they got stuck, giving you an idea how to continue.
 \item They perform the obvious steps but are highly incomplete.
 \end{itemize}
 A proof method is \conceptnoidx{complete} if it can prove all true formulas.
 There is no complete proof method for HOL, not even in theory.
 Hence all our proof methods only differ in how incomplete they are.
 
 A proof method that is still incomplete but tries harder than \<open>auto\<close> is
 \indexed{\<open>fastforce\<close>}{fastforce}.  It either succeeds or fails, it acts on the first
 subgoal only, and it can be modified like \<open>auto\<close>, e.g.,
 with \<open>simp add\<close>. Here is a typical example of what \<open>fastforce\<close>
 can do:
 \<close>
 
 lemma "\<lbrakk> \<forall>xs \<in> A. \<exists>ys. xs = ys @ ys;  us \<in> A \<rbrakk>
    \<Longrightarrow> \<exists>n. length us = n+n"
 by fastforce
 
 text\<open>This lemma is out of reach for \<open>auto\<close> because of the
 quantifiers.  Even \<open>fastforce\<close> fails when the quantifier structure
 becomes more complicated. In a few cases, its slow version \<open>force\<close>
 succeeds where \<open>fastforce\<close> fails.
 
 The method of choice for complex logical goals is \indexed{\<open>blast\<close>}{blast}. In the
 following example, \<open>T\<close> and \<open>A\<close> are two binary predicates. It
 is shown that if \<open>T\<close> is total, \<open>A\<close> is antisymmetric and \<open>T\<close> is
 a subset of \<open>A\<close>, then \<open>A\<close> is a subset of \<open>T\<close>:
 \<close>
 
 lemma
   "\<lbrakk> \<forall>x y. T x y \<or> T y x;
      \<forall>x y. A x y \<and> A y x \<longrightarrow> x = y;
      \<forall>x y. T x y \<longrightarrow> A x y \<rbrakk>
    \<Longrightarrow> \<forall>x y. A x y \<longrightarrow> T x y"
 by blast
 
 text\<open>
 We leave it to the reader to figure out why this lemma is true.
 Method \<open>blast\<close>
 \begin{itemize}
 \item is (in principle) a complete proof procedure for first-order formulas,
   a fragment of HOL. In practice there is a search bound.
 \item does no rewriting and knows very little about equality.
 \item covers logic, sets and relations.
 \item either succeeds or fails.
 \end{itemize}
 Because of its strength in logic and sets and its weakness in equality reasoning, it complements the earlier proof methods.
 
 
 \subsection{\concept{Sledgehammer}}
 
 Command \isacom{sledgehammer} calls a number of external automatic
 theorem provers (ATPs) that run for up to 30 seconds searching for a
 proof. Some of these ATPs are part of the Isabelle installation, others are
 queried over the internet. If successful, a proof command is generated and can
 be inserted into your proof.  The biggest win of \isacom{sledgehammer} is
 that it will take into account the whole lemma library and you do not need to
 feed in any lemma explicitly. For example,\<close>
 
 lemma "\<lbrakk> xs @ ys = ys @ xs;  length xs = length ys \<rbrakk> \<Longrightarrow> xs = ys"
 
 txt\<open>cannot be solved by any of the standard proof methods, but
 \isacom{sledgehammer} finds the following proof:\<close>
 
 by (metis append_eq_conv_conj)
 
 text\<open>We do not explain how the proof was found but what this command
 means. For a start, Isabelle does not trust external tools (and in particular
 not the translations from Isabelle's logic to those tools!)
 and insists on a proof that it can check. This is what \indexed{\<open>metis\<close>}{metis} does.
 It is given a list of lemmas and tries to find a proof using just those lemmas
 (and pure logic). In contrast to using \<open>simp\<close> and friends who know a lot of
 lemmas already, using \<open>metis\<close> manually is tedious because one has
 to find all the relevant lemmas first. But that is precisely what
 \isacom{sledgehammer} does for us.
 In this case lemma @{thm[source]append_eq_conv_conj} alone suffices:
 @{thm[display] append_eq_conv_conj}
 We leave it to the reader to figure out why this lemma suffices to prove
 the above lemma, even without any knowledge of what the functions \<^const>\<open>take\<close>
 and \<^const>\<open>drop\<close> do. Keep in mind that the variables in the two lemmas
 are independent of each other, despite the same names, and that you can
 substitute arbitrary values for the free variables in a lemma.
 
 Just as for the other proof methods we have seen, there is no guarantee that
 \isacom{sledgehammer} will find a proof if it exists. Nor is
 \isacom{sledgehammer} superior to the other proof methods.  They are
 incomparable. Therefore it is recommended to apply \<open>simp\<close> or \<open>auto\<close> before invoking \isacom{sledgehammer} on what is left.
 
 \subsection{Arithmetic}
 
 By arithmetic formulas we mean formulas involving variables, numbers, \<open>+\<close>, \<open>-\<close>, \<open>=\<close>, \<open><\<close>, \<open>\<le>\<close> and the usual logical
 connectives \<open>\<not>\<close>, \<open>\<and>\<close>, \<open>\<or>\<close>, \<open>\<longrightarrow>\<close>,
 \<open>\<longleftrightarrow>\<close>. Strictly speaking, this is known as \concept{linear arithmetic}
 because it does not involve multiplication, although multiplication with
 numbers, e.g., \<open>2*n\<close>, is allowed. Such formulas can be proved by
 \indexed{\<open>arith\<close>}{arith}:
 \<close>
 
 lemma "\<lbrakk> (a::nat) \<le> x + b; 2*x < c \<rbrakk> \<Longrightarrow> 2*a + 1 \<le> 2*b + c"
 by arith
 
 text\<open>In fact, \<open>auto\<close> and \<open>simp\<close> can prove many linear
 arithmetic formulas already, like the one above, by calling a weak but fast
 version of \<open>arith\<close>. Hence it is usually not necessary to invoke
 \<open>arith\<close> explicitly.
 
 The above example involves natural numbers, but integers (type \<^typ>\<open>int\<close>)
 and real numbers (type \<open>real\<close>) are supported as well. As are a number
 of further operators like \<^const>\<open>min\<close> and \<^const>\<open>max\<close>. On \<^typ>\<open>nat\<close> and
 \<^typ>\<open>int\<close>, \<open>arith\<close> can even prove theorems with quantifiers in them,
 but we will not enlarge on that here.
 
 
 \subsection{Trying Them All}
 
 If you want to try all of the above automatic proof methods you simply type
 \begin{isabelle}
 \isacom{try}
 \end{isabelle}
 There is also a lightweight variant \isacom{try0} that does not call
 sledgehammer. If desired, specific simplification and introduction rules
 can be added:
 \begin{isabelle}
 \isacom{try0} \<open>simp: \<dots> intro: \<dots>\<close>
 \end{isabelle}
 
 \section{Single Step Proofs}
 
 Although automation is nice, it often fails, at least initially, and you need
 to find out why. When \<open>fastforce\<close> or \<open>blast\<close> simply fail, you have
 no clue why. At this point, the stepwise
 application of proof rules may be necessary. For example, if \<open>blast\<close>
 fails on \<^prop>\<open>A \<and> B\<close>, you want to attack the two
 conjuncts \<open>A\<close> and \<open>B\<close> separately. This can
 be achieved by applying \emph{conjunction introduction}
 \[ @{thm[mode=Rule,show_question_marks]conjI}\ \<open>conjI\<close>
 \]
 to the proof state. We will now examine the details of this process.
 
 \subsection{Instantiating Unknowns}
 
 We had briefly mentioned earlier that after proving some theorem,
 Isabelle replaces all free variables \<open>x\<close> by so called \conceptidx{unknowns}{unknown}
 \<open>?x\<close>. We can see this clearly in rule @{thm[source] conjI}.
 These unknowns can later be instantiated explicitly or implicitly:
 \begin{itemize}
 \item By hand, using \indexed{\<open>of\<close>}{of}.
 The expression \<open>conjI[of "a=b" "False"]\<close>
 instantiates the unknowns in @{thm[source] conjI} from left to right with the
 two formulas \<open>a=b\<close> and \<open>False\<close>, yielding the rule
 @{thm[display,mode=Rule,margin=100]conjI[of "a=b" False]}
 
 In general, \<open>th[of string\<^sub>1 \<dots> string\<^sub>n]\<close> instantiates
 the unknowns in the theorem \<open>th\<close> from left to right with the terms
 \<open>string\<^sub>1\<close> to \<open>string\<^sub>n\<close>.
 
 \item By unification. \conceptidx{Unification}{unification} is the process of making two
 terms syntactically equal by suitable instantiations of unknowns. For example,
 unifying \<open>?P \<and> ?Q\<close> with \mbox{\<^prop>\<open>a=b \<and> False\<close>} instantiates
 \<open>?P\<close> with \<^prop>\<open>a=b\<close> and \<open>?Q\<close> with \<^prop>\<open>False\<close>.
 \end{itemize}
 We need not instantiate all unknowns. If we want to skip a particular one we
 can write \<open>_\<close> instead, for example \<open>conjI[of _ "False"]\<close>.
 Unknowns can also be instantiated by name using \indexed{\<open>where\<close>}{where}, for example
 \<open>conjI[where ?P = "a=b"\<close> \isacom{and} \<open>?Q = "False"]\<close>.
 
 
 \subsection{Rule Application}
 
 \conceptidx{Rule application}{rule application} means applying a rule backwards to a proof state.
 For example, applying rule @{thm[source]conjI} to a proof state
 \begin{quote}
 \<open>1.  \<dots>  \<Longrightarrow> A \<and> B\<close>
 \end{quote}
 results in two subgoals, one for each premise of @{thm[source]conjI}:
 \begin{quote}
 \<open>1.  \<dots>  \<Longrightarrow> A\<close>\\
 \<open>2.  \<dots>  \<Longrightarrow> B\<close>
 \end{quote}
 In general, the application of a rule \<open>\<lbrakk> A\<^sub>1; \<dots>; A\<^sub>n \<rbrakk> \<Longrightarrow> A\<close>
 to a subgoal \mbox{\<open>\<dots> \<Longrightarrow> C\<close>} proceeds in two steps:
 \begin{enumerate}
 \item
 Unify \<open>A\<close> and \<open>C\<close>, thus instantiating the unknowns in the rule.
 \item
 Replace the subgoal \<open>C\<close> with \<open>n\<close> new subgoals \<open>A\<^sub>1\<close> to \<open>A\<^sub>n\<close>.
 \end{enumerate}
 This is the command to apply rule \<open>xyz\<close>:
 \begin{quote}
 \isacom{apply}\<open>(rule xyz)\<close>\index{rule@\<open>rule\<close>}
 \end{quote}
 This is also called \concept{backchaining} with rule \<open>xyz\<close>.
 
 \subsection{Introduction Rules}
 
 Conjunction introduction (@{thm[source] conjI}) is one example of a whole
 class of rules known as \conceptidx{introduction rules}{introduction rule}. They explain under which
 premises some logical construct can be introduced. Here are some further
 useful introduction rules:
 \[
 \inferrule*[right=\mbox{\<open>impI\<close>}]{\mbox{\<open>?P \<Longrightarrow> ?Q\<close>}}{\mbox{\<open>?P \<longrightarrow> ?Q\<close>}}
 \qquad
 \inferrule*[right=\mbox{\<open>allI\<close>}]{\mbox{\<open>\<And>x. ?P x\<close>}}{\mbox{\<open>\<forall>x. ?P x\<close>}}
 \]
 \[
 \inferrule*[right=\mbox{\<open>iffI\<close>}]{\mbox{\<open>?P \<Longrightarrow> ?Q\<close>} \\ \mbox{\<open>?Q \<Longrightarrow> ?P\<close>}}
   {\mbox{\<open>?P = ?Q\<close>}}
 \]
 These rules are part of the logical system of \concept{natural deduction}
-(e.g., @{cite HuthRyan}). Although we intentionally de-emphasize the basic rules
+(e.g., \<^cite>\<open>HuthRyan\<close>). Although we intentionally de-emphasize the basic rules
 of logic in favour of automatic proof methods that allow you to take bigger
 steps, these rules are helpful in locating where and why automation fails.
 When applied backwards, these rules decompose the goal:
 \begin{itemize}
 \item @{thm[source] conjI} and @{thm[source]iffI} split the goal into two subgoals,
 \item @{thm[source] impI} moves the left-hand side of a HOL implication into the list of assumptions,
 \item and @{thm[source] allI} removes a \<open>\<forall>\<close> by turning the quantified variable into a fixed local variable of the subgoal.
 \end{itemize}
 Isabelle knows about these and a number of other introduction rules.
 The command
 \begin{quote}
 \isacom{apply} \<open>rule\<close>\index{rule@\<open>rule\<close>}
 \end{quote}
 automatically selects the appropriate rule for the current subgoal.
 
 You can also turn your own theorems into introduction rules by giving them
 the \indexed{\<open>intro\<close>}{intro} attribute, analogous to the \<open>simp\<close> attribute.  In
 that case \<open>blast\<close>, \<open>fastforce\<close> and (to a limited extent) \<open>auto\<close> will automatically backchain with those theorems. The \<open>intro\<close>
 attribute should be used with care because it increases the search space and
 can lead to nontermination.  Sometimes it is better to use it only in
 specific calls of \<open>blast\<close> and friends. For example,
 @{thm[source] le_trans}, transitivity of \<open>\<le>\<close> on type \<^typ>\<open>nat\<close>,
 is not an introduction rule by default because of the disastrous effect
 on the search space, but can be useful in specific situations:
 \<close>
 
 lemma "\<lbrakk> (a::nat) \<le> b; b \<le> c; c \<le> d; d \<le> e \<rbrakk> \<Longrightarrow> a \<le> e"
 by(blast intro: le_trans)
 
 text\<open>
 Of course this is just an example and could be proved by \<open>arith\<close>, too.
 
 \subsection{Forward Proof}
 \label{sec:forward-proof}
 
 Forward proof means deriving new theorems from old theorems. We have already
 seen a very simple form of forward proof: the \<open>of\<close> operator for
 instantiating unknowns in a theorem. The big brother of \<open>of\<close> is
 \indexed{\<open>OF\<close>}{OF} for applying one theorem to others. Given a theorem \<^prop>\<open>A \<Longrightarrow> B\<close> called
 \<open>r\<close> and a theorem \<open>A'\<close> called \<open>r'\<close>, the theorem \<open>r[OF r']\<close> is the result of applying \<open>r\<close> to \<open>r'\<close>, where \<open>r\<close> should be viewed as a function taking a theorem \<open>A\<close> and returning
 \<open>B\<close>.  More precisely, \<open>A\<close> and \<open>A'\<close> are unified, thus
 instantiating the unknowns in \<open>B\<close>, and the result is the instantiated
 \<open>B\<close>. Of course, unification may also fail.
 \begin{warn}
 Application of rules to other rules operates in the forward direction: from
 the premises to the conclusion of the rule; application of rules to proof
 states operates in the backward direction, from the conclusion to the
 premises.
 \end{warn}
 
 In general \<open>r\<close> can be of the form \<open>\<lbrakk> A\<^sub>1; \<dots>; A\<^sub>n \<rbrakk> \<Longrightarrow> A\<close>
 and there can be multiple argument theorems \<open>r\<^sub>1\<close> to \<open>r\<^sub>m\<close>
 (with \<open>m \<le> n\<close>), in which case \<open>r[OF r\<^sub>1 \<dots> r\<^sub>m]\<close> is obtained
 by unifying and thus proving \<open>A\<^sub>i\<close> with \<open>r\<^sub>i\<close>, \<open>i = 1\<dots>m\<close>.
 Here is an example, where @{thm[source]refl} is the theorem
 @{thm[show_question_marks] refl}:
 \<close>
 
 thm conjI[OF refl[of "a"] refl[of "b"]]
 
 text\<open>yields the theorem @{thm conjI[OF refl[of "a"] refl[of "b"]]}.
 The command \isacom{thm} merely displays the result.
 
 Forward reasoning also makes sense in connection with proof states.
 Therefore \<open>blast\<close>, \<open>fastforce\<close> and \<open>auto\<close> support a modifier
 \<open>dest\<close> which instructs the proof method to use certain rules in a
 forward fashion. If \<open>r\<close> is of the form \mbox{\<open>A \<Longrightarrow> B\<close>}, the modifier
 \mbox{\<open>dest: r\<close>}\index{dest@\<open>dest:\<close>}
 allows proof search to reason forward with \<open>r\<close>, i.e.,
 to replace an assumption \<open>A'\<close>, where \<open>A'\<close> unifies with \<open>A\<close>,
 with the correspondingly instantiated \<open>B\<close>. For example, @{thm[source,show_question_marks] Suc_leD} is the theorem \mbox{@{thm Suc_leD}}, which works well for forward reasoning:
 \<close>
 
 lemma "Suc(Suc(Suc a)) \<le> b \<Longrightarrow> a \<le> b"
 by(blast dest: Suc_leD)
 
 text\<open>In this particular example we could have backchained with
 @{thm[source] Suc_leD}, too, but because the premise is more complicated than the conclusion this can easily lead to nontermination.
 
 %\subsection{Finding Theorems}
 %
 %Command \isacom{find{\isacharunderscorekeyword}theorems} searches for specific theorems in the current
 %theory. Search criteria include pattern matching on terms and on names.
-%For details see the Isabelle/Isar Reference Manual~@{cite IsarRef}.
+%For details see the Isabelle/Isar Reference Manual~\<^cite>\<open>IsarRef\<close>.
 %\bigskip
 
 \begin{warn}
 To ease readability we will drop the question marks
 in front of unknowns from now on.
 \end{warn}
 
 
 \section{Inductive Definitions}
 \label{sec:inductive-defs}\index{inductive definition|(}
 
 Inductive definitions are the third important definition facility, after
 datatypes and recursive function.
 \ifsem
 In fact, they are the key construct in the
 definition of operational semantics in the second part of the book.
 \fi
 
 \subsection{An Example: Even Numbers}
 \label{sec:Logic:even}
 
 Here is a simple example of an inductively defined predicate:
 \begin{itemize}
 \item 0 is even
 \item If $n$ is even, so is $n+2$.
 \end{itemize}
 The operative word ``inductive'' means that these are the only even numbers.
 In Isabelle we give the two rules the names \<open>ev0\<close> and \<open>evSS\<close>
 and write
 \<close>
 
 inductive ev :: "nat \<Rightarrow> bool" where
 ev0:    "ev 0" |
 evSS:  (*<*)"ev n \<Longrightarrow> ev (Suc(Suc n))"(*>*)
 text_raw\<open>@{prop[source]"ev n \<Longrightarrow> ev (n + 2)"}\<close>
 
 text\<open>To get used to inductive definitions, we will first prove a few
 properties of \<^const>\<open>ev\<close> informally before we descend to the Isabelle level.
 
 How do we prove that some number is even, e.g., \<^prop>\<open>ev 4\<close>? Simply by combining the defining rules for \<^const>\<open>ev\<close>:
 \begin{quote}
 \<open>ev 0 \<Longrightarrow> ev (0 + 2) \<Longrightarrow> ev((0 + 2) + 2) = ev 4\<close>
 \end{quote}
 
 \subsubsection{Rule Induction}\index{rule induction|(}
 
 Showing that all even numbers have some property is more complicated.  For
 example, let us prove that the inductive definition of even numbers agrees
 with the following recursive one:\<close>
 
 fun evn :: "nat \<Rightarrow> bool" where
 "evn 0 = True" |
 "evn (Suc 0) = False" |
 "evn (Suc(Suc n)) = evn n"
 
 text\<open>We prove \<^prop>\<open>ev m \<Longrightarrow> evn m\<close>.  That is, we
 assume \<^prop>\<open>ev m\<close> and by induction on the form of its derivation
 prove \<^prop>\<open>evn m\<close>. There are two cases corresponding to the two rules
 for \<^const>\<open>ev\<close>:
 \begin{description}
 \item[Case @{thm[source]ev0}:]
  \<^prop>\<open>ev m\<close> was derived by rule \<^prop>\<open>ev 0\<close>: \\
  \<open>\<Longrightarrow>\<close> \<^prop>\<open>m=(0::nat)\<close> \<open>\<Longrightarrow>\<close> \<open>evn m = evn 0 = True\<close>
 \item[Case @{thm[source]evSS}:]
  \<^prop>\<open>ev m\<close> was derived by rule \<^prop>\<open>ev n \<Longrightarrow> ev(n+2)\<close>: \\
 \<open>\<Longrightarrow>\<close> \<^prop>\<open>m=n+(2::nat)\<close> and by induction hypothesis \<^prop>\<open>evn n\<close>\\
 \<open>\<Longrightarrow>\<close> \<open>evn m = evn(n + 2) = evn n = True\<close>
 \end{description}
 
 What we have just seen is a special case of \concept{rule induction}.
 Rule induction applies to propositions of this form
 \begin{quote}
 \<^prop>\<open>ev n \<Longrightarrow> P n\<close>
 \end{quote}
 That is, we want to prove a property \<^prop>\<open>P n\<close>
 for all even \<open>n\<close>. But if we assume \<^prop>\<open>ev n\<close>, then there must be
 some derivation of this assumption using the two defining rules for
 \<^const>\<open>ev\<close>. That is, we must prove
 \begin{description}
 \item[Case @{thm[source]ev0}:] \<^prop>\<open>P(0::nat)\<close>
 \item[Case @{thm[source]evSS}:] \<^prop>\<open>\<lbrakk> ev n; P n \<rbrakk> \<Longrightarrow> P(n + 2::nat)\<close>
 \end{description}
 The corresponding rule is called @{thm[source] ev.induct} and looks like this:
 \[
 \inferrule{
 \mbox{@{thm (prem 1) ev.induct[of "n"]}}\\
 \mbox{@{thm (prem 2) ev.induct}}\\
 \mbox{\<^prop>\<open>!!n. \<lbrakk> ev n; P n \<rbrakk> \<Longrightarrow> P(n+2)\<close>}}
 {\mbox{@{thm (concl) ev.induct[of "n"]}}}
 \]
 The first premise \<^prop>\<open>ev n\<close> enforces that this rule can only be applied
 in situations where we know that \<open>n\<close> is even.
 
 Note that in the induction step we may not just assume \<^prop>\<open>P n\<close> but also
 \mbox{\<^prop>\<open>ev n\<close>}, which is simply the premise of rule @{thm[source]
 evSS}.  Here is an example where the local assumption \<^prop>\<open>ev n\<close> comes in
 handy: we prove \<^prop>\<open>ev m \<Longrightarrow> ev(m - 2)\<close> by induction on \<^prop>\<open>ev m\<close>.
 Case @{thm[source]ev0} requires us to prove \<^prop>\<open>ev(0 - 2)\<close>, which follows
 from \<^prop>\<open>ev 0\<close> because \<^prop>\<open>0 - 2 = (0::nat)\<close> on type \<^typ>\<open>nat\<close>. In
 case @{thm[source]evSS} we have \mbox{\<^prop>\<open>m = n+(2::nat)\<close>} and may assume
 \<^prop>\<open>ev n\<close>, which implies \<^prop>\<open>ev (m - 2)\<close> because \<open>m - 2 = (n +
 2) - 2 = n\<close>. We did not need the induction hypothesis at all for this proof (it
 is just a case analysis of which rule was used) but having \<^prop>\<open>ev n\<close>
 at our disposal in case @{thm[source]evSS} was essential.
 This case analysis of rules is also called ``rule inversion''
 and is discussed in more detail in \autoref{ch:Isar}.
 
 \subsubsection{In Isabelle}
 
 Let us now recast the above informal proofs in Isabelle. For a start,
 we use \<^const>\<open>Suc\<close> terms instead of numerals in rule @{thm[source]evSS}:
 @{thm[display] evSS}
 This avoids the difficulty of unifying \<open>n+2\<close> with some numeral,
 which is not automatic.
 
 The simplest way to prove \<^prop>\<open>ev(Suc(Suc(Suc(Suc 0))))\<close> is in a forward
 direction: \<open>evSS[OF evSS[OF ev0]]\<close> yields the theorem @{thm evSS[OF
 evSS[OF ev0]]}. Alternatively, you can also prove it as a lemma in backwards
 fashion. Although this is more verbose, it allows us to demonstrate how each
 rule application changes the proof state:\<close>
 
 lemma "ev(Suc(Suc(Suc(Suc 0))))"
 txt\<open>
 @{subgoals[display,indent=0,goals_limit=1]}
 \<close>
 apply(rule evSS)
 txt\<open>
 @{subgoals[display,indent=0,goals_limit=1]}
 \<close>
 apply(rule evSS)
 txt\<open>
 @{subgoals[display,indent=0,goals_limit=1]}
 \<close>
 apply(rule ev0)
 done
 
 text\<open>\indent
 Rule induction is applied by giving the induction rule explicitly via the
 \<open>rule:\<close> modifier:\index{inductionrule@\<open>induction ... rule:\<close>}\<close>
 
 lemma "ev m \<Longrightarrow> evn m"
 apply(induction rule: ev.induct)
 by(simp_all)
 
 text\<open>Both cases are automatic. Note that if there are multiple assumptions
 of the form \<^prop>\<open>ev t\<close>, method \<open>induction\<close> will induct on the leftmost
 one.
 
 As a bonus, we also prove the remaining direction of the equivalence of
 \<^const>\<open>ev\<close> and \<^const>\<open>evn\<close>:
 \<close>
 
 lemma "evn n \<Longrightarrow> ev n"
 apply(induction n rule: evn.induct)
 
 txt\<open>This is a proof by computation induction on \<open>n\<close> (see
 \autoref{sec:recursive-funs}) that sets up three subgoals corresponding to
 the three equations for \<^const>\<open>evn\<close>:
 @{subgoals[display,indent=0]}
 The first and third subgoals follow with @{thm[source]ev0} and @{thm[source]evSS}, and the second subgoal is trivially true because \<^prop>\<open>evn(Suc 0)\<close> is \<^const>\<open>False\<close>:
 \<close>
 
 by (simp_all add: ev0 evSS)
 
 text\<open>The rules for \<^const>\<open>ev\<close> make perfect simplification and introduction
 rules because their premises are always smaller than the conclusion. It
 makes sense to turn them into simplification and introduction rules
 permanently, to enhance proof automation. They are named @{thm[source] ev.intros}
 \index{intros@\<open>.intros\<close>} by Isabelle:\<close>
 
 declare ev.intros[simp,intro]
 
 text\<open>The rules of an inductive definition are not simplification rules by
 default because, in contrast to recursive functions, there is no termination
 requirement for inductive definitions.
 
 \subsubsection{Inductive Versus Recursive}
 
 We have seen two definitions of the notion of evenness, an inductive and a
 recursive one. Which one is better? Much of the time, the recursive one is
 more convenient: it allows us to do rewriting in the middle of terms, and it
 expresses both the positive information (which numbers are even) and the
 negative information (which numbers are not even) directly. An inductive
 definition only expresses the positive information directly. The negative
 information, for example, that \<open>1\<close> is not even, has to be proved from
 it (by induction or rule inversion). On the other hand, rule induction is
 tailor-made for proving \mbox{\<^prop>\<open>ev n \<Longrightarrow> P n\<close>} because it only asks you
 to prove the positive cases. In the proof of \<^prop>\<open>evn n \<Longrightarrow> P n\<close> by
 computation induction via @{thm[source]evn.induct}, we are also presented
 with the trivial negative cases. If you want the convenience of both
 rewriting and rule induction, you can make two definitions and show their
 equivalence (as above) or make one definition and prove additional properties
 from it, for example rule induction from computation induction.
 
 But many concepts do not admit a recursive definition at all because there is
 no datatype for the recursion (for example, the transitive closure of a
 relation), or the recursion would not terminate (for example,
 an interpreter for a programming language). Even if there is a recursive
 definition, if we are only interested in the positive information, the
 inductive definition may be much simpler.
 
 \subsection{The Reflexive Transitive Closure}
 \label{sec:star}
 
 Evenness is really more conveniently expressed recursively than inductively.
 As a second and very typical example of an inductive definition we define the
 reflexive transitive closure.
 \ifsem
 It will also be an important building block for
 some of the semantics considered in the second part of the book.
 \fi
 
 The reflexive transitive closure, called \<open>star\<close> below, is a function
 that maps a binary predicate to another binary predicate: if \<open>r\<close> is of
 type \<open>\<tau> \<Rightarrow> \<tau> \<Rightarrow> bool\<close> then \<^term>\<open>star r\<close> is again of type \<open>\<tau> \<Rightarrow>
 \<tau> \<Rightarrow> bool\<close>, and \<^prop>\<open>star r x y\<close> means that \<open>x\<close> and \<open>y\<close> are in
 the relation \<^term>\<open>star r\<close>. Think \<^term>\<open>r\<^sup>*\<close> when you see \<^term>\<open>star
 r\<close>, because \<open>star r\<close> is meant to be the reflexive transitive closure.
 That is, \<^prop>\<open>star r x y\<close> is meant to be true if from \<open>x\<close> we can
 reach \<open>y\<close> in finitely many \<open>r\<close> steps. This concept is naturally
 defined inductively:\<close>
 
 inductive star :: "('a \<Rightarrow> 'a \<Rightarrow> bool) \<Rightarrow> 'a \<Rightarrow> 'a \<Rightarrow> bool"  for r where
 refl:  "star r x x" |
 step:  "r x y \<Longrightarrow> star r y z \<Longrightarrow> star r x z"
 
 text\<open>The base case @{thm[source] refl} is reflexivity: \<^term>\<open>x=y\<close>. The
 step case @{thm[source]step} combines an \<open>r\<close> step (from \<open>x\<close> to
 \<open>y\<close>) and a \<^term>\<open>star r\<close> step (from \<open>y\<close> to \<open>z\<close>) into a
 \<^term>\<open>star r\<close> step (from \<open>x\<close> to \<open>z\<close>).
 The ``\isacom{for}~\<open>r\<close>'' in the header is merely a hint to Isabelle
 that \<open>r\<close> is a fixed parameter of \<^const>\<open>star\<close>, in contrast to the
 further parameters of \<^const>\<open>star\<close>, which change. As a result, Isabelle
 generates a simpler induction rule.
 
 By definition \<^term>\<open>star r\<close> is reflexive. It is also transitive, but we
 need rule induction to prove that:\<close>
 
 lemma star_trans: "star r x y \<Longrightarrow> star r y z \<Longrightarrow> star r x z"
 apply(induction rule: star.induct)
 (*<*)
 defer
 apply(rename_tac u x y)
 defer
 (*>*)
 txt\<open>The induction is over \<^prop>\<open>star r x y\<close> (the first matching assumption)
 and we try to prove \mbox{\<^prop>\<open>star r y z \<Longrightarrow> star r x z\<close>},
 which we abbreviate by \<^prop>\<open>P x y\<close>. These are our two subgoals:
 @{subgoals[display,indent=0]}
 The first one is \<^prop>\<open>P x x\<close>, the result of case @{thm[source]refl},
 and it is trivial:\index{assumption@\<open>assumption\<close>}
 \<close>
 apply(assumption)
 txt\<open>Let us examine subgoal \<open>2\<close>, case @{thm[source] step}.
 Assumptions \<^prop>\<open>r u x\<close> and \mbox{\<^prop>\<open>star r x y\<close>}
 are the premises of rule @{thm[source]step}.
 Assumption \<^prop>\<open>star r y z \<Longrightarrow> star r x z\<close> is \mbox{\<^prop>\<open>P x y\<close>},
 the IH coming from \<^prop>\<open>star r x y\<close>. We have to prove \<^prop>\<open>P u y\<close>,
 which we do by assuming \<^prop>\<open>star r y z\<close> and proving \<^prop>\<open>star r u z\<close>.
 The proof itself is straightforward: from \mbox{\<^prop>\<open>star r y z\<close>} the IH
 leads to \<^prop>\<open>star r x z\<close> which, together with \<^prop>\<open>r u x\<close>,
 leads to \mbox{\<^prop>\<open>star r u z\<close>} via rule @{thm[source]step}:
 \<close>
 apply(metis step)
 done
 
 text\<open>\index{rule induction|)}
 
 \subsection{The General Case}
 
 Inductive definitions have approximately the following general form:
 \begin{quote}
 \isacom{inductive} \<open>I :: "\<tau> \<Rightarrow> bool"\<close> \isacom{where}
 \end{quote}
 followed by a sequence of (possibly named) rules of the form
 \begin{quote}
 \<open>\<lbrakk> I a\<^sub>1; \<dots>; I a\<^sub>n \<rbrakk> \<Longrightarrow> I a\<close>
 \end{quote}
 separated by \<open>|\<close>. As usual, \<open>n\<close> can be 0.
 The corresponding rule induction principle
 \<open>I.induct\<close> applies to propositions of the form
 \begin{quote}
 \<^prop>\<open>I x \<Longrightarrow> P x\<close>
 \end{quote}
 where \<open>P\<close> may itself be a chain of implications.
 \begin{warn}
 Rule induction is always on the leftmost premise of the goal.
 Hence \<open>I x\<close> must be the first premise.
 \end{warn}
 Proving \<^prop>\<open>I x \<Longrightarrow> P x\<close> by rule induction means proving
 for every rule of \<open>I\<close> that \<open>P\<close> is invariant:
 \begin{quote}
 \<open>\<lbrakk> I a\<^sub>1; P a\<^sub>1; \<dots>; I a\<^sub>n; P a\<^sub>n \<rbrakk> \<Longrightarrow> P a\<close>
 \end{quote}
 
 The above format for inductive definitions is simplified in a number of
 respects. \<open>I\<close> can have any number of arguments and each rule can have
 additional premises not involving \<open>I\<close>, so-called \conceptidx{side
 conditions}{side condition}. In rule inductions, these side conditions appear as additional
 assumptions. The \isacom{for} clause seen in the definition of the reflexive
 transitive closure simplifies the induction rule.
 \index{inductive definition|)}
 
 \subsection*{Exercises}
 
 \begin{exercise}
 Formalize the following definition of palindromes
 \begin{itemize}
 \item The empty list and a singleton list are palindromes.
 \item If \<open>xs\<close> is a palindrome, so is \<^term>\<open>a # xs @ [a]\<close>.
 \end{itemize}
 as an inductive predicate \<open>palindrome ::\<close> \<^typ>\<open>'a list \<Rightarrow> bool\<close>
 and prove that \<^prop>\<open>rev xs = xs\<close> if \<open>xs\<close> is a palindrome.
 \end{exercise}
 
 \exercise
 We could also have defined \<^const>\<open>star\<close> as follows:
 \<close>
 
 inductive star' :: "('a \<Rightarrow> 'a \<Rightarrow> bool) \<Rightarrow> 'a \<Rightarrow> 'a \<Rightarrow> bool" for r where
 refl': "star' r x x" |
 step': "star' r x y \<Longrightarrow> r y z \<Longrightarrow> star' r x z"
 
 text\<open>
 The single \<open>r\<close> step is performed after rather than before the \<open>star'\<close>
 steps. Prove \<^prop>\<open>star' r x y \<Longrightarrow> star r x y\<close> and
 \<^prop>\<open>star r x y \<Longrightarrow> star' r x y\<close>. You may need lemmas.
 Note that rule induction fails
 if the assumption about the inductive predicate is not the first assumption.
 \endexercise
 
 \begin{exercise}\label{exe:iter}
 Analogous to \<^const>\<open>star\<close>, give an inductive definition of the \<open>n\<close>-fold iteration
 of a relation \<open>r\<close>: \<^term>\<open>iter r n x y\<close> should hold if there are \<open>x\<^sub>0\<close>, \dots, \<open>x\<^sub>n\<close>
 such that \<^prop>\<open>x = x\<^sub>0\<close>, \<^prop>\<open>x\<^sub>n = y\<close> and \<open>r x\<^bsub>i\<^esub> x\<^bsub>i+1\<^esub>\<close> for
 all \<^prop>\<open>i < n\<close>. Correct and prove the following claim:
 \<^prop>\<open>star r x y \<Longrightarrow> iter r n x y\<close>.
 \end{exercise}
 
 \begin{exercise}\label{exe:cfg}
 A context-free grammar can be seen as an inductive definition where each
 nonterminal $A$ is an inductively defined predicate on lists of terminal
 symbols: $A(w)$ means that $w$ is in the language generated by $A$.
 For example, the production $S \to a S b$ can be viewed as the implication
 \<^prop>\<open>S w \<Longrightarrow> S (a # w @ [b])\<close> where \<open>a\<close> and \<open>b\<close> are terminal symbols,
 i.e., elements of some alphabet. The alphabet can be defined like this:
 \isacom{datatype} \<open>alpha = a | b | \<dots>\<close>
 
 Define the two grammars (where $\varepsilon$ is the empty word)
 \[
 \begin{array}{r@ {\quad}c@ {\quad}l}
 S &\to& \varepsilon \quad\mid\quad aSb \quad\mid\quad SS \\
 T &\to& \varepsilon \quad\mid\quad TaTb
 \end{array}
 \]
 as two inductive predicates.
 If you think of \<open>a\<close> and \<open>b\<close> as ``\<open>(\<close>'' and  ``\<open>)\<close>'',
 the grammar defines strings of balanced parentheses.
 Prove \<^prop>\<open>T w \<Longrightarrow> S w\<close> and \mbox{\<^prop>\<open>S w \<Longrightarrow> T w\<close>} separately and conclude
 \<^prop>\<open>S w = T w\<close>.
 \end{exercise}
 
 \ifsem
 \begin{exercise}
 In \autoref{sec:AExp} we defined a recursive evaluation function
 \<open>aval :: aexp \<Rightarrow> state \<Rightarrow> val\<close>.
 Define an inductive evaluation predicate
 \<open>aval_rel :: aexp \<Rightarrow> state \<Rightarrow> val \<Rightarrow> bool\<close>
 and prove that it agrees with the recursive function:
 \<^prop>\<open>aval_rel a s v \<Longrightarrow> aval a s = v\<close>, 
 \<^prop>\<open>aval a s = v \<Longrightarrow> aval_rel a s v\<close> and thus
 \noquotes{@{prop [source] "aval_rel a s v \<longleftrightarrow> aval a s = v"}}.
 \end{exercise}
 
 \begin{exercise}
 Consider the stack machine from Chapter~3
 and recall the concept of \concept{stack underflow}
 from Exercise~\ref{exe:stack-underflow}.
 Define an inductive predicate
 \<open>ok :: nat \<Rightarrow> instr list \<Rightarrow> nat \<Rightarrow> bool\<close>
 such that \<open>ok n is n'\<close> means that with any initial stack of length
 \<open>n\<close> the instructions \<open>is\<close> can be executed
 without stack underflow and that the final stack has length \<open>n'\<close>.
 Prove that \<open>ok\<close> correctly computes the final stack size
 @{prop[display] "\<lbrakk>ok n is n'; length stk = n\<rbrakk> \<Longrightarrow> length (exec is s stk) = n'"}
 and that instruction sequences generated by \<open>comp\<close>
 cannot cause stack underflow: \ \<open>ok n (comp a) ?\<close> \ for
 some suitable value of \<open>?\<close>.
 \end{exercise}
 \fi
 \<close>
 (*<*)
 end
 (*>*)
diff --git a/src/Doc/Prog_Prove/Types_and_funs.thy b/src/Doc/Prog_Prove/Types_and_funs.thy
--- a/src/Doc/Prog_Prove/Types_and_funs.thy
+++ b/src/Doc/Prog_Prove/Types_and_funs.thy
@@ -1,605 +1,605 @@
 (*<*)
 theory Types_and_funs
 imports Main
 begin
 (*>*)
 text\<open>
 \vspace{-5ex}
 \section{Type and Function Definitions}
 
 Type synonyms are abbreviations for existing types, for example
 \index{string@\<open>string\<close>}\<close>
 
 type_synonym string = "char list"
 
 text\<open>
 Type synonyms are expanded after parsing and are not present in internal representation and output. They are mere conveniences for the reader.
 
 \subsection{Datatypes}
 \label{sec:datatypes}
 
 The general form of a datatype definition looks like this:
 \begin{quote}
 \begin{tabular}{@ {}rclcll}
 \indexed{\isacom{datatype}}{datatype} \<open>('a\<^sub>1,\<dots>,'a\<^sub>n)t\<close>
      & = & $C_1 \ \<open>"\<close>\tau_{1,1}\<open>"\<close> \dots \<open>"\<close>\tau_{1,n_1}\<open>"\<close>$ \\
      & $|$ & \dots \\
      & $|$ & $C_k \ \<open>"\<close>\tau_{k,1}\<open>"\<close> \dots \<open>"\<close>\tau_{k,n_k}\<open>"\<close>$
 \end{tabular}
 \end{quote}
 It introduces the constructors \
 $C_i :: \tau_{i,1}\Rightarrow \cdots \Rightarrow \tau_{i,n_i} \Rightarrow$~\<open>('a\<^sub>1,\<dots>,'a\<^sub>n)t\<close> \ and expresses that any value of this type is built from these constructors in a unique manner. Uniqueness is implied by the following
 properties of the constructors:
 \begin{itemize}
 \item \emph{Distinctness:} $C_i\ \ldots \neq C_j\ \dots$ \quad if $i \neq j$
 \item \emph{Injectivity:}
 \begin{tabular}[t]{l}
  $(C_i \ x_1 \dots x_{n_i} = C_i \ y_1 \dots y_{n_i}) =$\\
  $(x_1 = y_1 \land \dots \land x_{n_i} = y_{n_i})$
 \end{tabular}
 \end{itemize}
 The fact that any value of the datatype is built from the constructors implies
 the \concept{structural induction}\index{induction} rule: to show
 $P~x$ for all $x$ of type \<open>('a\<^sub>1,\<dots>,'a\<^sub>n)t\<close>,
 one needs to show $P(C_i\ x_1 \dots x_{n_i})$ (for each $i$) assuming
 $P(x_j)$ for all $j$ where $\tau_{i,j} =$~\<open>('a\<^sub>1,\<dots>,'a\<^sub>n)t\<close>.
 Distinctness and injectivity are applied automatically by \<open>auto\<close>
 and other proof methods. Induction must be applied explicitly.
 
 Like in functional programming languages, datatype values can be taken apart
 with case expressions\index{case expression}\index{case expression@\<open>case ... of\<close>}, for example
 \begin{quote}
 \noquotes{@{term[source] "(case xs of [] \<Rightarrow> 0 | x # _ \<Rightarrow> Suc x)"}}
 \end{quote}
 Case expressions must be enclosed in parentheses.
 
 As an example of a datatype beyond \<^typ>\<open>nat\<close> and \<open>list\<close>, consider binary trees:
 \<close>
 
 datatype 'a tree = Tip | Node  "'a tree"  'a  "'a tree"
 
 text\<open>with a mirror function:\<close>
 
 fun mirror :: "'a tree \<Rightarrow> 'a tree" where
 "mirror Tip = Tip" |
 "mirror (Node l a r) = Node (mirror r) a (mirror l)"
 
 text\<open>The following lemma illustrates induction:\<close>
 
 lemma "mirror(mirror t) = t"
 apply(induction t)
 
 txt\<open>yields
 @{subgoals[display]}
 The induction step contains two induction hypotheses, one for each subtree.
 An application of \<open>auto\<close> finishes the proof.
 
 A very simple but also very useful datatype is the predefined
 @{datatype[display] option}\index{option@\<open>option\<close>}\index{None@\<^const>\<open>None\<close>}\index{Some@\<^const>\<open>Some\<close>}
 Its sole purpose is to add a new element \<^const>\<open>None\<close> to an existing
 type \<^typ>\<open>'a\<close>. To make sure that \<^const>\<open>None\<close> is distinct from all the
 elements of \<^typ>\<open>'a\<close>, you wrap them up in \<^const>\<open>Some\<close> and call
 the new type \<^typ>\<open>'a option\<close>. A typical application is a lookup function
 on a list of key-value pairs, often called an association list:
 \<close>
 (*<*)
 apply auto
 done
 (*>*)
 fun lookup :: "('a * 'b) list \<Rightarrow> 'a \<Rightarrow> 'b option" where
 "lookup [] x = None" |
 "lookup ((a,b) # ps) x = (if a = x then Some b else lookup ps x)"
 
 text\<open>
 Note that \<open>\<tau>\<^sub>1 * \<tau>\<^sub>2\<close> is the type of pairs, also written \<open>\<tau>\<^sub>1 \<times> \<tau>\<^sub>2\<close>.
 Pairs can be taken apart either by pattern matching (as above) or with the
 projection functions \<^const>\<open>fst\<close> and \<^const>\<open>snd\<close>: @{thm fst_conv[of x y]} and @{thm snd_conv[of x y]}.
 Tuples are simulated by pairs nested to the right: \<^term>\<open>(a,b,c)\<close>
 is short for \<open>(a, (b, c))\<close> and \<open>\<tau>\<^sub>1 \<times> \<tau>\<^sub>2 \<times> \<tau>\<^sub>3\<close> is short for
 \<open>\<tau>\<^sub>1 \<times> (\<tau>\<^sub>2 \<times> \<tau>\<^sub>3)\<close>.
 
 \subsection{Definitions}
 
 Non-recursive functions can be defined as in the following example:
 \index{definition@\isacom{definition}}\<close>
 
 definition sq :: "nat \<Rightarrow> nat" where
 "sq n = n * n"
 
 text\<open>Such definitions do not allow pattern matching but only
 \<open>f x\<^sub>1 \<dots> x\<^sub>n = t\<close>, where \<open>f\<close> does not occur in \<open>t\<close>.
 
 \subsection{Abbreviations}
 
 Abbreviations are similar to definitions:
 \index{abbreviation@\isacom{abbreviation}}\<close>
 
 abbreviation sq' :: "nat \<Rightarrow> nat" where
 "sq' n \<equiv> n * n"
 
 text\<open>The key difference is that \<^const>\<open>sq'\<close> is only syntactic sugar:
 after parsing, \<^term>\<open>sq' t\<close> is replaced by \mbox{\<^term>\<open>t*t\<close>};
 before printing, every occurrence of \<^term>\<open>u*u\<close> is replaced by
 \mbox{\<^term>\<open>sq' u\<close>}.  Internally, \<^const>\<open>sq'\<close> does not exist.
 This is the
 advantage of abbreviations over definitions: definitions need to be expanded
 explicitly (\autoref{sec:rewr-defs}) whereas abbreviations are already
 expanded upon parsing. However, abbreviations should be introduced sparingly:
 if abused, they can lead to a confusing discrepancy between the internal and
 external view of a term.
 
 The ASCII representation of \<open>\<equiv>\<close> is \texttt{==} or \xsymbol{equiv}.
 
 \subsection{Recursive Functions}
 \label{sec:recursive-funs}
 
 Recursive functions are defined with \indexed{\isacom{fun}}{fun} by pattern matching
 over datatype constructors. The order of equations matters, as in
 functional programming languages. However, all HOL functions must be
 total. This simplifies the logic --- terms are always defined --- but means
 that recursive functions must terminate. Otherwise one could define a
 function \<^prop>\<open>f n = f n + (1::nat)\<close> and conclude \mbox{\<^prop>\<open>(0::nat) = 1\<close>} by
 subtracting \<^term>\<open>f n\<close> on both sides.
 
 Isabelle's automatic termination checker requires that the arguments of
 recursive calls on the right-hand side must be strictly smaller than the
 arguments on the left-hand side. In the simplest case, this means that one
 fixed argument position decreases in size with each recursive call. The size
 is measured as the number of constructors (excluding 0-ary ones, e.g., \<open>Nil\<close>). Lexicographic combinations are also recognized. In more complicated
 situations, the user may have to prove termination by hand. For details
-see~@{cite Krauss}.
+see~\<^cite>\<open>Krauss\<close>.
 
 Functions defined with \isacom{fun} come with their own induction schema
 that mirrors the recursion schema and is derived from the termination
 order. For example,
 \<close>
 
 fun div2 :: "nat \<Rightarrow> nat" where
 "div2 0 = 0" |
 "div2 (Suc 0) = 0" |
 "div2 (Suc(Suc n)) = Suc(div2 n)"
 
 text\<open>does not just define \<^const>\<open>div2\<close> but also proves a
 customized induction rule:
 \[
 \inferrule{
 \mbox{@{thm (prem 1) div2.induct}}\\
 \mbox{@{thm (prem 2) div2.induct}}\\
 \mbox{@{thm (prem 3) div2.induct}}}
 {\mbox{@{thm (concl) div2.induct[of _ "m"]}}}
 \]
 This customized induction rule can simplify inductive proofs. For example,
 \<close>
 
 lemma "div2 n = n div 2"
 apply(induction n rule: div2.induct)
 
 txt\<open>(where the infix \<open>div\<close> is the predefined division operation)
 yields the subgoals
 @{subgoals[display,margin=65]}
 An application of \<open>auto\<close> finishes the proof.
 Had we used ordinary structural induction on \<open>n\<close>,
 the proof would have needed an additional
 case analysis in the induction step.
 
 This example leads to the following induction heuristic:
 \begin{quote}
 \emph{Let \<open>f\<close> be a recursive function.
 If the definition of \<open>f\<close> is more complicated
 than having one equation for each constructor of some datatype,
 then properties of \<open>f\<close> are best proved via \<open>f.induct\<close>.\index{inductionrule@\<open>.induct\<close>}}
 \end{quote}
 
 The general case is often called \concept{computation induction},
 because the induction follows the (terminating!) computation.
 For every defining equation
 \begin{quote}
 \<open>f(e) = \<dots> f(r\<^sub>1) \<dots> f(r\<^sub>k) \<dots>\<close>
 \end{quote}
 where \<open>f(r\<^sub>i)\<close>, \<open>i=1\<dots>k\<close>, are all the recursive calls,
 the induction rule \<open>f.induct\<close> contains one premise of the form
 \begin{quote}
 \<open>P(r\<^sub>1) \<Longrightarrow> \<dots> \<Longrightarrow> P(r\<^sub>k) \<Longrightarrow> P(e)\<close>
 \end{quote}
 If \<open>f :: \<tau>\<^sub>1 \<Rightarrow> \<dots> \<Rightarrow> \<tau>\<^sub>n \<Rightarrow> \<tau>\<close> then \<open>f.induct\<close> is applied like this:
 \begin{quote}
 \isacom{apply}\<open>(induction x\<^sub>1 \<dots> x\<^sub>n rule: f.induct)\<close>\index{inductionrule@\<open>induction ... rule:\<close>}
 \end{quote}
 where typically there is a call \<open>f x\<^sub>1 \<dots> x\<^sub>n\<close> in the goal.
 But note that the induction rule does not mention \<open>f\<close> at all,
 except in its name, and is applicable independently of \<open>f\<close>.
 
 
 \subsection*{Exercises}
 
 \begin{exercise}
 Starting from the type \<open>'a tree\<close> defined in the text, define
 a function \<open>contents ::\<close> \<^typ>\<open>'a tree \<Rightarrow> 'a list\<close>
 that collects all values in a tree in a list, in any order,
 without removing duplicates.
 Then define a function \<open>sum_tree ::\<close> \<^typ>\<open>nat tree \<Rightarrow> nat\<close>
 that sums up all values in a tree of natural numbers
 and prove \<^prop>\<open>sum_tree t = sum_list(contents t)\<close>
 where \<^const>\<open>sum_list\<close> is predefined by the equations
 @{thm sum_list.Nil[where 'a=nat]} and
 @{thm sum_list.Cons}.
 \end{exercise}
 
 \begin{exercise}
 Define the two functions
 \<open>pre_order\<close> and \<open>post_order\<close> of type @{typ "'a tree \<Rightarrow> 'a list"}
 that traverse a tree and collect all stored values in the respective order in
 a list. Prove \<^prop>\<open>pre_order (mirror t) = rev (post_order t)\<close>.
 \end{exercise}
 
 \begin{exercise}
 Define a function \<open>intersperse ::\<close> \<^typ>\<open>'a \<Rightarrow> 'a list \<Rightarrow> 'a list\<close>
 such that \<open>intersperse a [x\<^sub>1, ..., x\<^sub>n] = [x\<^sub>1, a, x\<^sub>2, a, ..., a, x\<^sub>n]\<close>.
 Now prove that \<^prop>\<open>map f (intersperse a xs) = intersperse (f a) (map f xs)\<close>.
 \end{exercise}
 
 
 \section{Induction Heuristics}\index{induction heuristics}
 
 We have already noted that theorems about recursive functions are proved by
 induction. In case the function has more than one argument, we have followed
 the following heuristic in the proofs about the append function:
 \begin{quote}
 \emph{Perform induction on argument number $i$\\
  if the function is defined by recursion on argument number $i$.}
 \end{quote}
 The key heuristic, and the main point of this section, is to
 \emph{generalize the goal before induction}.
 The reason is simple: if the goal is
 too specific, the induction hypothesis is too weak to allow the induction
 step to go through. Let us illustrate the idea with an example.
 
 Function \<^const>\<open>rev\<close> has quadratic worst-case running time
 because it calls append for each element of the list and
 append is linear in its first argument.  A linear time version of
 \<^const>\<open>rev\<close> requires an extra argument where the result is accumulated
 gradually, using only~\<open>#\<close>:
 \<close>
 (*<*)
 apply auto
 done
 (*>*)
 fun itrev :: "'a list \<Rightarrow> 'a list \<Rightarrow> 'a list" where
 "itrev []        ys = ys" |
 "itrev (x#xs) ys = itrev xs (x#ys)"
 
 text\<open>The behaviour of \<^const>\<open>itrev\<close> is simple: it reverses
 its first argument by stacking its elements onto the second argument,
 and it returns that second argument when the first one becomes
 empty. Note that \<^const>\<open>itrev\<close> is tail-recursive: it can be
 compiled into a loop; no stack is necessary for executing it.
 
 Naturally, we would like to show that \<^const>\<open>itrev\<close> reverses its first argument:
 \<close>
 
 lemma "itrev xs [] = rev xs"
 
 txt\<open>There is no choice as to the induction variable:
 \<close>
 
 apply(induction xs)
 apply(auto)
 
 txt\<open>
 Unfortunately, this attempt does not prove
 the induction step:
 @{subgoals[display,margin=70]}
 The induction hypothesis is too weak.  The fixed
 argument,~\<^term>\<open>[]\<close>, prevents it from rewriting the conclusion.  
 This example suggests a heuristic:
 \begin{quote}
 \emph{Generalize goals for induction by replacing constants by variables.}
 \end{quote}
 Of course one cannot do this naively: \<^prop>\<open>itrev xs ys = rev xs\<close> is
 just not true.  The correct generalization is
 \<close>
 (*<*)oops(*>*)
 lemma "itrev xs ys = rev xs @ ys"
 (*<*)apply(induction xs, auto)(*>*)
 txt\<open>
 If \<open>ys\<close> is replaced by \<^term>\<open>[]\<close>, the right-hand side simplifies to
 \<^term>\<open>rev xs\<close>, as required.
 In this instance it was easy to guess the right generalization.
 Other situations can require a good deal of creativity.  
 
 Although we now have two variables, only \<open>xs\<close> is suitable for
 induction, and we repeat our proof attempt. Unfortunately, we are still
 not there:
 @{subgoals[display,margin=65]}
 The induction hypothesis is still too weak, but this time it takes no
 intuition to generalize: the problem is that the \<open>ys\<close>
 in the induction hypothesis is fixed,
 but the induction hypothesis needs to be applied with
 \<^term>\<open>a # ys\<close> instead of \<open>ys\<close>. Hence we prove the theorem
 for all \<open>ys\<close> instead of a fixed one. We can instruct induction
 to perform this generalization for us by adding \<open>arbitrary: ys\<close>\index{arbitrary@\<open>arbitrary:\<close>}.
 \<close>
 (*<*)oops
 lemma "itrev xs ys = rev xs @ ys"
 (*>*)
 apply(induction xs arbitrary: ys)
 
 txt\<open>The induction hypothesis is now universally quantified over \<open>ys\<close>:
 @{subgoals[display,margin=65]}
 Thus the proof succeeds:
 \<close>
 
 apply(auto)
 done
 
 text\<open>
 This leads to another heuristic for generalization:
 \begin{quote}
 \emph{Generalize induction by generalizing all free
 variables\\ {\em(except the induction variable itself)}.}
 \end{quote}
 Generalization is best performed with \<open>arbitrary: y\<^sub>1 \<dots> y\<^sub>k\<close>. 
 This heuristic prevents trivial failures like the one above.
 However, it should not be applied blindly.
 It is not always required, and the additional quantifiers can complicate
 matters in some cases. The variables that need to be quantified are typically
 those that change in recursive calls.
 
 
 \subsection*{Exercises}
 
 \begin{exercise}
 Write a tail-recursive variant of the \<open>add\<close> function on \<^typ>\<open>nat\<close>:
 \<^term>\<open>itadd :: nat \<Rightarrow> nat \<Rightarrow> nat\<close>.
 Tail-recursive means that in the recursive case, \<open>itadd\<close> needs to call
 itself directly: \mbox{\<^term>\<open>itadd (Suc m) n\<close>} \<open>= itadd \<dots>\<close>.
 Prove \<^prop>\<open>itadd m n = add m n\<close>.
 \end{exercise}
 
 
 \section{Simplification}
 
 So far we have talked a lot about simplifying terms without explaining the concept.
 \conceptidx{Simplification}{simplification} means
 \begin{itemize}
 \item using equations $l = r$ from left to right (only),
 \item as long as possible.
 \end{itemize}
 To emphasize the directionality, equations that have been given the
 \<open>simp\<close> attribute are called \conceptidx{simplification rules}{simplification rule}.
 Logically, they are still symmetric, but proofs by
 simplification use them only in the left-to-right direction.  The proof tool
 that performs simplifications is called the \concept{simplifier}. It is the
 basis of \<open>auto\<close> and other related proof methods.
 
 The idea of simplification is best explained by an example. Given the
 simplification rules
 \[
 \begin{array}{rcl@ {\quad}l}
 \<^term>\<open>0 + n::nat\<close> &\<open>=\<close>& \<open>n\<close> & (1) \\
 \<^term>\<open>(Suc m) + n\<close> &\<open>=\<close>& \<^term>\<open>Suc (m + n)\<close> & (2) \\
 \<open>(Suc m \<le> Suc n)\<close> &\<open>=\<close>& \<open>(m \<le> n)\<close> & (3)\\
 \<open>(0 \<le> m)\<close> &\<open>=\<close>& \<^const>\<open>True\<close> & (4)
 \end{array}
 \]
 the formula \<^prop>\<open>0 + Suc 0 \<le> Suc 0 + x\<close> is simplified to \<^const>\<open>True\<close>
 as follows:
 \[
 \begin{array}{r@ {}c@ {}l@ {\quad}l}
 \<open>(0 + Suc 0\<close> & \leq & \<open>Suc 0 + x)\<close>  & \stackrel{(1)}{=} \\
 \<open>(Suc 0\<close>     & \leq & \<open>Suc 0 + x)\<close>  & \stackrel{(2)}{=} \\
 \<open>(Suc 0\<close>     & \leq & \<open>Suc (0 + x))\<close> & \stackrel{(3)}{=} \\
 \<open>(0\<close>         & \leq & \<open>0 + x)\<close>      & \stackrel{(4)}{=} \\[1ex]
  & \<^const>\<open>True\<close>
 \end{array}
 \]
 Simplification is often also called \concept{rewriting}
 and simplification rules \conceptidx{rewrite rules}{rewrite rule}.
 
 \subsection{Simplification Rules}
 
 The attribute \<open>simp\<close> declares theorems to be simplification rules,
 which the simplifier will use automatically. In addition,
 \isacom{datatype} and \isacom{fun} commands implicitly declare some
 simplification rules: \isacom{datatype} the distinctness and injectivity
 rules, \isacom{fun} the defining equations. Definitions are not declared
 as simplification rules automatically! Nearly any theorem can become a
 simplification rule. The simplifier will try to transform it into an
 equation. For example, the theorem \<^prop>\<open>\<not> P\<close> is turned into \<^prop>\<open>P = False\<close>.
 
 Only equations that really simplify, like \<^prop>\<open>rev (rev xs) = xs\<close> and
 \<^prop>\<open>xs @ [] = xs\<close>, should be declared as simplification
 rules. Equations that may be counterproductive as simplification rules
 should only be used in specific proof steps (see \autoref{sec:simp} below).
 Distributivity laws, for example, alter the structure of terms
 and can produce an exponential blow-up.
 
 \subsection{Conditional Simplification Rules}
 
 Simplification rules can be conditional.  Before applying such a rule, the
 simplifier will first try to prove the preconditions, again by
 simplification. For example, given the simplification rules
 \begin{quote}
 \<^prop>\<open>p(0::nat) = True\<close>\\
 \<^prop>\<open>p(x) \<Longrightarrow> f(x) = g(x)\<close>,
 \end{quote}
 the term \<^term>\<open>f(0::nat)\<close> simplifies to \<^term>\<open>g(0::nat)\<close>
 but \<^term>\<open>f(1::nat)\<close> does not simplify because \<^prop>\<open>p(1::nat)\<close>
 is not provable.
 
 \subsection{Termination}
 
 Simplification can run forever, for example if both \<^prop>\<open>f x = g x\<close> and
 \<^prop>\<open>g(x) = f(x)\<close> are simplification rules. It is the user's
 responsibility not to include simplification rules that can lead to
 nontermination, either on their own or in combination with other
 simplification rules. The right-hand side of a simplification rule should
 always be ``simpler'' than the left-hand side --- in some sense. But since
 termination is undecidable, such a check cannot be automated completely
 and Isabelle makes little attempt to detect nontermination.
 
 When conditional simplification rules are applied, their preconditions are
 proved first. Hence all preconditions need to be
 simpler than the left-hand side of the conclusion. For example
 \begin{quote}
 \<^prop>\<open>n < m \<Longrightarrow> (n < Suc m) = True\<close>
 \end{quote}
 is suitable as a simplification rule: both \<^prop>\<open>n<m\<close> and \<^const>\<open>True\<close>
 are simpler than \mbox{\<^prop>\<open>n < Suc m\<close>}. But
 \begin{quote}
 \<^prop>\<open>Suc n < m \<Longrightarrow> (n < m) = True\<close>
 \end{quote}
 leads to nontermination: when trying to rewrite \<^prop>\<open>n<m\<close> to \<^const>\<open>True\<close>
 one first has to prove \mbox{\<^prop>\<open>Suc n < m\<close>}, which can be rewritten to \<^const>\<open>True\<close> provided \<^prop>\<open>Suc(Suc n) < m\<close>, \emph{ad infinitum}.
 
 \subsection{The \indexed{\<open>simp\<close>}{simp} Proof Method}
 \label{sec:simp}
 
 So far we have only used the proof method \<open>auto\<close>.  Method \<open>simp\<close>
 is the key component of \<open>auto\<close>, but \<open>auto\<close> can do much more. In
 some cases, \<open>auto\<close> is overeager and modifies the proof state too much.
 In such cases the more predictable \<open>simp\<close> method should be used.
 Given a goal
 \begin{quote}
 \<open>1. \<lbrakk> P\<^sub>1; \<dots>; P\<^sub>m \<rbrakk> \<Longrightarrow> C\<close>
 \end{quote}
 the command
 \begin{quote}
 \isacom{apply}\<open>(simp add: th\<^sub>1 \<dots> th\<^sub>n)\<close>
 \end{quote}
 simplifies the assumptions \<open>P\<^sub>i\<close> and the conclusion \<open>C\<close> using
 \begin{itemize}
 \item all simplification rules, including the ones coming from \isacom{datatype} and \isacom{fun},
 \item the additional lemmas \<open>th\<^sub>1 \<dots> th\<^sub>n\<close>, and
 \item the assumptions.
 \end{itemize}
 In addition to or instead of \<open>add\<close> there is also \<open>del\<close> for removing
 simplification rules temporarily. Both are optional. Method \<open>auto\<close>
 can be modified similarly:
 \begin{quote}
 \isacom{apply}\<open>(auto simp add: \<dots> simp del: \<dots>)\<close>
 \end{quote}
 Here the modifiers are \<open>simp add\<close> and \<open>simp del\<close>
 instead of just \<open>add\<close> and \<open>del\<close> because \<open>auto\<close>
 does not just perform simplification.
 
 Note that \<open>simp\<close> acts only on subgoal 1, \<open>auto\<close> acts on all
 subgoals. There is also \<open>simp_all\<close>, which applies \<open>simp\<close> to
 all subgoals.
 
 \subsection{Rewriting with Definitions}
 \label{sec:rewr-defs}
 
 Definitions introduced by the command \isacom{definition}
 can also be used as simplification rules,
 but by default they are not: the simplifier does not expand them
 automatically. Definitions are intended for introducing abstract concepts and
 not merely as abbreviations. Of course, we need to expand the definition
 initially, but once we have proved enough abstract properties of the new
 constant, we can forget its original definition. This style makes proofs more
 robust: if the definition has to be changed, only the proofs of the abstract
 properties will be affected.
 
 The definition of a function \<open>f\<close> is a theorem named \<open>f_def\<close>
 and can be added to a call of \<open>simp\<close> like any other theorem:
 \begin{quote}
 \isacom{apply}\<open>(simp add: f_def)\<close>
 \end{quote}
 In particular, let-expressions can be unfolded by
 making @{thm[source] Let_def} a simplification rule.
 
 \subsection{Case Splitting With \<open>simp\<close>}
 
 Goals containing if-expressions are automatically split into two cases by
 \<open>simp\<close> using the rule
 \begin{quote}
 \<^prop>\<open>P(if A then s else t) = ((A \<longrightarrow> P(s)) \<and> (~A \<longrightarrow> P(t)))\<close>
 \end{quote}
 For example, \<open>simp\<close> can prove
 \begin{quote}
 \<^prop>\<open>(A \<and> B) = (if A then B else False)\<close>
 \end{quote}
 because both \<^prop>\<open>A \<longrightarrow> (A & B) = B\<close> and \<^prop>\<open>~A \<longrightarrow> (A & B) = False\<close>
 simplify to \<^const>\<open>True\<close>.
 
 We can split case-expressions similarly. For \<open>nat\<close> the rule looks like this:
 @{prop[display,margin=65,indent=4]"P(case e of 0 \<Rightarrow> a | Suc n \<Rightarrow> b n) = ((e = 0 \<longrightarrow> P a) \<and> (\<forall>n. e = Suc n \<longrightarrow> P(b n)))"}
 Case expressions are not split automatically by \<open>simp\<close>, but \<open>simp\<close>
 can be instructed to do so:
 \begin{quote}
 \isacom{apply}\<open>(simp split: nat.split)\<close>
 \end{quote}
 splits all case-expressions over natural numbers. For an arbitrary
 datatype \<open>t\<close> it is \<open>t.split\<close>\index{split@\<open>.split\<close>} instead of @{thm[source] nat.split}.
 Method \<open>auto\<close> can be modified in exactly the same way.
 The modifier \indexed{\<open>split:\<close>}{split} can be followed by multiple names.
 Splitting if or case-expressions in the assumptions requires 
 \<open>split: if_splits\<close> or \<open>split: t.splits\<close>.
 
 \ifsem\else
 \subsection{Rewriting \<open>let\<close> and Numerals}
 
 Let-expressions (\<^term>\<open>let x = s in t\<close>) can be expanded explicitly with the simplification rule
 @{thm[source] Let_def}. The simplifier will not expand \<open>let\<close>s automatically in many cases.
 
 Numerals of type \<^typ>\<open>nat\<close> can be converted to \<^const>\<open>Suc\<close> terms with the simplification rule
 @{thm[source] numeral_eq_Suc}. This is required, for example, when a function that is defined
 by pattern matching with \<^const>\<open>Suc\<close> is applied to a numeral: if \<open>f\<close> is defined by
 \<open>f 0 = ...\<close> and  \<open>f (Suc n) = ...\<close>, the simplifier cannot simplify \<open>f 2\<close> unless
 \<open>2\<close> is converted to \<^term>\<open>Suc(Suc 0)\<close> (via @{thm[source] numeral_eq_Suc}).
 \fi
 
 \subsection*{Exercises}
 
 \exercise\label{exe:tree0}
 Define a datatype \<open>tree0\<close> of binary tree skeletons which do not store
 any information, neither in the inner nodes nor in the leaves.
 Define a function \<open>nodes :: tree0 \<Rightarrow> nat\<close> that counts the number of
 all nodes (inner nodes and leaves) in such a tree.
 Consider the following recursive function:
 \<close>
 (*<*)
 datatype tree0 = Tip | Node tree0 tree0
 (*>*)
 fun explode :: "nat \<Rightarrow> tree0 \<Rightarrow> tree0" where
 "explode 0 t = t" |
 "explode (Suc n) t = explode n (Node t t)"
 
 text \<open>
 Find an equation expressing the size of a tree after exploding it
 (\noquotes{@{term [source] "nodes (explode n t)"}}) as a function
 of \<^term>\<open>nodes t\<close> and \<open>n\<close>. Prove your equation.
 You may use the usual arithmetic operators, including the exponentiation
 operator ``\<open>^\<close>''. For example, \noquotes{@{prop [source] "2 ^ 2 = 4"}}.
 
 Hint: simplifying with the list of theorems @{thm[source] algebra_simps}
 takes care of common algebraic properties of the arithmetic operators.
 \endexercise
 
 \exercise
 Define arithmetic expressions in one variable over integers (type \<^typ>\<open>int\<close>)
 as a data type:
 \<close>
 
 datatype exp = Var | Const int | Add exp exp | Mult exp exp
 
 text\<open>
 Define a function \noquotes{@{term [source]"eval :: exp \<Rightarrow> int \<Rightarrow> int"}}
 such that \<^term>\<open>eval e x\<close> evaluates \<open>e\<close> at the value
 \<open>x\<close>.
 
 A polynomial can be represented as a list of coefficients, starting with
 the constant. For example, \<^term>\<open>[4, 2, -1, 3::int]\<close> represents the
 polynomial $4 + 2x - x^2 + 3x^3$.
 Define a function \noquotes{@{term [source] "evalp :: int list \<Rightarrow> int \<Rightarrow> int"}}
 that evaluates a polynomial at the given value.
 Define a function \noquotes{@{term[source] "coeffs :: exp \<Rightarrow> int list"}}
 that transforms an expression into a polynomial. This may require auxiliary
 functions. Prove that \<open>coeffs\<close> preserves the value of the expression:
 \mbox{\<^prop>\<open>evalp (coeffs e) x = eval e x\<close>.}
 Hint: consider the hint in Exercise~\ref{exe:tree0}.
 \endexercise
 \<close>
 (*<*)
 end
 (*>*)
diff --git a/src/Doc/Sugar/Sugar.thy b/src/Doc/Sugar/Sugar.thy
--- a/src/Doc/Sugar/Sugar.thy
+++ b/src/Doc/Sugar/Sugar.thy
@@ -1,583 +1,583 @@
 (*<*)
 theory Sugar
 imports
   "HOL-Library.LaTeXsugar"
   "HOL-Library.OptionalSugar"
 begin
 no_translations
   ("prop") "P \<and> Q \<Longrightarrow> R" <= ("prop") "P \<Longrightarrow> Q \<Longrightarrow> R"
 (*>*)
 text\<open>
 \section{Introduction}
 
 This document is for those Isabelle users who have mastered
 the art of mixing \LaTeX\ text and Isabelle theories and never want to
 typeset a theorem by hand anymore because they have experienced the
 bliss of writing \verb!@!\verb!{thm[display,mode=latex_sum] sum_Suc_diff [no_vars]}!
 and seeing Isabelle typeset it for them:
 @{thm[display,mode=latex_sum] sum_Suc_diff[no_vars]}
 No typos, no omissions, no sweat.
 If you have not experienced that joy, read Chapter 4, \emph{Presenting
-Theories}, @{cite LNCS2283} first.
+Theories}, \<^cite>\<open>LNCS2283\<close> first.
 
 If you have mastered the art of Isabelle's \emph{antiquotations},
 i.e.\ things like the above \verb!@!\verb!{thm...}!, beware: in your vanity
 you may be tempted to think that all readers of the stunning
 documents you can now produce at the drop of a hat will be struck with
 awe at the beauty unfolding in front of their eyes. Until one day you
 come across that very critical of readers known as the ``common referee''.
 He has the nasty habit of refusing to understand unfamiliar notation
 like Isabelle's infamous \<open>\<lbrakk> \<rbrakk> \<Longrightarrow>\<close> no matter how many times you
 explain it in your paper. Even worse, he thinks that using \<open>\<lbrakk>
 \<rbrakk>\<close> for anything other than denotational semantics is a cardinal sin
 that must be punished by instant rejection.
 
 
 This document shows you how to make Isabelle and \LaTeX\ cooperate to
 produce ordinary looking mathematics that hides the fact that it was
 typeset by a machine. You merely need to load the right files:
 \begin{itemize}
 \item Import theory \texttt{LaTeXsugar} in the header of your own
 theory.  You may also want bits of \texttt{OptionalSugar}, which you can
 copy selectively into your own theory or import as a whole.  Both
 theories live in \texttt{HOL/Library}.
 
 \item Should you need additional \LaTeX\ packages (the text will tell
 you so), you include them at the beginning of your \LaTeX\ document,
 typically in \texttt{root.tex}. For a start, you should
 \verb!\usepackage{amssymb}! --- otherwise typesetting
 @{prop[source]"\<not>(\<exists>x. P x)"} will fail because the AMS symbol
 \<open>\<nexists>\<close> is missing.
 \end{itemize}
 
 
 \section{HOL syntax}
 
 \subsection{Logic}
 
 The formula @{prop[source]"\<not>(\<exists>x. P x)"} is typeset as \<^prop>\<open>\<not>(\<exists>x. P x)\<close>.
 
 The predefined constructs \<open>if\<close>, \<open>let\<close> and
 \<open>case\<close> are set in sans serif font to distinguish them from
 other functions. This improves readability:
 \begin{itemize}
 \item \<^term>\<open>if b then e\<^sub>1 else e\<^sub>2\<close> instead of \<open>if b then e\<^sub>1 else e\<^sub>2\<close>.
 \item \<^term>\<open>let x = e\<^sub>1 in e\<^sub>2\<close> instead of \<open>let x = e\<^sub>1 in e\<^sub>2\<close>.
 \item \<^term>\<open>case x of True \<Rightarrow> e\<^sub>1 | False \<Rightarrow> e\<^sub>2\<close> instead of\\
       \<open>case x of True \<Rightarrow> e\<^sub>1 | False \<Rightarrow> e\<^sub>2\<close>.
 \end{itemize}
 
 \subsection{Sets}
 
 Although set syntax in HOL is already close to
 standard, we provide a few further improvements:
 \begin{itemize}
 \item \<^term>\<open>{x. P}\<close> instead of \<open>{x. P}\<close>.
 \item \<^term>\<open>{}\<close> instead of \<open>{}\<close>, where
  \<^term>\<open>{}\<close> is also input syntax.
 \item \<^term>\<open>insert a (insert b (insert c M))\<close> instead of \<open>insert a (insert b (insert c M))\<close>.
 \item \<^term>\<open>card A\<close> instead of \<open>card A\<close>.
 \end{itemize}
 
 
 \subsection{Lists}
 
 If lists are used heavily, the following notations increase readability:
 \begin{itemize}
 \item \<^term>\<open>x # xs\<close> instead of \<open>x # xs\<close>,
       where \<^term>\<open>x # xs\<close> is also input syntax.
 \item \<^term>\<open>length xs\<close> instead of \<open>length xs\<close>.
 \item \<^term>\<open>nth xs n\<close> instead of \<open>nth xs n\<close>,
       the $n$th element of \<open>xs\<close>.
 
 \item Human readers are good at converting automatically from lists to
 sets. Hence \texttt{OptionalSugar} contains syntax for suppressing the
 conversion function \<^const>\<open>set\<close>: for example, @{prop[source]"x \<in> set xs"}
 becomes \<^prop>\<open>x \<in> set xs\<close>.
 
 \item The \<open>@\<close> operation associates implicitly to the right,
 which leads to unpleasant line breaks if the term is too long for one
 line. To avoid this, \texttt{OptionalSugar} contains syntax to group
 \<open>@\<close>-terms to the left before printing, which leads to better
 line breaking behaviour:
 @{term[display]"term\<^sub>0 @ term\<^sub>1 @ term\<^sub>2 @ term\<^sub>3 @ term\<^sub>4 @ term\<^sub>5 @ term\<^sub>6 @ term\<^sub>7 @ term\<^sub>8 @ term\<^sub>9 @ term\<^sub>1\<^sub>0"}
 
 \end{itemize}
 
 
 \subsection{Numbers}
 
 Coercions between numeric types are alien to mathematicians who
 consider, for example, \<^typ>\<open>nat\<close> as a subset of \<^typ>\<open>int\<close>.
 \texttt{OptionalSugar} contains syntax for suppressing numeric coercions such
 as \<^const>\<open>int\<close> \<open>::\<close> \<^typ>\<open>nat \<Rightarrow> int\<close>. For example,
 @{term[source]"int 5"} is printed as \<^term>\<open>int 5\<close>. Embeddings of types
 \<^typ>\<open>nat\<close>, \<^typ>\<open>int\<close>, \<^typ>\<open>real\<close> are covered; non-injective coercions such
 as \<^const>\<open>nat\<close> \<open>::\<close> \<^typ>\<open>int \<Rightarrow> nat\<close> are not and should not be
 hidden.
 
 
 \section{Printing constants and their type}
 
 Instead of
 \verb!@!\verb!{const myconst}! \verb!@!\verb!{text "::"}! \verb!@!\verb!{typeof myconst}!,
 you can write \verb!@!\verb!{const_typ myconst}! using the new antiquotation
 \texttt{const\_typ} defined in \texttt{LaTeXsugar}. For example,
 \verb!@!\verb!{const_typ length}! produces \<^const_typ>\<open>length\<close> (see below for how to suppress
 the question mark).
 This works both for genuine constants and for variables fixed in some context,
 especially in a locale.
 
 
 \section{Printing theorems}
 
 The \<^prop>\<open>P \<Longrightarrow> Q \<Longrightarrow> R\<close> syntax is a bit idiosyncratic. If you would like
 to avoid it, you can easily print the premises as a conjunction:
 \<^prop>\<open>P \<and> Q \<Longrightarrow> R\<close>. See \texttt{OptionalSugar} for the required ``code''.
 
 \subsection{Question marks}
 
 If you print anything, especially theorems, containing
 schematic variables they are prefixed with a question mark:
 \verb!@!\verb!{thm conjI}! results in @{thm conjI}. Most of the time
 you would rather not see the question marks. There is an attribute
 \verb!no_vars! that you can attach to the theorem that turns its
 schematic into ordinary free variables:
 \begin{quote}
 \verb!@!\verb!{thm conjI[no_vars]}!\\
 \showout @{thm conjI[no_vars]}
 \end{quote}
 This \verb!no_vars! business can become a bit tedious.
 If you would rather never see question marks, simply put
 \begin{quote}
 \verb!options [show_question_marks = false]!
 \end{quote}
 into the relevant \texttt{ROOT} file, just before the \texttt{theories} for that session.
 The rest of this document is produced with this flag set to \texttt{false}.
 \<close>
 
 (*<*)declare [[show_question_marks = false]](*>*)
 
 subsection \<open>Qualified names\<close>
 
 text\<open>If there are multiple declarations of the same name, Isabelle prints
 the qualified name, for example \<open>T.length\<close>, where \<open>T\<close> is the
 theory it is defined in, to distinguish it from the predefined @{const[source]
 "List.length"}. In case there is no danger of confusion, you can insist on
 short names (no qualifiers) by setting the \verb!names_short!
 configuration option in the context.
 
 
 \subsection {Variable names\label{sec:varnames}}
 
 It sometimes happens that you want to change the name of a
 variable in a theorem before printing it. This can easily be achieved
 with the help of Isabelle's instantiation attribute \texttt{where}:
 \begin{quote}
 \verb!@!\verb!{thm conjI[where P = \<phi> and Q = \<psi>]}!\\
 \showout @{thm conjI[where P = \<phi> and Q = \<psi>]}
 \end{quote}
 To support the ``\_''-notation for irrelevant variables
 the constant \texttt{DUMMY} has been introduced:
 \begin{quote}
 \verb!@!\verb!{thm fst_conv[of _ DUMMY]}!\\
 \showout @{thm fst_conv[of _ DUMMY]}
 \end{quote}
 As expected, the second argument has been replaced by ``\_'',
 but the first argument is the ugly \<open>x1.0\<close>, a schematic variable
 with suppressed question mark. Schematic variables that end in digits,
 e.g. \<open>x1\<close>, are still printed with a trailing \<open>.0\<close>,
 e.g. \<open>x1.0\<close>, their internal index. This can be avoided by
 turning the last digit into a subscript: write \<^verbatim>\<open>x\<^sub>1\<close> and
 obtain the much nicer \<open>x\<^sub>1\<close>. Alternatively, you can display trailing digits of
 schematic and free variables as subscripts with the \texttt{sub} style:
 \begin{quote}
 \verb!@!\verb!{thm (sub) fst_conv[of _ DUMMY]}!\\
 \showout @{thm (sub) fst_conv[of _ DUMMY]}
 \end{quote}
 The insertion of underscores can be automated with the \verb!dummy_pats! style:
 \begin{quote}
 \verb!@!\verb!{thm (dummy_pats,sub) fst_conv}!\\
 \showout @{thm (dummy_pats,sub) fst_conv}
 \end{quote}
 The theorem must be an equation. Then every schematic variable that occurs
 on the left-hand but not the right-hand side is replaced by \texttt{DUMMY}.
 This is convenient for displaying functional programs.
 
 Variables that are bound by quantifiers or lambdas can be renamed
 with the help of the attribute \verb!rename_abs!.
 It expects a list of names or underscores, similar to the \texttt{of} attribute:
 \begin{quote}
 \verb!@!\verb!{thm split_paired_All[rename_abs _ l r]}!\\
 \showout @{thm split_paired_All[rename_abs _ l r]}
 \end{quote}
 
 Sometimes Isabelle $\eta$-contracts terms, for example in the following definition:
 \<close>
 fun eta where
 "eta (x \<cdot> xs) = (\<forall>y \<in> set xs. x < y)"
 text\<open>
 \noindent
 If you now print the defining equation, the result is not what you hoped for:
 \begin{quote}
 \verb!@!\verb!{thm eta.simps}!\\
 \showout @{thm eta.simps}
 \end{quote}
 In such situations you can put the abstractions back by explicitly $\eta$-expanding upon output:
 \begin{quote}
 \verb!@!\verb!{thm (eta_expand z) eta.simps}!\\
 \showout @{thm (eta_expand z) eta.simps}
 \end{quote}
 Instead of a single variable \verb!z! you can give a whole list \verb!x y z!
 to perform multiple $\eta$-expansions.
 
 \subsection{Inference rules}
 
 To print theorems as inference rules you need to include Didier
-R\'emy's \texttt{mathpartir} package~@{cite mathpartir}
+R\'emy's \texttt{mathpartir} package~\<^cite>\<open>mathpartir\<close>
 for typesetting inference rules in your \LaTeX\ file.
 
 Writing \verb!@!\verb!{thm[mode=Rule] conjI}! produces
 @{thm[mode=Rule] conjI}, even in the middle of a sentence.
 If you prefer your inference rule on a separate line, maybe with a name,
 \begin{center}
 @{thm[mode=Rule] conjI} {\sc conjI}
 \end{center}
 is produced by
 \begin{quote}
 \verb!\begin{center}!\\
 \verb!@!\verb!{thm[mode=Rule] conjI} {\sc conjI}!\\
 \verb!\end{center}!
 \end{quote}
 It is not recommended to use the standard \texttt{display} option
 together with \texttt{Rule} because centering does not work and because
 the line breaking mechanisms of \texttt{display} and \texttt{mathpartir} can
 clash.
 
 Of course you can display multiple rules in this fashion:
 \begin{quote}
 \verb!\begin{center}!\\
 \verb!@!\verb!{thm[mode=Rule] conjI} {\sc conjI} \\[1ex]!\\
 \verb!@!\verb!{thm[mode=Rule] conjE} {\sc disjI$_1$} \qquad!\\
 \verb!@!\verb!{thm[mode=Rule] disjE} {\sc disjI$_2$}!\\
 \verb!\end{center}!
 \end{quote}
 yields
 \begin{center}\small
 @{thm[mode=Rule] conjI} {\sc conjI} \\[1ex]
 @{thm[mode=Rule] disjI1} {\sc disjI$_1$} \qquad
 @{thm[mode=Rule] disjI2} {\sc disjI$_2$}
 \end{center}
 
 The \texttt{mathpartir} package copes well if there are too many
 premises for one line:
 \begin{center}
 @{prop[mode=Rule] "\<lbrakk> A \<longrightarrow> B; B \<longrightarrow> C; C \<longrightarrow> D; D \<longrightarrow> E; E \<longrightarrow> F; F \<longrightarrow> G;
  G \<longrightarrow> H; H \<longrightarrow> I; I \<longrightarrow> J; J \<longrightarrow> K \<rbrakk> \<Longrightarrow> A \<longrightarrow> K"}
 \end{center}
 
 Limitations: 1. Premises and conclusion must each not be longer than
 the line.  2. Premises that are \<open>\<Longrightarrow>\<close>-implications are again
 displayed with a horizontal line, which looks at least unusual.
 
 
 In case you print theorems without premises no rule will be printed by the
 \texttt{Rule} print mode. However, you can use \texttt{Axiom} instead:
 \begin{quote}
 \verb!\begin{center}!\\
 \verb!@!\verb!{thm[mode=Axiom] refl} {\sc refl}! \\
 \verb!\end{center}!
 \end{quote}
 yields
 \begin{center}
 @{thm[mode=Axiom] refl} {\sc refl} 
 \end{center}
 
 
 \subsection{Displays and font sizes}
 
 When displaying theorems with the \texttt{display} option, for example as in
 \verb!@!\verb!{thm[display] refl}! @{thm[display] refl} the theorem is
 set in small font. It uses the \LaTeX-macro \verb!\isastyle!,
 which is also the style that regular theory text is set in, e.g.\<close>
 
 lemma "t = t"
 (*<*)oops(*>*)
 
 text\<open>\noindent Otherwise \verb!\isastyleminor! is used,
 which does not modify the font size (assuming you stick to the default
 \verb!\isabellestyle{it}! in \texttt{root.tex}). If you prefer
 normal font size throughout your text, include
 \begin{quote}
 \verb!\renewcommand{\isastyle}{\isastyleminor}!
 \end{quote}
 in \texttt{root.tex}. On the other hand, if you like the small font,
 just put \verb!\isastyle! in front of the text in question,
 e.g.\ at the start of one of the center-environments above.
 
 The advantage of the display option is that you can display a whole
 list of theorems in one go. For example,
 \verb!@!\verb!{thm[display] append.simps}!
 generates @{thm[display] append.simps}
 
 
 \subsection{If-then}
 
 If you prefer a fake ``natural language'' style you can produce
 the body of
 \newtheorem{theorem}{Theorem}
 \begin{theorem}
 @{thm[mode=IfThen] le_trans}
 \end{theorem}
 by typing
 \begin{quote}
 \verb!@!\verb!{thm[mode=IfThen] le_trans}!
 \end{quote}
 
 In order to prevent odd line breaks, the premises are put into boxes.
 At times this is too drastic:
 \begin{theorem}
 @{prop[mode=IfThen] "longpremise \<Longrightarrow> longerpremise \<Longrightarrow> P(f(f(f(f(f(f(f(f(f(x)))))))))) \<Longrightarrow> longestpremise \<Longrightarrow> conclusion"}
 \end{theorem}
 In which case you should use \texttt{IfThenNoBox} instead of
 \texttt{IfThen}:
 \begin{theorem}
 @{prop[mode=IfThenNoBox] "longpremise \<Longrightarrow> longerpremise \<Longrightarrow> P(f(f(f(f(f(f(f(f(f(x)))))))))) \<Longrightarrow> longestpremise \<Longrightarrow> conclusion"}
 \end{theorem}
 
 
 \subsection{Doing it yourself\label{sec:yourself}}
 
 If for some reason you want or need to present theorems your
 own way, you can extract the premises and the conclusion explicitly
 and combine them as you like:
 \begin{itemize}
 \item \verb!@!\verb!{thm (prem 1)! $thm$\verb!}!
 prints premise 1 of $thm$.
 \item \verb!@!\verb!{thm (concl)! $thm$\verb!}!
 prints the conclusion of $thm$.
 \end{itemize}
 For example, ``from @{thm (prem 2) conjI} and
 @{thm (prem 1) conjI} we conclude @{thm (concl) conjI}''
 is produced by
 \begin{quote}
 \verb!from !\verb!@!\verb!{thm (prem 2) conjI}! \verb!and !\verb!@!\verb!{thm (prem 1) conjI}!\\
 \verb!we conclude !\verb!@!\verb!{thm (concl) conjI}!
 \end{quote}
 Thus you can rearrange or hide premises and typeset the theorem as you like.
 Styles like \verb!(prem 1)! are a general mechanism explained
 in \S\ref{sec:styles}.
 
 
 \subsection{Patterns}
 
 
 In \S\ref{sec:varnames} we shows how to create patterns containing ``\<^term>\<open>DUMMY\<close>''.
 You can drive this game even further and extend the syntax of let
 bindings such that certain functions like \<^term>\<open>fst\<close>, \<^term>\<open>hd\<close>, 
 etc.\ are printed as patterns. \texttt{OptionalSugar} provides the following:
 
 \begin{center}
 \begin{tabular}{l@ {~~produced by~~}l}
 \<^term>\<open>let x = fst p in t\<close> & \verb!@!\verb!{term "let x = fst p in t"}!\\
 \<^term>\<open>let x = snd p in t\<close> & \verb!@!\verb!{term "let x = snd p in t"}!\\
 \<^term>\<open>let x = hd xs in t\<close> & \verb!@!\verb!{term "let x = hd xs in t"}!\\
 \<^term>\<open>let x = tl xs in t\<close> & \verb!@!\verb!{term "let x = tl xs in t"}!\\
 \<^term>\<open>let x = the y in t\<close> & \verb!@!\verb!{term "let x = the y in t"}!\\
 \end{tabular}
 \end{center}
 
 
 \section {Styles\label{sec:styles}}
 
 The \verb!thm! antiquotation works nicely for single theorems, but
 sets of equations as used in definitions are more difficult to
 typeset nicely: people tend to prefer aligned \<open>=\<close> signs.
 
 To deal with such cases where it is desirable to dive into the structure
 of terms and theorems, Isabelle offers antiquotations featuring ``styles'':
 
 \begin{quote}
 \verb!@!\verb!{thm (style) thm}!\\
 \verb!@!\verb!{prop (style) thm}!\\
 \verb!@!\verb!{term (style) term}!\\
 \verb!@!\verb!{term_type (style) term}!\\
 \verb!@!\verb!{typeof (style) term}!\\
 \end{quote}
 
  A ``style'' is a transformation of a term. There are predefined
  styles, namely \verb!lhs! and \verb!rhs!, \verb!prem! with one argument, and \verb!concl!.
 For example, the output
 \begin{center}
 \begin{tabular}{l@ {~~\<open>=\<close>~~}l}
 @{thm (lhs) append_Nil} & @{thm (rhs) append_Nil}\\
 @{thm (lhs) append_Cons} & @{thm (rhs) append_Cons}
 \end{tabular}
 \end{center}
 is produced by the following code:
 \begin{quote}
   \verb!\begin{center}!\\
   \verb!\begin{tabular}{l@ {~~!\verb!@!\verb!{text "="}~~}l}!\\
   \verb!@!\verb!{thm (lhs) append_Nil} & @!\verb!{thm (rhs) append_Nil}\\!\\
   \verb!@!\verb!{thm (lhs) append_Cons} & @!\verb!{thm (rhs) append_Cons}!\\
   \verb!\end{tabular}!\\
   \verb!\end{center}!
 \end{quote}
 Note the space between \verb!@! and \verb!{! in the tabular argument.
 It prevents Isabelle from interpreting \verb!@ {~~...~~}! 
 as an antiquotation. The styles \verb!lhs! and \verb!rhs!
 extract the left hand side (or right hand side respectively) from the
 conclusion of propositions consisting of a binary operator
 (e.~g.~\<open>=\<close>, \<open>\<equiv>\<close>, \<open><\<close>).
 
 Likewise, \verb!concl! may be used as a style to show just the
 conclusion of a proposition. For example, take \verb!hd_Cons_tl!:
 \begin{center}
   @{thm hd_Cons_tl}
 \end{center}
 To print just the conclusion,
 \begin{center}
   @{thm (concl) hd_Cons_tl}
 \end{center}
 type
 \begin{quote}
   \verb!\begin{center}!\\
   \verb!@!\verb!{thm (concl) hd_Cons_tl}!\\
   \verb!\end{center}!
 \end{quote}
 Beware that any options must be placed \emph{before} the style, as in this example.
 
 Further use cases can be found in \S\ref{sec:yourself}.
 If you are not afraid of ML, you may also define your own styles.
 Have a look at module \<^ML_structure>\<open>Term_Style\<close>.
 
 
 \section {Proofs}
 
 Full proofs, even if written in beautiful Isar style, are
 likely to be too long and detailed to be included in conference
 papers, but some key lemmas might be of interest.
 It is usually easiest to put them in figures like the one in Fig.\
 \ref{fig:proof}. This was achieved with the \isakeyword{text\_raw} command:
 \<close>
 text_raw \<open>
   \begin{figure}
   \begin{center}\begin{minipage}{0.6\textwidth}  
   \isastyleminor\isamarkuptrue
 \<close>
 lemma True
 proof -
   \<comment> \<open>pretty trivial\<close>
   show True by force
 qed
 text_raw \<open>
   \end{minipage}\end{center}
   \caption{Example proof in a figure.}\label{fig:proof}
   \end{figure}
 \<close>
 text \<open>
 
 \begin{quote}
 \small
 \verb!text_raw {!\verb!*!\\
 \verb!  \begin{figure}!\\
 \verb!  \begin{center}\begin{minipage}{0.6\textwidth}!\\
 \verb!  \isastyleminor\isamarkuptrue!\\
 \verb!*!\verb!}!\\
 \verb!lemma True!\\
 \verb!proof -!\\
 \verb!  -- "pretty trivial"!\\
 \verb!  show True by force!\\
 \verb!qed!\\
 \verb!text_raw {!\verb!*!\\
 \verb!  \end{minipage}\end{center}!\\
 \verb!  \caption{Example proof in a figure.}\label{fig:proof}!\\
 \verb!  \end{figure}!\\
 \verb!*!\verb!}!
 \end{quote}
 
 Other theory text, e.g.\ definitions, can be put in figures, too.
 
 \section{Theory snippets}
 
 This section describes how to include snippets of a theory text in some other \LaTeX\ document.
 The typical scenario is that the description of your theory is not part of the theory text but
 a separate document that antiquotes bits of the theory. This works well for terms and theorems
 but there are no antiquotations, for example, for function definitions or proofs. Even if there are antiquotations,
 the output is usually a reformatted (by Isabelle) version of the input and may not look like
 you wanted it to look. Here is how to include a snippet of theory text (in \LaTeX\ form) in some
 other \LaTeX\ document, in 4 easy steps. Beware that these snippets are not processed by
 any antiquotation mechanism: the resulting \LaTeX\ text is more or less exactly what you wrote
 in the theory, without any added sugar.
 
 \subsection{Theory markup}
 
 Include some markers at the beginning and the end of the theory snippet you want to cut out.
 You have to place the following lines before and after the snippet, where snippets must always be
 consecutive lines of theory text:
 \begin{quote}
 \verb!\text_raw{!\verb!*\snip{!\emph{snippetname}\verb!}{1}{2}{%*!\verb!}!\\
 \emph{theory text}\\
 \verb!\text_raw{!\verb!*!\verb!}%endsnip*!\verb!}!
 \end{quote}
 where \emph{snippetname} should be a unique name for the snippet. The numbers \texttt{1}
 and \texttt{2} are explained in a moment.
 
 \subsection{Generate the \texttt{.tex} file}
 
 Run your theory \texttt{T} with the \texttt{isabelle} \texttt{build} tool
 to generate the \LaTeX-file \texttt{T.tex} which is needed for the next step,
 extraction of marked snippets.
 You may also want to process \texttt{T.tex} to generate a pdf document.
 This requires a definition of \texttt{\char`\\snippet}:
 \begin{verbatim}
 \newcommand{\repeatisanl}[1]
   {\ifnum#1=0\else\isanewline\repeatisanl{\numexpr#1-1}\fi}
 \newcommand{\snip}[4]{\repeatisanl#2#4\repeatisanl#3}
 \end{verbatim}
 Parameter 2 and 3 of \texttt{\char`\\snippet} are numbers (the \texttt{1}
 and \texttt{2} above) and determine how many newlines are inserted before and after the snippet.
 Unfortunately \texttt{text\_raw} eats up all preceding and following newlines
 and they have to be inserted again in this manner. Otherwise the document generated from \texttt{T.tex}
 will look ugly around the snippets. It can take some iterations to get the number of required
 newlines exactly right.
 
 \subsection{Extract marked snippets}
 \label{subsec:extract}
 
 Extract the marked bits of text with a shell-level script, e.g.
 \begin{quote}
 \verb!sed -n '/\\snip{/,/endsnip/p' T.tex > !\emph{snippets}\verb!.tex!
 \end{quote}
 File \emph{snippets}\texttt{.tex} (the name is arbitrary) now contains a sequence of blocks like this
 \begin{quote}
 \verb!\snip{!\emph{snippetname}\verb!}{1}{2}{%!\\
 \emph{theory text}\\
 \verb!}%endsnip!
 \end{quote}
 
 \subsection{Including snippets}
 
 In the preamble of the document where the snippets are to be used you define \texttt{\char`\\snip}
 and input \emph{snippets}\texttt{.tex}:
 \begin{verbatim}
 \newcommand{\snip}[4]
   {\expandafter\newcommand\csname #1\endcsname{#4}}
 \input{snippets}
 \end{verbatim}
 This definition of \texttt{\char`\\snip} simply has the effect of defining for each snippet
 \emph{snippetname} a \LaTeX\ command \texttt{\char`\\}\emph{snippetname}
 that produces the corresponding snippet text. In the body of your document you can display that text
 like this:
 \begin{quote}
 \verb!\begin{isabelle}!\\
 \texttt{\char`\\}\emph{snippetname}\\
 \verb!\end{isabelle}!
 \end{quote}
 The \texttt{isabelle} environment is the one defined in the standard file
 \texttt{isabelle.sty} which most likely you are loading anyway.
 \<close>
 
 (*<*)
 end
 (*>*)
diff --git a/src/Doc/System/Environment.thy b/src/Doc/System/Environment.thy
--- a/src/Doc/System/Environment.thy
+++ b/src/Doc/System/Environment.thy
@@ -1,490 +1,488 @@
 (*:maxLineLen=78:*)
 
 theory Environment
 imports Base
 begin
 
 chapter \<open>The Isabelle system environment\<close>
 
 text \<open>
   This manual describes Isabelle together with related tools as seen from a
-  system oriented view. See also the \<^emph>\<open>Isabelle/Isar Reference Manual\<close> @{cite
-  "isabelle-isar-ref"} for the actual Isabelle input language and related
-  concepts, and \<^emph>\<open>The Isabelle/Isar Implementation Manual\<close> @{cite
-  "isabelle-implementation"} for the main concepts of the underlying
+  system oriented view. See also the \<^emph>\<open>Isabelle/Isar Reference Manual\<close> \<^cite>\<open>"isabelle-isar-ref"\<close> for the actual Isabelle input language and related
+  concepts, and \<^emph>\<open>The Isabelle/Isar Implementation Manual\<close> \<^cite>\<open>"isabelle-implementation"\<close> for the main concepts of the underlying
   implementation in Isabelle/ML.
 \<close>
 
 
 section \<open>Isabelle settings \label{sec:settings}\<close>
 
 text \<open>
   Isabelle executables may depend on the \<^emph>\<open>Isabelle settings\<close> within the
   process environment. This is a statically scoped collection of environment
   variables, such as @{setting ISABELLE_HOME}, @{setting ML_SYSTEM}, @{setting
   ML_HOME}. These variables are \<^emph>\<open>not\<close> intended to be set directly from the
   shell, but are provided by Isabelle \<^emph>\<open>components\<close> within their \<^emph>\<open>settings
   files\<close>, as explained below.
 \<close>
 
 
 subsection \<open>Bootstrapping the environment \label{sec:boot}\<close>
 
 text \<open>
   Isabelle executables need to be run within a proper settings environment.
   This is bootstrapped as described below, on the first invocation of one of
   the outer wrapper scripts (such as @{executable_ref isabelle}). This happens
   only once for each process tree, i.e.\ the environment is passed to
   subprocesses according to regular Unix conventions.
 
     \<^enum> The special variable @{setting_def ISABELLE_HOME} is determined
     automatically from the location of the binary that has been run.
 
     You should not try to set @{setting ISABELLE_HOME} manually. Also note
     that the Isabelle executables either have to be run from their original
     location in the distribution directory, or via the executable objects
     created by the @{tool install} tool. Symbolic links are admissible, but a
     plain copy of the \<^dir>\<open>$ISABELLE_HOME/bin\<close> files will not work!
 
     \<^enum> The file \<^file>\<open>$ISABELLE_HOME/etc/settings\<close> is run as a @{executable_ref
     bash} shell script with the auto-export option for variables enabled.
 
     This file holds a rather long list of shell variable assignments, thus
     providing the site-wide default settings. The Isabelle distribution
     already contains a global settings file with sensible defaults for most
     variables. When installing the system, only a few of these may have to be
     adapted (probably @{setting ML_SYSTEM} etc.).
 
     \<^enum> The file \<^path>\<open>$ISABELLE_HOME_USER/etc/settings\<close> (if it
     exists) is run in the same way as the site default settings. Note that the
     variable @{setting ISABELLE_HOME_USER} has already been set before ---
     usually to something like \<^verbatim>\<open>$USER_HOME/.isabelle/Isabelle2022\<close>.
 
     Thus individual users may override the site-wide defaults. Typically, a
     user settings file contains only a few lines, with some assignments that
     are actually changed. Never copy the central
     \<^file>\<open>$ISABELLE_HOME/etc/settings\<close> file!
 
   Since settings files are regular GNU @{executable_def bash} scripts, one may
   use complex shell commands, such as \<^verbatim>\<open>if\<close> or \<^verbatim>\<open>case\<close> statements to set
   variables depending on the system architecture or other environment
   variables. Such advanced features should be added only with great care,
   though. In particular, external environment references should be kept at a
   minimum.
 
   \<^medskip>
   A few variables are somewhat special, e.g.\ @{setting_def ISABELLE_TOOL} is
   set automatically to the absolute path name of the @{executable isabelle}
   executables.
 
   \<^medskip>
   Note that the settings environment may be inspected with the @{tool getenv}
   tool. This might help to figure out the effect of complex settings scripts.
 \<close>
 
 
 subsection \<open>Common variables\<close>
 
 text \<open>
   This is a reference of common Isabelle settings variables. Note that the
   list is somewhat open-ended. Third-party utilities or interfaces may add
   their own selection. Variables that are special in some sense are marked
   with \<open>\<^sup>*\<close>.
 
   \<^descr>[@{setting_def USER_HOME}\<open>\<^sup>*\<close>] Is the cross-platform user home directory.
   On Unix systems this is usually the same as @{setting HOME}, but on Windows
   it is the regular home directory of the user, not the one of within the
   Cygwin root file-system.\<^footnote>\<open>Cygwin itself offers another choice whether its
   HOME should point to the \<^path>\<open>/home\<close> directory tree or the Windows user
   home.\<close>
 
   \<^descr>[@{setting_def ISABELLE_HOME}\<open>\<^sup>*\<close>] is the location of the top-level
   Isabelle distribution directory. This is automatically determined from the
   Isabelle executable that has been invoked. Do not attempt to set @{setting
   ISABELLE_HOME} yourself from the shell!
 
   \<^descr>[@{setting_def ISABELLE_HOME_USER}] is the user-specific counterpart of
   @{setting ISABELLE_HOME}. The default value is relative to \<^path>\<open>$USER_HOME/.isabelle\<close>, under rare circumstances this may be changed in the
   global setting file. Typically, the @{setting ISABELLE_HOME_USER} directory
   mimics @{setting ISABELLE_HOME} to some extend. In particular, site-wide
   defaults may be overridden by a private \<^verbatim>\<open>$ISABELLE_HOME_USER/etc/settings\<close>.
 
   \<^descr>[@{setting_def ISABELLE_PLATFORM_FAMILY}\<open>\<^sup>*\<close>] is automatically set to the
   general platform family (\<^verbatim>\<open>linux\<close>, \<^verbatim>\<open>macos\<close>, \<^verbatim>\<open>windows\<close>). Note that
   platform-dependent tools usually need to refer to the more specific
   identification according to @{setting ISABELLE_PLATFORM64}, @{setting
   ISABELLE_WINDOWS_PLATFORM64}, @{setting ISABELLE_APPLE_PLATFORM64}.
 
   \<^descr>[@{setting_def ISABELLE_PLATFORM64}\<open>\<^sup>*\<close>] indicates the standard Posix
   platform (\<^verbatim>\<open>x86_64\<close>, \<^verbatim>\<open>arm64\<close>), together with a symbolic name for the
   operating system (\<^verbatim>\<open>linux\<close>, \<^verbatim>\<open>darwin\<close>, \<^verbatim>\<open>cygwin\<close>).
 
   \<^descr>[@{setting_def ISABELLE_WINDOWS_PLATFORM64}\<open>\<^sup>*\<close>, @{setting_def
   ISABELLE_WINDOWS_PLATFORM32}\<open>\<^sup>*\<close>] indicate the native Windows platform: both
   64\,bit and 32\,bit executables are supported here.
 
   In GNU bash scripts, a preference for native Windows platform variants may
   be specified like this (first 64 bit, second 32 bit):
 
   @{verbatim [display] \<open>"${ISABELLE_WINDOWS_PLATFORM64:-${ISABELLE_WINDOWS_PLATFORM32:-
   $ISABELLE_PLATFORM64}}"\<close>}
 
   \<^descr>[@{setting_def ISABELLE_APPLE_PLATFORM64}\<open>\<^sup>*\<close>] indicates the native Apple
   Silicon platform (\<^verbatim>\<open>arm64-darwin\<close> if available), instead of Intel emulation
   via Rosetta (\<^verbatim>\<open>ISABELLE_PLATFORM64=x86_64-darwin\<close>).
 
   \<^descr>[@{setting ISABELLE_TOOL}\<open>\<^sup>*\<close>] is automatically set to the full path name
   of the @{executable isabelle} executable.
 
   \<^descr>[@{setting_def ISABELLE_IDENTIFIER}\<open>\<^sup>*\<close>] refers to the name of this
   Isabelle distribution, e.g.\ ``\<^verbatim>\<open>Isabelle2022\<close>''.
 
   \<^descr>[@{setting_def ML_SYSTEM}, @{setting_def ML_HOME}, @{setting_def
   ML_OPTIONS}, @{setting_def ML_PLATFORM}, @{setting_def ML_IDENTIFIER}\<open>\<^sup>*\<close>]
   specify the underlying ML system to be used for Isabelle. There is only a
   fixed set of admissable @{setting ML_SYSTEM} names (see the
   \<^file>\<open>$ISABELLE_HOME/etc/settings\<close> file of the distribution).
 
   The actual compiler binary will be run from the directory @{setting
   ML_HOME}, with @{setting ML_OPTIONS} as first arguments on the command line.
   The optional @{setting ML_PLATFORM} may specify the binary format of ML heap
   images, which is useful for cross-platform installations. The value of
   @{setting ML_IDENTIFIER} is automatically obtained by composing the values
   of @{setting ML_SYSTEM}, @{setting ML_PLATFORM} and the Isabelle version
   values.
 
   \<^descr>[@{setting_def ISABELLE_JDK_HOME}] points to a full JDK (Java Development
   Kit) installation with \<^verbatim>\<open>javac\<close> and \<^verbatim>\<open>jar\<close> executables. Note that
   conventional \<^verbatim>\<open>JAVA_HOME\<close> points to the JRE (Java Runtime Environment), not
   the JDK.
 
   \<^descr>[@{setting_def ISABELLE_JAVA_PLATFORM}] identifies the hardware and
   operating system platform for the Java installation of Isabelle. That is
   always the (native) 64 bit variant: \<^verbatim>\<open>x86_64-linux\<close>, \<^verbatim>\<open>x86_64-darwin\<close>,
   \<^verbatim>\<open>x86_64-windows\<close>.
 
   \<^descr>[@{setting_def ISABELLE_BROWSER_INFO}] is the directory where HTML and PDF
   browser information is stored (see also \secref{sec:info}); its default is
   \<^path>\<open>$ISABELLE_HOME_USER/browser_info\<close>. For ``system build mode'' (see
   \secref{sec:tool-build}), @{setting_def ISABELLE_BROWSER_INFO_SYSTEM} is
   used instead; its default is \<^path>\<open>$ISABELLE_HOME/browser_info\<close>.
 
   \<^descr>[@{setting_def ISABELLE_HEAPS}] is the directory where session heap images,
   log files, and build databases are stored; its default is
   \<^path>\<open>$ISABELLE_HOME_USER/heaps\<close>. If @{system_option system_heaps} is
   \<^verbatim>\<open>true\<close>, @{setting_def ISABELLE_HEAPS_SYSTEM} is used instead; its default
   is \<^path>\<open>$ISABELLE_HOME/heaps\<close>. See also \secref{sec:tool-build}.
 
   \<^descr>[@{setting_def ISABELLE_LOGIC}] specifies the default logic to load if none
   is given explicitely by the user. The default value is \<^verbatim>\<open>HOL\<close>.
 
   \<^descr>[@{setting_def ISABELLE_LINE_EDITOR}] specifies the line editor for the
   @{tool_ref console} interface.
 
   \<^descr>[@{setting_def ISABELLE_PDFLATEX}, @{setting_def ISABELLE_LUALATEX},
   @{setting_def ISABELLE_BIBTEX}, @{setting_def ISABELLE_MAKEINDEX}] refer to
   {\LaTeX}-related tools for Isabelle document preparation (see also
   \secref{sec:tool-document}).
 
   \<^descr>[@{setting_def ISABELLE_TOOLS}] is a colon separated list of directories
   that are scanned by @{executable isabelle} for external utility programs
   (see also \secref{sec:isabelle-tool}).
 
   \<^descr>[@{setting_def ISABELLE_DOCS}] is a colon separated list of directories
   with documentation files.
 
   \<^descr>[@{setting_def PDF_VIEWER}] specifies the program to be used for displaying
   \<^verbatim>\<open>pdf\<close> files.
 
   \<^descr>[@{setting_def ISABELLE_TMP_PREFIX}\<open>\<^sup>*\<close>] is the prefix from which any
   running Isabelle ML process derives an individual directory for temporary
   files.
 
   \<^descr>[@{setting_def ISABELLE_TOOL_JAVA_OPTIONS}] is passed to the \<^verbatim>\<open>java\<close>
   executable when running Isabelle tools (e.g.\ @{tool build}). This is
   occasionally helpful to provide more heap space, via additional options like
   \<^verbatim>\<open>-Xms1g -Xmx4g\<close>.
 \<close>
 
 
 subsection \<open>Additional components \label{sec:components}\<close>
 
 text \<open>
   Any directory may be registered as an explicit \<^emph>\<open>Isabelle component\<close>. The
   general layout conventions are that of the main Isabelle distribution
   itself, and the following two files (both optional) have a special meaning:
 
     \<^item> \<^verbatim>\<open>etc/settings\<close> holds additional settings that are initialized when
     bootstrapping the overall Isabelle environment, cf.\ \secref{sec:boot}. As
     usual, the content is interpreted as a GNU bash script. It may refer to
     the component's enclosing directory via the \<^verbatim>\<open>COMPONENT\<close> shell variable.
 
     For example, the following setting allows to refer to files within the
     component later on, without having to hardwire absolute paths:
     @{verbatim [display] \<open>MY_COMPONENT_HOME="$COMPONENT"\<close>}
 
     Components can also add to existing Isabelle settings such as
     @{setting_def ISABELLE_TOOLS}, in order to provide component-specific
     tools that can be invoked by end-users. For example:
     @{verbatim [display] \<open>ISABELLE_TOOLS="$ISABELLE_TOOLS:$COMPONENT/lib/Tools"\<close>}
 
     \<^item> \<^verbatim>\<open>etc/components\<close> holds a list of further sub-components of the same
     structure. The directory specifications given here can be either absolute
     (with leading \<^verbatim>\<open>/\<close>) or relative to the component's main directory.
 
   The root of component initialization is @{setting ISABELLE_HOME} itself.
   After initializing all of its sub-components recursively, @{setting
   ISABELLE_HOME_USER} is included in the same manner (if that directory
   exists). This allows to install private components via
   \<^path>\<open>$ISABELLE_HOME_USER/etc/components\<close>, although it is often more
   convenient to do that programmatically via the
   \<^bash_function>\<open>init_component\<close> shell function in the \<^verbatim>\<open>etc/settings\<close>
   script of \<^verbatim>\<open>$ISABELLE_HOME_USER\<close> (or any other component directory). For
   example:
   @{verbatim [display] \<open>init_component "$HOME/screwdriver-2.0"\<close>}
 
   This is tolerant wrt.\ missing component directories, but might produce a
   warning.
 
   \<^medskip>
   More complex situations may be addressed by initializing components listed
   in a given catalog file, relatively to some base directory:
   @{verbatim [display] \<open>init_components "$HOME/my_component_store" "some_catalog_file"\<close>}
 
   The component directories listed in the catalog file are treated as relative
   to the given base directory.
 
   See also \secref{sec:tool-components} for some tool-support for resolving
   components that are formally initialized but not installed yet.
 \<close>
 
 
 section \<open>The Isabelle tool wrapper \label{sec:isabelle-tool}\<close>
 
 text \<open>
   The main \<^emph>\<open>Isabelle tool wrapper\<close> provides a generic startup environment for
   Isabelle-related utilities, user interfaces, add-on applications etc. Such
   tools automatically benefit from the settings mechanism
   (\secref{sec:settings}). Moreover, this is the standard way to invoke
   Isabelle/Scala functionality as a separate operating-system process.
   Isabelle command-line tools are run uniformly via a common wrapper ---
   @{executable_ref isabelle}:
   @{verbatim [display]
 \<open>Usage: isabelle TOOL [ARGS ...]
 
   Start Isabelle TOOL with ARGS; pass "-?" for tool-specific help.
 
 Available tools:
   ...\<close>}
 
   Tools may be implemented in Isabelle/Scala or as stand-alone executables
   (usually as GNU bash scripts). In the invocation of ``@{executable
   isabelle}~\<open>tool\<close>'', the named \<open>tool\<close> is resolved as follows (and in the
   given order).
 
     \<^enum> An external tool found on the directories listed in the @{setting
     ISABELLE_TOOLS} settings variable (colon-separated list in standard POSIX
     notation). It is invoked as stand-alone program with the command-line
     arguments provided as \<^verbatim>\<open>argv\<close> array.
 
     \<^enum> An internal tool that is declared via class
     \<^scala_type>\<open>isabelle.Isabelle_Scala_Tools\<close> and registered via
     \<^verbatim>\<open>services\<close> in \<^path>\<open>etc/build.props\<close>. See \secref{sec:scala-build} for
     more details.
 
   There are also various administrative tools that are available from a bare
   repository clone of Isabelle, but not in regular distributions.
 \<close>
 
 
 subsubsection \<open>Examples\<close>
 
 text \<open>
   Show the list of available documentation of the Isabelle distribution:
   @{verbatim [display] \<open>isabelle doc\<close>}
 
   View a certain document as follows:
   @{verbatim [display] \<open>isabelle doc system\<close>}
 
   Query the Isabelle settings environment:
   @{verbatim [display] \<open>isabelle getenv ISABELLE_HOME_USER\<close>}
 \<close>
 
 
 section \<open>The raw Isabelle ML process\<close>
 
 subsection \<open>Batch mode \label{sec:tool-process}\<close>
 
 text \<open>
   The @{tool_def process} tool runs the raw ML process in batch mode:
   @{verbatim [display]
 \<open>Usage: isabelle process [OPTIONS]
 
   Options are:
     -T THEORY    load theory
     -d DIR       include session directory
     -e ML_EXPR   evaluate ML expression on startup
     -f ML_FILE   evaluate ML file on startup
     -l NAME      logic session name (default ISABELLE_LOGIC="HOL")
     -m MODE      add print mode for output
     -o OPTION    override Isabelle system OPTION (via NAME=VAL or NAME)
 
   Run the raw Isabelle ML process in batch mode.\<close>}
 
   \<^medskip>
   Options \<^verbatim>\<open>-e\<close> and \<^verbatim>\<open>-f\<close> allow to evaluate ML code, before the ML process is
   started. The source is either given literally or taken from a file. Multiple
   \<^verbatim>\<open>-e\<close> and \<^verbatim>\<open>-f\<close> options are evaluated in the given order. Errors lead to
   a premature exit of the ML process with return code 1.
 
   \<^medskip>
   Option \<^verbatim>\<open>-T\<close> loads a specified theory file. This is a wrapper for \<^verbatim>\<open>-e\<close> with
   a suitable \<^ML>\<open>use_thy\<close> invocation.
 
   \<^medskip>
   Option \<^verbatim>\<open>-l\<close> specifies the logic session name. Option \<^verbatim>\<open>-d\<close> specifies
   additional directories for session roots, see also \secref{sec:tool-build}.
 
   \<^medskip>
   The \<^verbatim>\<open>-m\<close> option adds identifiers of print modes to be made active for this
   session. For example, \<^verbatim>\<open>-m ASCII\<close> prefers ASCII replacement syntax over
   mathematical Isabelle symbols.
 
   \<^medskip>
   Option \<^verbatim>\<open>-o\<close> allows to override Isabelle system options for this process,
   see also \secref{sec:system-options}.
 \<close>
 
 
 subsubsection \<open>Examples\<close>
 
 text \<open>
   The subsequent example retrieves the \<^verbatim>\<open>Main\<close> theory value from the theory
   loader within ML:
   @{verbatim [display] \<open>isabelle process -e 'Thy_Info.get_theory "Main"'\<close>}
 
   Observe the delicate quoting rules for the GNU bash shell vs.\ ML. The
   Isabelle/ML and Scala libraries provide functions for that, but here we need
   to do it manually.
 
   \<^medskip>
   This is how to invoke a function body with proper return code and printing
   of errors, and without printing of a redundant \<^verbatim>\<open>val it = (): unit\<close> result:
   @{verbatim [display] \<open>isabelle process -e 'Command_Line.tool (fn () => writeln "OK")'\<close>}
   @{verbatim [display] \<open>isabelle process -e 'Command_Line.tool (fn () => error "Bad")'\<close>}
 \<close>
 
 
 subsection \<open>Interactive mode\<close>
 
 text \<open>
   The @{tool_def console} tool runs the raw ML process with interactive
   console and line editor:
   @{verbatim [display]
 \<open>Usage: isabelle console [OPTIONS]
 
   Options are:
     -d DIR       include session directory
     -i NAME      include session in name-space of theories
     -l NAME      logic session name (default ISABELLE_LOGIC)
     -m MODE      add print mode for output
     -n           no build of session image on startup
     -o OPTION    override Isabelle system OPTION (via NAME=VAL or NAME)
     -r           bootstrap from raw Poly/ML
 
   Build a logic session image and run the raw Isabelle ML process
   in interactive mode, with line editor ISABELLE_LINE_EDITOR.\<close>}
 
   \<^medskip>
   Option \<^verbatim>\<open>-l\<close> specifies the logic session name. By default, its heap image is
   checked and built on demand, but the option \<^verbatim>\<open>-n\<close> skips that.
 
   Option \<^verbatim>\<open>-i\<close> includes additional sessions into the name-space of theories:
   multiple occurrences are possible.
 
   Option \<^verbatim>\<open>-r\<close> indicates a bootstrap from the raw Poly/ML system, which is
   relevant for Isabelle/Pure development.
 
   \<^medskip>
   Options \<^verbatim>\<open>-d\<close>, \<^verbatim>\<open>-m\<close>, \<^verbatim>\<open>-o\<close> have the same meaning as for @{tool process}
   (\secref{sec:tool-process}).
 
   \<^medskip>
   The Isabelle/ML process is run through the line editor that is specified via
   the settings variable @{setting ISABELLE_LINE_EDITOR} (e.g.\
   @{executable_def rlwrap} for GNU readline); the fall-back is to use plain
   standard input/output.
 
   The user is connected to the raw ML toplevel loop: this is neither
   Isabelle/Isar nor Isabelle/ML within the usual formal context. The most
   relevant ML commands at this stage are \<^ML>\<open>use\<close> (for ML files) and
   \<^ML>\<open>use_thy\<close> (for theory files).
 \<close>
 
 
 section \<open>The raw Isabelle Java process \label{sec:isabelle-java}\<close>
 
 text \<open>
   The @{executable_ref isabelle_java} executable allows to run a Java process
   within the name space of Java and Scala components that are bundled with
   Isabelle, but \<^emph>\<open>without\<close> the Isabelle settings environment
   (\secref{sec:settings}).
 
   After such a JVM cold-start, the Isabelle environment can be accessed via
   \<^verbatim>\<open>Isabelle_System.getenv\<close> as usual, but the underlying process environment
   remains clean. This is e.g.\ relevant when invoking other processes that
   should remain separate from the current Isabelle installation.
 
   \<^medskip>
   Note that under normal circumstances, Isabelle command-line tools are run
   \<^emph>\<open>within\<close> the settings environment, as provided by the @{executable
   isabelle} wrapper (\secref{sec:isabelle-tool} and \secref{sec:tool-java}).
 \<close>
 
 
 subsubsection \<open>Example\<close>
 
 text \<open>
   The subsequent example creates a raw Java process on the command-line and
   invokes the main Isabelle application entry point:
   @{verbatim [display] \<open>isabelle_java -Djava.awt.headless=false isabelle.jedit.JEdit_Main\<close>}
 \<close>
 
 
 section \<open>YXML versus XML \label{sec:yxml-vs-xml}\<close>
 
 text \<open>
   Isabelle tools often use YXML, which is a simple and efficient syntax for
   untyped XML trees. The YXML format is defined as follows.
 
     \<^enum> The encoding is always UTF-8.
 
     \<^enum> Body text is represented verbatim (no escaping, no special treatment of
     white space, no named entities, no CDATA chunks, no comments).
 
     \<^enum> Markup elements are represented via ASCII control characters \<open>\<^bold>X = 5\<close>
     and \<open>\<^bold>Y = 6\<close> as follows:
 
     \begin{tabular}{ll}
       XML & YXML \\\hline
       \<^verbatim>\<open><\<close>\<open>name attribute\<close>\<^verbatim>\<open>=\<close>\<open>value \<dots>\<close>\<^verbatim>\<open>>\<close> &
       \<open>\<^bold>X\<^bold>Yname\<^bold>Yattribute\<close>\<^verbatim>\<open>=\<close>\<open>value\<dots>\<^bold>X\<close> \\
       \<^verbatim>\<open></\<close>\<open>name\<close>\<^verbatim>\<open>>\<close> & \<open>\<^bold>X\<^bold>Y\<^bold>X\<close> \\
     \end{tabular}
 
     There is no special case for empty body text, i.e.\ \<^verbatim>\<open><foo/>\<close> is treated
     like \<^verbatim>\<open><foo></foo>\<close>. Also note that \<open>\<^bold>X\<close> and \<open>\<^bold>Y\<close> may never occur in
     well-formed XML documents.
 
   Parsing YXML is pretty straight-forward: split the text into chunks
   separated by \<open>\<^bold>X\<close>, then split each chunk into sub-chunks separated by \<open>\<^bold>Y\<close>.
   Markup chunks start with an empty sub-chunk, and a second empty sub-chunk
   indicates close of an element. Any other non-empty chunk consists of plain
   text. For example, see \<^file>\<open>~~/src/Pure/PIDE/yxml.ML\<close> or
   \<^file>\<open>~~/src/Pure/PIDE/yxml.scala\<close>.
 
   YXML documents may be detected quickly by checking that the first two
   characters are \<open>\<^bold>X\<^bold>Y\<close>.
 \<close>
 
 end
diff --git a/src/Doc/System/Scala.thy b/src/Doc/System/Scala.thy
--- a/src/Doc/System/Scala.thy
+++ b/src/Doc/System/Scala.thy
@@ -1,493 +1,493 @@
 (*:maxLineLen=78:*)
 
 theory Scala
 imports Base
 begin
 
 chapter \<open>Isabelle/Scala systems programming \label{sec:scala}\<close>
 
 text \<open>
   Isabelle/ML and Isabelle/Scala are the two main implementation languages of
   the Isabelle environment:
 
     \<^item> Isabelle/ML is for \<^emph>\<open>mathematics\<close>, to develop tools within the context
     of symbolic logic, e.g.\ for constructing proofs or defining
     domain-specific formal languages. See the \<^emph>\<open>Isabelle/Isar implementation
-    manual\<close> @{cite "isabelle-implementation"} for more details.
+    manual\<close> \<^cite>\<open>"isabelle-implementation"\<close> for more details.
 
     \<^item> Isabelle/Scala is for \<^emph>\<open>physics\<close>, to connect with the world of systems
     and services, including editors and IDE frameworks.
 
   There are various ways to access Isabelle/Scala modules and operations:
 
     \<^item> Isabelle command-line tools (\secref{sec:scala-tools}) run in a separate
     Java process.
 
     \<^item> Isabelle/ML antiquotations access Isabelle/Scala functions
     (\secref{sec:scala-functions}) via the PIDE protocol: execution happens
     within the running Java process underlying Isabelle/Scala.
 
-    \<^item> The \<^verbatim>\<open>Console/Scala\<close> plugin of Isabelle/jEdit @{cite "isabelle-jedit"}
+    \<^item> The \<^verbatim>\<open>Console/Scala\<close> plugin of Isabelle/jEdit \<^cite>\<open>"isabelle-jedit"\<close>
     operates on the running Java application, using the Scala
     read-eval-print-loop (REPL).
 
   The main Isabelle/Scala/jEdit functionality is provided by
   \<^file>\<open>$ISABELLE_HOME/lib/classes/isabelle.jar\<close>. Further underlying Scala and
   Java libraries are bundled with Isabelle, e.g.\ to access SQLite or
   PostgreSQL via JDBC.
 
   Add-on Isabelle components may augment the system environment by providing
   suitable configuration in \<^path>\<open>etc/settings\<close> (GNU bash script). The
   shell function \<^bash_function>\<open>classpath\<close> helps to write
   \<^path>\<open>etc/settings\<close> in a portable manner: it refers to library \<^verbatim>\<open>jar\<close>
   files in standard POSIX path notation. On Windows, this is converted to
   native platform format, before invoking Java (\secref{sec:scala-tools}).
 
   \<^medskip>
   There is also an implicit build process for Isabelle/Scala/Java modules,
   based on \<^path>\<open>etc/build.props\<close> within the component directory (see also
   \secref{sec:scala-build}).
 \<close>
 
 
 section \<open>Command-line tools \label{sec:scala-tools}\<close>
 
 subsection \<open>Java Runtime Environment \label{sec:tool-java}\<close>
 
 text \<open>
   The @{tool_def java} tool is a direct wrapper for the Java Runtime
   Environment, within the regular Isabelle settings environment
   (\secref{sec:settings}) and Isabelle classpath. The command line arguments
   are that of the bundled Java distribution: see option \<^verbatim>\<open>-help\<close> in
   particular.
 
   The \<^verbatim>\<open>java\<close> executable is taken from @{setting ISABELLE_JDK_HOME}, according
   to the standard directory layout for regular distributions of OpenJDK.
 
   The shell function \<^bash_function>\<open>isabelle_jdk\<close> allows shell scripts to
   invoke other Java tools robustly (e.g.\ \<^verbatim>\<open>isabelle_jdk jar\<close>), without
   depending on accidental operating system installations.
 \<close>
 
 
 subsection \<open>Scala toplevel \label{sec:tool-scala}\<close>
 
 text \<open>
   The @{tool_def scala} tool is a direct wrapper for the Scala toplevel,
   similar to @{tool java} above. The command line arguments are that of the
   bundled Scala distribution: see option \<^verbatim>\<open>-help\<close> in particular. This allows
   to interact with Isabelle/Scala interactively.
 \<close>
 
 subsubsection \<open>Example\<close>
 
 text \<open>
   Explore the Isabelle system environment in Scala:
   @{verbatim [display, indent = 2] \<open>$ isabelle scala\<close>}
   @{scala [display, indent = 2]
 \<open>import isabelle._
 
 val isabelle_home = Isabelle_System.getenv("ISABELLE_HOME")
 
 val options = Options.init()
 options.bool("browser_info")
 options.string("document")\<close>}
 \<close>
 
 
 subsection \<open>Scala script wrapper\<close>
 
 text \<open>
   The executable @{executable "$ISABELLE_HOME/bin/isabelle_scala_script"}
   allows to run Isabelle/Scala source files stand-alone programs, by using a
   suitable ``hash-bang'' line and executable file permissions. For example:
   @{verbatim [display, indent = 2] \<open>#!/usr/bin/env isabelle_scala_script\<close>}
   @{scala [display, indent = 2]
 \<open>val options = isabelle.Options.init()
 Console.println("browser_info = " + options.bool("browser_info"))
 Console.println("document = " + options.string("document"))\<close>}
 
   This assumes that the executable may be found via the @{setting PATH} from
   the process environment: this is the case when Isabelle settings are active,
   e.g.\ in the context of the main Isabelle tool wrapper
   \secref{sec:isabelle-tool}. Alternatively, the full
   \<^file>\<open>$ISABELLE_HOME/bin/isabelle_scala_script\<close> may be specified in expanded
   form.
 \<close>
 
 
 subsection \<open>Scala compiler \label{sec:tool-scalac}\<close>
 
 text \<open>
   The @{tool_def scalac} tool is a direct wrapper for the Scala compiler; see
   also @{tool scala} above. The command line arguments are that of the
   bundled Scala distribution.
 
   This provides a low-level mechanism to compile further Scala modules,
   depending on existing Isabelle/Scala functionality; the resulting \<^verbatim>\<open>class\<close>
   or \<^verbatim>\<open>jar\<close> files can be added to the Java classpath using the shell function
   \<^bash_function>\<open>classpath\<close>.
 
   A more convenient high-level approach works via \<^path>\<open>etc/build.props\<close>
   (see \secref{sec:scala-build}).
 \<close>
 
 
 section \<open>Isabelle/Scala/Java modules \label{sec:scala-build}\<close>
 
 subsection \<open>Component configuration via \<^path>\<open>etc/build.props\<close>\<close>
 
 text \<open>
   Isabelle components may augment the Isabelle/Scala/Java environment
   declaratively via properties given in \<^path>\<open>etc/build.props\<close> (within the
   component directory). This specifies an output \<^verbatim>\<open>jar\<close> \<^emph>\<open>module\<close>, based on
   Scala or Java \<^emph>\<open>sources\<close>, and arbitrary \<^emph>\<open>resources\<close>. Moreover, a module can
   specify \<^emph>\<open>services\<close> that are subclasses of
   \<^scala_type>\<open>isabelle.Isabelle_System.Service\<close>; these have a particular
   meaning to Isabelle/Scala tools.
 
   Before running a Scala or Java process, the Isabelle system implicitly
   ensures that all provided modules are compiled and packaged (as jars). It is
   also possible to invoke @{tool scala_build} explicitly, with extra options.
 
   \<^medskip>
   The syntax of \<^path>\<open>etc/build.props\<close> follows a regular Java properties
   file\<^footnote>\<open>\<^url>\<open>https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/util/Properties.html#load(java.io.Reader)\<close>\<close>,
   but the encoding is \<^verbatim>\<open>UTF-8\<close>, instead of historic \<^verbatim>\<open>ISO 8859-1\<close> from the API
   documentation.
 
   The subsequent properties are relevant for the Scala/Java build process.
   Most properties are optional: the default is an empty string (or list). File
   names are relative to the main component directory and may refer to Isabelle
   settings variables (e.g. \<^verbatim>\<open>$ISABELLE_HOME\<close>).
 
     \<^item> \<^verbatim>\<open>title\<close> (required) is a human-readable description of the module, used
     in printed messages.
 
     \<^item> \<^verbatim>\<open>module\<close> specifies a \<^verbatim>\<open>jar\<close> file name for the output module, as result
     of the specified sources (and resources). If this is absent (or
     \<^verbatim>\<open>no_build\<close> is set, as described below), there is no implicit build
     process. The contributing sources might be given nonetheless, notably for
     @{tool scala_project} (\secref{sec:tool-scala-project}), which includes
     Scala/Java sources of components, while suppressing \<^verbatim>\<open>jar\<close> modules (to
     avoid duplication of program content).
 
     \<^item> \<^verbatim>\<open>no_build\<close> is a Boolean property, with default \<^verbatim>\<open>false\<close>. If set to
     \<^verbatim>\<open>true\<close>, the implicit build process for the given \<^verbatim>\<open>module\<close> is \<^emph>\<open>omitted\<close>
     --- it is assumed to be provided by other means.
 
     \<^item> \<^verbatim>\<open>scalac_options\<close> and \<^verbatim>\<open>javac_options\<close> augment the default settings
     @{setting_ref ISABELLE_SCALAC_OPTIONS} and @{setting_ref
     ISABELLE_JAVAC_OPTIONS} for this component; option syntax follows the
     regular command-line tools \<^verbatim>\<open>scalac\<close> and \<^verbatim>\<open>javac\<close>, respectively.
 
     \<^item> \<^verbatim>\<open>main\<close> specifies the main entry point for the \<^verbatim>\<open>jar\<close> module. This is
     only relevant for direct invocation like ``\<^verbatim>\<open>java -jar test.jar\<close>''.
 
     \<^item> \<^verbatim>\<open>requirements\<close> is a list of \<^verbatim>\<open>jar\<close> modules that are needed in the
     compilation process, but not provided by the regular classpath (notably
     @{setting ISABELLE_CLASSPATH}).
 
     A \<^emph>\<open>normal entry\<close> refers to a single \<^verbatim>\<open>jar\<close> file name, possibly with
     settings variables as usual. E.g. \<^file>\<open>$ISABELLE_SCALA_JAR\<close> for the main
     \<^file>\<open>$ISABELLE_HOME/lib/classes/isabelle.jar\<close> (especially relevant for
     add-on modules).
 
     A \<^emph>\<open>special entry\<close> is of the form \<^verbatim>\<open>env:\<close>\<open>variable\<close> and refers to a
     settings variable from the Isabelle environment: its value may consist of
     multiple \<^verbatim>\<open>jar\<close> entries (separated by colons). Environment variables are
     not expanded recursively.
 
     \<^item> \<^verbatim>\<open>resources\<close> is a list of files that should be included in the resulting
     \<^verbatim>\<open>jar\<close> file. Each item consists of a pair separated by colon:
     \<open>source\<close>\<^verbatim>\<open>:\<close>\<open>target\<close> means to copy an existing source file (relative to
     the component directory) to the given target file or directory (relative
     to the \<^verbatim>\<open>jar\<close> name space). A \<open>file\<close> specification without colon
     abbreviates \<open>file\<close>\<^verbatim>\<open>:\<close>\<open>file\<close>, i.e. the file is copied while retaining its
     relative path name.
 
     \<^item> \<^verbatim>\<open>sources\<close> is a list of \<^verbatim>\<open>.scala\<close> or \<^verbatim>\<open>.java\<close> files that contribute to
     the specified module. It is possible to use both languages simultaneously:
     the Scala and Java compiler will be invoked consecutively to make this
     work.
 
     \<^item> \<^verbatim>\<open>services\<close> is a list of class names to be registered as Isabelle
     service providers (subclasses of
     \<^scala_type>\<open>isabelle.Isabelle_System.Service\<close>). Internal class names of
     the underlying JVM need to be given: e.g. see method @{scala_method (in
     java.lang.Object) getClass}.
 
     Particular services require particular subclasses: instances are filtered
     according to their dynamic type. For example, class
     \<^scala_type>\<open>isabelle.Isabelle_Scala_Tools\<close> collects Scala command-line
     tools, and class \<^scala_type>\<open>isabelle.Scala.Functions\<close> collects Scala
     functions (\secref{sec:scala-functions}).
 \<close>
 
 
 subsection \<open>Explicit Isabelle/Scala/Java build \label{sec:tool-scala-build}\<close>
 
 text \<open>
   The @{tool_def scala_build} tool explicitly invokes the build process for
   all registered components.
   @{verbatim [display]
 \<open>Usage: isabelle scala_build [OPTIONS]
 
   Options are:
     -f           force fresh build
     -q           quiet mode: suppress stdout/stderr
 
   Build Isabelle/Scala/Java modules of all registered components
   (if required).
 \<close>}
 
   For each registered Isabelle component that provides
   \<^path>\<open>etc/build.props\<close>, the specified output \<^verbatim>\<open>module\<close> is checked against
   the corresponding input \<^verbatim>\<open>requirements\<close>, \<^verbatim>\<open>resources\<close>, \<^verbatim>\<open>sources\<close>. If
   required, there is an automatic build using \<^verbatim>\<open>scalac\<close> or \<^verbatim>\<open>javac\<close> (or both).
   The identity of input files is recorded within the output \<^verbatim>\<open>jar\<close>, using SHA1
   digests in \<^verbatim>\<open>META-INF/isabelle/shasum\<close>.
 
   \<^medskip>
   Option \<^verbatim>\<open>-f\<close> forces a fresh build, regardless of the up-to-date status of
   input files vs. the output module.
 
   \<^medskip>
   Option \<^verbatim>\<open>-q\<close> suppresses all output on stdout/stderr produced by the Scala or
   Java compiler.
 
   \<^medskip> Explicit invocation of @{tool scala_build} mainly serves testing or
   applications with special options: the Isabelle system normally does an
   automatic the build on demand.
 \<close>
 
 
 subsection \<open>Project setup for common Scala IDEs \label{sec:tool-scala-project}\<close>
 
 text \<open>
   The @{tool_def scala_project} tool creates a project configuration for all
   Isabelle/Java/Scala modules specified in components via
   \<^path>\<open>etc/build.props\<close>, together with additional source files given on
   the command-line:
 
   @{verbatim [display]
 \<open>Usage: isabelle scala_project [OPTIONS] [MORE_SOURCES ...]
 
   Options are:
     -D DIR       project directory (default: "$ISABELLE_HOME_USER/scala_project")
     -G           use Gradle as build tool
     -L           make symlinks to original source files
     -M           use Maven as build tool
     -f           force update of existing directory
 
   Setup project for Isabelle/Scala/jEdit --- to support common IDEs such
   as IntelliJ IDEA. Either option -G or -M is mandatory to specify the
   build tool.\<close>}
 
   The generated configuration is for Gradle\<^footnote>\<open>\<^url>\<open>https://gradle.org\<close>\<close> or
   Maven\<^footnote>\<open>\<^url>\<open>https://maven.apache.org\<close>\<close>, but the main purpose is to import it
   into common IDEs like IntelliJ IDEA\<^footnote>\<open>\<^url>\<open>https://www.jetbrains.com/idea\<close>\<close>.
   This allows to explore the sources with static analysis and other hints in
   real-time.
 
   The generated files refer to physical file-system locations, using the path
   notation of the underlying OS platform. Thus the project needs to be
   recreated whenever the Isabelle installation is changed or moved.
 
   \<^medskip>
   Option \<^verbatim>\<open>-G\<close> selects Gradle and \<^verbatim>\<open>-M\<close> selects Maven as Java/Scala build
   tool: either one needs to be specified explicitly. These tools have a
   tendency to break down unexpectedly, so supporting both increases the
   chances that the generated IDE project works properly.
 
   \<^medskip>
   Option \<^verbatim>\<open>-L\<close> produces \<^emph>\<open>symlinks\<close> to the original files: this allows to
   develop Isabelle/Scala/jEdit modules within an external IDE. The default is
   to \<^emph>\<open>copy\<close> source files, so editing them within the IDE has no permanent
   effect on the originals.
 
   \<^medskip>
   Option \<^verbatim>\<open>-D\<close> specifies an explicit project directory, instead of the default
   \<^path>\<open>$ISABELLE_HOME_USER/scala_project\<close>. Option \<^verbatim>\<open>-f\<close> forces an existing
   project directory to be \<^emph>\<open>purged\<close> --- after some sanity checks that it has
   been generated by @{tool "scala_project"} before.
 \<close>
 
 
 subsubsection \<open>Examples\<close>
 
 text \<open>
   Create a project directory and for editing the original sources:
 
   @{verbatim [display] \<open>isabelle scala_project -f -L\<close>}
 
   On Windows, this usually requires Administrator rights, in order to create
   native symlinks.
 \<close>
 
 
 section \<open>Registered Isabelle/Scala functions \label{sec:scala-functions}\<close>
 
 subsection \<open>Defining functions in Isabelle/Scala\<close>
 
 text \<open>
   The service class \<^scala_type>\<open>isabelle.Scala.Functions\<close> collects Scala
   functions of type \<^scala_type>\<open>isabelle.Scala.Fun\<close>: by registering
   instances via \<^verbatim>\<open>services\<close> in \<^path>\<open>etc/build.props\<close>
   (\secref{sec:scala-build}), it becomes possible to invoke Isabelle/Scala
   from Isabelle/ML (see below).
 
   An example is the predefined collection of
   \<^scala_type>\<open>isabelle.Scala.Functions\<close> in
   \<^file>\<open>$ISABELLE_HOME/etc/build.props\<close>. The overall list of registered functions
   is accessible in Isabelle/Scala as
   \<^scala_object>\<open>isabelle.Scala.functions\<close>.
 
   The general class \<^scala_type>\<open>isabelle.Scala.Fun\<close> expects a multi-argument
   / multi-result function
   \<^scala_type>\<open>List[isabelle.Bytes] => List[isabelle.Bytes]\<close>; more common are
   instances of \<^scala_type>\<open>isabelle.Scala.Fun_Strings\<close> for type
   \<^scala_type>\<open>List[String] => List[String]\<close>, or
   \<^scala_type>\<open>isabelle.Scala.Fun_String\<close> for type
   \<^scala_type>\<open>String => String\<close>.
 \<close>
 
 
 subsection \<open>Invoking functions in Isabelle/ML\<close>
 
 text \<open>
   Isabelle/PIDE provides a protocol to invoke registered Scala functions in
   ML: this works both within the Prover IDE and in batch builds.
 
   The subsequent ML antiquotations refer to Scala functions in a
   formally-checked manner.
 
   \begin{matharray}{rcl}
   @{ML_antiquotation_def "scala_function"} & : & \<open>ML_antiquotation\<close> \\
   @{ML_antiquotation_def "scala"} & : & \<open>ML_antiquotation\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     (@{ML_antiquotation scala_function} |
      @{ML_antiquotation scala}) @{syntax embedded}
   \<close>
 
   \<^descr> \<open>@{scala_function name}\<close> inlines the checked function name as ML string
     literal.
 
   \<^descr> \<open>@{scala name}\<close> and \<open>@{scala_thread name}\<close> invoke the checked function via
   the PIDE protocol. In Isabelle/ML this appears as a function of type
   \<^ML_type>\<open>string list -> string list\<close> or \<^ML_type>\<open>string -> string\<close>,
   depending on the definition in Isabelle/Scala. Evaluation is subject to
   interrupts within the ML runtime environment as usual. A \<^scala>\<open>null\<close>
   result in Scala raises an exception \<^ML>\<open>Scala.Null\<close> in ML. The execution
   of \<open>@{scala}\<close> works via a Scala future on a bounded thread farm, while
   \<open>@{scala_thread}\<close> always forks a separate Java/VM thread.
 
   The standard approach of representing datatypes via strings works via XML in
   YXML transfer syntax. See Isabelle/ML operations and modules @{ML
   YXML.string_of_body}, @{ML YXML.parse_body}, @{ML_structure XML.Encode},
   @{ML_structure XML.Decode}; similarly for Isabelle/Scala. Isabelle symbols
   may have to be recoded via Scala operations
   \<^scala_method>\<open>isabelle.Symbol.decode\<close> and
   \<^scala_method>\<open>isabelle.Symbol.encode\<close>.
 \<close>
 
 
 subsubsection \<open>Examples\<close>
 
 text \<open>
   Invoke the predefined Scala function \<^scala_function>\<open>echo\<close>:
 \<close>
 
 ML \<open>
   val s = "test";
   val s' = \<^scala>\<open>echo\<close> s;
   \<^assert> (s = s')
 \<close>
 
 text \<open>
   Let the Scala compiler process some toplevel declarations, producing a list
   of errors:
 \<close>
 
 ML \<open>
   val source = "class A(a: Int, b: Boolean)"
   val errors =
     \<^scala>\<open>scala_toplevel\<close> source
     |> YXML.parse_body
     |> let open XML.Decode in list string end;
 
   \<^assert> (null errors)\<close>
 
 text \<open>
   The above is merely for demonstration. See \<^ML>\<open>Scala_Compiler.toplevel\<close>
   for a more convenient version with builtin decoding and treatment of errors.
 \<close>
 
 
 section \<open>Documenting Isabelle/Scala entities\<close>
 
 text \<open>
   The subsequent document antiquotations help to document Isabelle/Scala
   entities, with formal checking of names against the Isabelle classpath.
 
   \begin{matharray}{rcl}
   @{antiquotation_def "scala"} & : & \<open>antiquotation\<close> \\
   @{antiquotation_def "scala_object"} & : & \<open>antiquotation\<close> \\
   @{antiquotation_def "scala_type"} & : & \<open>antiquotation\<close> \\
   @{antiquotation_def "scala_method"} & : & \<open>antiquotation\<close> \\
   \end{matharray}
 
   \<^rail>\<open>
     (@@{antiquotation scala} | @@{antiquotation scala_object})
       @{syntax embedded}
     ;
     @@{antiquotation scala_type} @{syntax embedded} types
     ;
     @@{antiquotation scala_method} class @{syntax embedded} types args
     ;
     class: ('(' @'in' @{syntax name} types ')')?
     ;
     types: ('[' (@{syntax name} ',' +) ']')?
     ;
     args: ('(' (nat | (('_' | @{syntax name}) + ',')) ')')?
   \<close>
 
   \<^descr> \<open>@{scala s}\<close> is similar to \<open>@{verbatim s}\<close>, but the given source text is
   checked by the Scala compiler as toplevel declaration (without evaluation).
   This allows to write Isabelle/Scala examples that are statically checked.
 
   \<^descr> \<open>@{scala_object x}\<close> checks the given Scala object name (simple value or
   ground module) and prints the result verbatim.
 
   \<^descr> \<open>@{scala_type T[A]}\<close> checks the given Scala type name (with optional type
   parameters) and prints the result verbatim.
 
   \<^descr> \<open>@{scala_method (in c[A]) m[B](n)}\<close> checks the given Scala method \<open>m\<close> in
   the context of class \<open>c\<close>. The method argument slots are either specified by
   a number \<open>n\<close> or by a list of (optional) argument types; this may refer to
   type variables specified for the class or method: \<open>A\<close> or \<open>B\<close> above.
 
   Everything except for the method name \<open>m\<close> is optional. The absence of the
   class context means that this is a static method. The absence of arguments
   with types means that the method can be determined uniquely as \<^verbatim>\<open>(\<close>\<open>m\<close>\<^verbatim>\<open> _)\<close>
   in Scala (no overloading).
 \<close>
 
 
 subsubsection \<open>Examples\<close>
 
 text \<open>
   Miscellaneous Isabelle/Scala entities:
 
     \<^item> object: \<^scala_object>\<open>isabelle.Isabelle_Process\<close>
     \<^item> type without parameter: @{scala_type isabelle.Console_Progress}
     \<^item> type with parameter: @{scala_type List[A]}
     \<^item> static method: \<^scala_method>\<open>isabelle.Isabelle_System.bash\<close>
     \<^item> class and method with type parameters:
       @{scala_method (in List[A]) map[B]("A => B")}
     \<^item> overloaded method with argument type: @{scala_method (in Int) "+" (Int)}
 \<close>
 
 end
diff --git a/src/Doc/System/Server.thy b/src/Doc/System/Server.thy
--- a/src/Doc/System/Server.thy
+++ b/src/Doc/System/Server.thy
@@ -1,1108 +1,1107 @@
 (*:maxLineLen=78:*)
 
 theory Server
 imports Base
 begin
 
 chapter \<open>The Isabelle server\<close>
 
 text \<open>
   An Isabelle session requires at least two processes, which are both rather
   heavy: Isabelle/Scala for the system infrastructure and Isabelle/ML for the
   logic session (e.g.\ HOL). In principle, these processes can be invoked
   directly on the command-line, e.g.\ via @{tool java}, @{tool scala}, @{tool
   process}, @{tool console}, but this approach is inadequate for reactive
   applications that require quick responses from the prover.
 
   In contrast, the Isabelle server exposes Isabelle/Scala as a
   ``terminate-stay-resident'' application that manages multiple logic
   \<^emph>\<open>sessions\<close> and concurrent tasks to use \<^emph>\<open>theories\<close>. This is analogous to
   \<^ML>\<open>Thy_Info.use_theories\<close> in Isabelle/ML, with proper support for
   concurrent invocations.
 
   The client/server arrangement via TCP sockets also opens possibilities for
   remote Isabelle services that are accessed by local applications, e.g.\ via
   an SSH tunnel.
 \<close>
 
 
 section \<open>Command-line tools\<close>
 
 subsection \<open>Server \label{sec:tool-server}\<close>
 
 text \<open>
   The @{tool_def server} tool manages resident server processes:
   @{verbatim [display]
 \<open>Usage: isabelle server [OPTIONS]
 
   Options are:
     -L FILE      logging on FILE
     -c           console interaction with specified server
     -l           list servers (alternative operation)
     -n NAME      explicit server name (default: isabelle)
     -p PORT      explicit server port
     -s           assume existing server, no implicit startup
     -x           exit specified server (alternative operation)
 
   Manage resident Isabelle servers.\<close>}
 
   The main operation of \<^verbatim>\<open>isabelle server\<close> is to ensure that a named server is
   running, either by finding an already running process (according to the
   central database file \<^path>\<open>$ISABELLE_HOME_USER/servers.db\<close>) or by
   becoming itself a new server that accepts connections on a particular TCP
   socket. The server name and its address are printed as initial output line.
   If another server instance is already running, the current
   \<^verbatim>\<open>isabelle server\<close> process will terminate; otherwise, it keeps running as a
   new server process until an explicit \<^verbatim>\<open>shutdown\<close> command is received.
   Further details of the server socket protocol are explained in
   \secref{sec:server-protocol}.
 
   Other server management operations are invoked via options \<^verbatim>\<open>-l\<close> and \<^verbatim>\<open>-x\<close>
   (see below).
 
   \<^medskip>
   Option \<^verbatim>\<open>-n\<close> specifies an alternative server name: at most one process for
   each name may run, but each server instance supports multiple connections
   and logic sessions.
 
   \<^medskip>
   Option \<^verbatim>\<open>-p\<close> specifies an explicit TCP port for the server socket (which is
   always on \<^verbatim>\<open>localhost\<close>): the default is to let the operating system assign a
   free port number.
 
   \<^medskip>
   Option \<^verbatim>\<open>-s\<close> strictly assumes that the specified server process is already
   running, skipping the optional server startup phase.
 
   \<^medskip>
   Option \<^verbatim>\<open>-c\<close> connects the console in/out channels after the initial check
   for a suitable server process. Also note that the @{tool client} tool
   (\secref{sec:tool-client}) provides a command-line editor to interact with
   the server.
 
   \<^medskip>
   Option \<^verbatim>\<open>-L\<close> specifies a log file for exceptional output of internal server
   and session operations.
 
   \<^medskip>
   Operation \<^verbatim>\<open>-l\<close> lists all active server processes with their connection
   details.
 
   \<^medskip>
   Operation \<^verbatim>\<open>-x\<close> exits the specified server process by sending it a
   \<^verbatim>\<open>shutdown\<close> command.
 \<close>
 
 
 subsection \<open>Client \label{sec:tool-client}\<close>
 
 text \<open>
   The @{tool_def client} tool provides console interaction for Isabelle
   servers:
   @{verbatim [display]
 \<open>Usage: isabelle client [OPTIONS]
 
   Options are:
     -n NAME      explicit server name
     -p PORT      explicit server port
 
   Console interaction for Isabelle server (with line-editor).\<close>}
 
   This is a wrapper to \<^verbatim>\<open>isabelle server -s -c\<close> for interactive
   experimentation, which uses @{setting ISABELLE_LINE_EDITOR} if available.
   The server name is sufficient for identification, as the client can
   determine the connection details from the local database of active servers.
 
   \<^medskip>
   Option \<^verbatim>\<open>-n\<close> specifies an explicit server name as in @{tool server}.
 
   \<^medskip>
   Option \<^verbatim>\<open>-p\<close> specifies an explicit server port as in @{tool server}.
 \<close>
 
 
 subsection \<open>Examples\<close>
 
 text \<open>
   Ensure that a particular server instance is running in the background:
   @{verbatim [display] \<open>isabelle server -n test &\<close>}
 
   The first line of output presents the connection details:\<^footnote>\<open>This information
   may be used in other TCP clients, without access to Isabelle/Scala and the
   underlying database of running servers.\<close>
   @{verbatim [display] \<open>server "test" = 127.0.0.1:4711 (password "XYZ")\<close>}
 
   \<^medskip>
   List available server processes:
   @{verbatim [display] \<open>isabelle server -l\<close>}
 
   \<^medskip>
   Connect the command-line client to the above test server:
   @{verbatim [display] \<open>isabelle client -n test\<close>}
 
   Interaction now works on a line-by-line basis, with commands like \<^verbatim>\<open>help\<close> or
   \<^verbatim>\<open>echo\<close>. For example, some JSON values may be echoed like this:
 
   @{verbatim [display]
 \<open>echo 42
 echo [1, 2, 3]
 echo {"a": "text", "b": true, "c": 42}\<close>}
 
   Closing the connection (via CTRL-D) leaves the server running: it is
   possible to reconnect again, and have multiple connections at the same time.
 
   \<^medskip>
   Exit the named server on the command-line:
   @{verbatim [display] \<open>isabelle server -n test -x\<close>}
 \<close>
 
 
 section \<open>Protocol messages \label{sec:server-protocol}\<close>
 
 text \<open>
   The Isabelle server listens on a regular TCP socket, using a line-oriented
   protocol of structured messages. Input \<^emph>\<open>commands\<close> and output \<^emph>\<open>results\<close>
   (via \<^verbatim>\<open>OK\<close> or \<^verbatim>\<open>ERROR\<close>) are strictly alternating on the toplevel, but
   commands may also return a \<^emph>\<open>task\<close> identifier to indicate an ongoing
   asynchronous process that is joined later (via \<^verbatim>\<open>FINISHED\<close> or \<^verbatim>\<open>FAILED\<close>).
   Asynchronous \<^verbatim>\<open>NOTE\<close> messages may occur at any time: they are independent of
   the main command-result protocol.
 
   For example, the synchronous \<^verbatim>\<open>echo\<close> command immediately returns its
   argument as \<^verbatim>\<open>OK\<close> result. In contrast, the asynchronous \<^verbatim>\<open>session_build\<close>
   command returns \<^verbatim>\<open>OK {"task":\<close>\<open>id\<close>\<^verbatim>\<open>}\<close> and continues in the background. It
   will eventually produce \<^verbatim>\<open>FINISHED {"task":\<close>\<open>id\<close>\<^verbatim>\<open>,\<close>\<open>\<dots>\<close>\<^verbatim>\<open>}\<close> or
   \<^verbatim>\<open>FAILED {"task":\<close>\<open>id\<close>\<^verbatim>\<open>,\<close>\<open>\<dots>\<close>\<^verbatim>\<open>}\<close> with the final result. Intermediately, it
   may emit asynchronous messages of the form \<^verbatim>\<open>NOTE {"task":\<close>\<open>id\<close>\<^verbatim>\<open>,\<close>\<open>\<dots>\<close>\<^verbatim>\<open>}\<close>
   to inform about its progress. Due to the explicit task identifier, the
   client can show these messages in the proper context, e.g.\ a GUI window for
   this particular session build job.
 
   \medskip Subsequently, the protocol message formats are described in further
   detail.
 \<close>
 
 
 subsection \<open>Byte messages \label{sec:byte-messages}\<close>
 
 text \<open>
   The client-server connection is a raw byte-channel for bidirectional
   communication, but the Isabelle server always works with messages of a
   particular length. Messages are written as a single chunk that is flushed
   immediately.
 
   Message boundaries are determined as follows:
 
     \<^item> A \<^emph>\<open>short message\<close> consists of a single line: it is a sequence of
     arbitrary bytes excluding CR (13) and LF (10), and terminated by CR-LF or
     just LF.
 
     \<^item> A \<^emph>\<open>long message\<close> starts with a single line consisting of decimal
     digits: these are interpreted as length of the subsequent block of
     arbitrary bytes. A final line-terminator (as above) may be included here,
     but is not required.
 
   Messages in JSON format (see below) always fit on a single line, due to
   escaping of newline characters within string literals. This is convenient
   for interactive experimentation, but it can impact performance for very long
   messages. If the message byte-length is given on the preceding line, the
   server can read the message more efficiently as a single block.
 \<close>
 
 
 subsection \<open>Text messages\<close>
 
 text \<open>
   Messages are read and written as byte streams (with byte lengths), but the
   content is always interpreted as plain text in terms of the UTF-8
   encoding.\<^footnote>\<open>See also the ``UTF-8 Everywhere Manifesto''
   \<^url>\<open>https://utf8everywhere.org\<close>.\<close>
 
   Note that line-endings and other formatting characters are invariant wrt.
   UTF-8 representation of text: thus implementations are free to determine the
   overall message structure before or after applying the text encoding.
 \<close>
 
 
 subsection \<open>Input and output messages \label{sec:input-output-messages}\<close>
 
 text \<open>
   The uniform format for server input and output messages is \<open>name argument\<close>,
   such that:
 
     \<^item> \<open>name\<close> is the longest prefix consisting of ASCII letters, digits,
     ``\<^verbatim>\<open>_\<close>'', ``\<^verbatim>\<open>.\<close>'',
 
     \<^item> the separator between \<open>name\<close> and \<open>argument\<close> is the longest possible
     sequence of ASCII blanks (it could be empty, e.g.\ when the argument
     starts with a quote or bracket),
 
     \<^item> \<open>argument\<close> is the rest of the message without line terminator.
 
   \<^medskip>
   Input messages are sent from the client to the server. Here the \<open>name\<close>
   specifies a \<^emph>\<open>server command\<close>: the list of known commands may be
   retrieved via the \<^verbatim>\<open>help\<close> command.
 
   \<^medskip>
   Output messages are sent from the server to the client. Here the \<open>name\<close>
   specifies the \<^emph>\<open>server reply\<close>, which always has a specific meaning as
   follows:
 
     \<^item> synchronous results: \<^verbatim>\<open>OK\<close> or \<^verbatim>\<open>ERROR\<close>
     \<^item> asynchronous results: \<^verbatim>\<open>FINISHED\<close> or \<^verbatim>\<open>FAILED\<close>
     \<^item> intermediate notifications: \<^verbatim>\<open>NOTE\<close>
 
   \<^medskip>
   The \<open>argument\<close> format is uniform for both input and output messages:
 
     \<^item> empty argument (Scala type \<^verbatim>\<open>Unit\<close>)
     \<^item> XML element in YXML notation (Scala type \<^verbatim>\<open>XML.Elem\<close>)
     \<^item> JSON value (Scala type \<^verbatim>\<open>JSON.T\<close>)
 
   JSON values may consist of objects (records), arrays (lists), strings,
   numbers, bools, or null.\<^footnote>\<open>See also the official specification
   \<^url>\<open>https://www.json.org\<close> and unofficial explorations ``Parsing JSON is a
   Minefield'' \<^url>\<open>http://seriot.ch/parsing_json.php\<close>.\<close> Since JSON requires
   explicit quotes and backslash-escapes to represent arbitrary text, the YXML
   notation for XML trees (\secref{sec:yxml-vs-xml}) works better
   for large messages with a lot of PIDE markup.
 
   Nonetheless, the most common commands use JSON by default: big chunks of
   text (theory sources etc.) are taken from the underlying file-system and
   results are pre-formatted for plain-text output, without PIDE markup
   information. This is a concession to simplicity: the server imitates the
   appearance of command-line tools on top of the Isabelle/PIDE infrastructure.
 \<close>
 
 
 subsection \<open>Initial password exchange\<close>
 
 text \<open>
   Whenever a new client opens the server socket, the initial message needs to
   be its unique password as a single line, without length indication (i.e.\ a
   ``short message'' in the sense of \secref{sec:byte-messages}).
 
   The server replies either with \<^verbatim>\<open>OK\<close> (and some information about the
   Isabelle version) or by silent disconnection of what is considered an
   illegal connection attempt. Note that @{tool client} already presents the
   correct password internally.
 
   Server passwords are created as Universally Unique Identifier (UUID) in
   Isabelle/Scala and stored in a per-user database, with restricted
   file-system access only for the current user. The Isabelle/Scala server
   implementation is careful to expose the password only on private output
   channels, and not on a process command-line (which is accessible to other
   users, e.g.\ via the \<^verbatim>\<open>ps\<close> command).
 \<close>
 
 
 subsection \<open>Synchronous commands\<close>
 
 text \<open>
   A \<^emph>\<open>synchronous command\<close> corresponds to regular function application in
   Isabelle/Scala, with single argument and result (regular or error). Both the
   argument and the result may consist of type \<^verbatim>\<open>Unit\<close>, \<^verbatim>\<open>XML.Elem\<close>, \<^verbatim>\<open>JSON.T\<close>.
   An error result typically consists of a JSON object with error message and
   potentially further result fields (this resembles exceptions in Scala).
 
   These are the protocol exchanges for both cases of command execution:
   \begin{center}
   \begin{tabular}{rl}
   \<^bold>\<open>input:\<close> & \<open>command argument\<close> \\
   (a) regular \<^bold>\<open>output:\<close> & \<^verbatim>\<open>OK\<close> \<open>result\<close> \\
   (b) error \<^bold>\<open>output:\<close> & \<^verbatim>\<open>ERROR\<close> \<open>result\<close> \\
   \end{tabular}
   \end{center}
 \<close>
 
 
 subsection \<open>Asynchronous commands\<close>
 
 text \<open>
   An \<^emph>\<open>asynchronous command\<close> corresponds to an ongoing process that finishes
   or fails eventually, while emitting arbitrary notifications in between.
   Formally, it starts as synchronous command with immediate result \<^verbatim>\<open>OK\<close>
   giving the \<^verbatim>\<open>task\<close> identifier, or an immediate \<^verbatim>\<open>ERROR\<close> that indicates bad
   command syntax. For a running task, the termination is indicated later by
   \<^verbatim>\<open>FINISHED\<close> or \<^verbatim>\<open>FAILED\<close>, together with its ultimate result value.
 
   These are the protocol exchanges for various cases of command task
   execution:
 
   \begin{center}
   \begin{tabular}{rl}
   \<^bold>\<open>input:\<close> & \<open>command argument\<close> \\
   immediate \<^bold>\<open>output:\<close> & \<^verbatim>\<open>OK {"task":\<close>\<open>id\<close>\<^verbatim>\<open>}\<close> \\
   intermediate \<^bold>\<open>output:\<close> & \<^verbatim>\<open>NOTE {"task":\<close>\<open>id\<close>\<^verbatim>\<open>,\<close>\<open>\<dots>\<close>\<^verbatim>\<open>}\<close> \\
   (a) regular \<^bold>\<open>output:\<close> & \<^verbatim>\<open>FINISHED {"task":\<close>\<open>id\<close>\<^verbatim>\<open>,\<close>\<open>\<dots>\<close>\<^verbatim>\<open>}\<close> \\
   (b) error \<^bold>\<open>output:\<close> & \<^verbatim>\<open>FAILED {"task":\<close>\<open>id\<close>\<^verbatim>\<open>,\<close>\<open>\<dots>\<close>\<^verbatim>\<open>}\<close> \\[3ex]
   \<^bold>\<open>input:\<close> & \<open>command argument\<close> \\
   immediate \<^bold>\<open>output:\<close> & \<^verbatim>\<open>ERROR\<close>~\<open>\<dots>\<close> \\
   \end{tabular}
   \end{center}
 
   All asynchronous messages are decorated with the task identifier that was
   revealed in the immediate (synchronous) result. Thus the client can
   invoke further asynchronous commands and still dispatch the resulting stream of
   asynchronous messages properly.
 
   The synchronous command \<^verbatim>\<open>cancel {"task":\<close>~\<open>id\<close>\<^verbatim>\<open>}\<close> tells the specified task
   to terminate prematurely: usually causing a \<^verbatim>\<open>FAILED\<close> result, but this is
   not guaranteed: the cancel event may come too late or the running process
   may just ignore it.
 \<close>
 
 
 section \<open>Types for JSON values \label{sec:json-types}\<close>
 
 text \<open>
   In order to specify concrete JSON types for command arguments and result
   messages, the following type definition language shall be used:
 
   \<^rail>\<open>
     @{syntax type_def}: @'type' @{syntax name} '=' @{syntax type}
     ;
     @{syntax type}: @{syntax name} | @{syntax value} | 'any' | 'null' |
       'bool' | 'int' | 'long' | 'double' | 'string' | '[' @{syntax type} ']' |
       '{' (@{syntax field_type} ',' *) '}' |
       @{syntax type} '\<oplus>' @{syntax type} |
       @{syntax type} '|' @{syntax type} |
       '(' @{syntax type} ')'
     ;
     @{syntax field_type}: @{syntax name} ('?'?) ':' @{syntax type}
   \<close>
 
   This is a simplified variation of TypeScript
   interfaces.\<^footnote>\<open>\<^url>\<open>https://www.typescriptlang.org/docs/handbook/interfaces.html\<close>\<close>
   The meaning of these types is specified wrt. the Isabelle/Scala
   implementation as follows.
 
   \<^item> A \<open>name\<close> refers to a type defined elsewhere. The environment of type
   definitions is given informally: put into proper foundational order, it
   needs to specify a strongly normalizing system of syntactic abbreviations;
   type definitions may not be recursive.
 
   \<^item> A \<open>value\<close> in JSON notation represents the singleton type of the given
   item. For example, the string \<^verbatim>\<open>"error"\<close> can be used as type for a slot that
   is guaranteed to contain that constant.
 
   \<^item> Type \<open>any\<close> is the super type of all other types: it is an untyped slot in
   the specification and corresponds to \<^verbatim>\<open>Any\<close> or \<^verbatim>\<open>JSON.T\<close> in Isabelle/Scala.
 
   \<^item> Type \<open>null\<close> is the type of the improper value \<open>null\<close>; it corresponds to
   type \<^verbatim>\<open>Null\<close> in Scala and is normally not used in Isabelle/Scala.\<^footnote>\<open>See also
   ``Null References: The Billion Dollar Mistake'' by Tony Hoare
   \<^url>\<open>https://www.infoq.com/presentations/Null-References-The-Billion-Dollar-Mistake-Tony-Hoare\<close>.\<close>
 
   \<^item> Type \<open>bool\<close> is the type of the truth values \<^verbatim>\<open>true\<close> and \<^verbatim>\<open>false\<close>; it
   corresponds to \<^verbatim>\<open>Boolean\<close> in Scala.
 
   \<^item> Types \<open>int\<close>, \<open>long\<close>, \<open>double\<close> are specific versions of the generic
   \<open>number\<close> type, corresponding to \<^verbatim>\<open>Int\<close>, \<^verbatim>\<open>Long\<close>, \<^verbatim>\<open>Double\<close> in Scala, but
   \<^verbatim>\<open>Long\<close> is limited to 53 bit precision.\<^footnote>\<open>Implementations of JSON typically
   standardize \<open>number\<close> to \<^verbatim>\<open>Double\<close>, which can absorb \<^verbatim>\<open>Int\<close> faithfully, but
   not all of \<^verbatim>\<open>Long\<close>.\<close>
 
   \<^item> Type \<open>string\<close> represents Unicode text; it corresponds to type \<^verbatim>\<open>String\<close> in
   Scala.
 
   \<^item> Type \<open>[t]\<close> is the array (or list) type over \<open>t\<close>; it corresponds to
   \<^verbatim>\<open>List[t]\<close> in Scala. The list type is co-variant as usual (i.e.\ monotonic
   wrt. the subtype relation).
 
   \<^item> Object types describe the possible content of JSON records, with field
   names and types. A question mark after a field name means that it is
   optional. In Scala this could refer to an explicit type \<^verbatim>\<open>Option[t]\<close>, e.g.\
   \<open>{a: int, b?: string}\<close> corresponding to a Scala case class with arguments
   \<^verbatim>\<open>a: Int\<close>, \<^verbatim>\<open>b: Option[String]\<close>.
 
   Alternatively, optional fields can have a default value. If nothing else is
   specified, a standard ``empty value'' is used for each type, i.e.\ \<^verbatim>\<open>0\<close> for
   the number types, \<^verbatim>\<open>false\<close> for \<open>bool\<close>, or the empty string, array, object
   etc.
 
   Object types are \<^emph>\<open>permissive\<close> in the sense that only the specified field
   names need to conform to the given types, but unspecified fields may be
   present as well.
 
   \<^item> The type expression \<open>t\<^sub>1 \<oplus> t\<^sub>2\<close> only works for two object types with
   disjoint field names: it is the concatenation of the respective @{syntax
   field_type} specifications taken together. For example: \<open>{task: string} \<oplus>
   {ok: bool}\<close> is the equivalent to \<open>{task: string, ok: bool}\<close>.
 
   \<^item> The type expression \<open>t\<^sub>1 | t\<^sub>2\<close> is the disjoint union of two types, either
   one of the two cases may occur.
 
   \<^item> Parentheses \<open>(t)\<close> merely group type expressions syntactically.
 
 
   These types correspond to JSON values in an obvious manner, which is not
   further described here. For example, the JSON array \<^verbatim>\<open>[1, 2, 3]\<close> conforms to
   types \<open>[int]\<close>, \<open>[long]\<close>, \<open>[double]\<close>, \<open>[any]\<close>, \<open>any\<close>.
 
   Note that JSON objects require field names to be quoted, but the type
   language omits quotes for clarity. Thus the object \<^verbatim>\<open>{"a": 42, "b": "xyz"}\<close>
   conforms to the type \<open>{a: int, b: string}\<close>, for example.
 
   \<^medskip>
   The absence of an argument or result is represented by the Scala type
   \<^verbatim>\<open>Unit\<close>: it is written as empty text in the message \<open>argument\<close>
   (\secref{sec:input-output-messages}). This is not part of the JSON language.
 
   Server replies have name tags like \<^verbatim>\<open>OK\<close>, \<^verbatim>\<open>ERROR\<close>: these are used literally
   together with type specifications to indicate the particular name with the
   type of its argument, e.g.\ \<^verbatim>\<open>OK\<close>~\<open>[string]\<close> for a regular result that is a
   list (JSON array) of strings.
 
   \<^bigskip>
   Here are some common type definitions, for use in particular specifications
   of command arguments and results.
 
   \<^item> \<^bold>\<open>type\<close>~\<open>position = {line?: int, offset?: int, end_offset?: int, file?:
   string, id?: long}\<close> describes a source position within Isabelle text. Only
   the \<open>line\<close> and \<open>file\<close> fields make immediate sense to external programs.
   Detailed \<open>offset\<close> and \<open>end_offset\<close> positions are counted according to
-  Isabelle symbols, see \<^ML_type>\<open>Symbol.symbol\<close> in Isabelle/ML @{cite
-  "isabelle-implementation"}. The position \<open>id\<close> belongs to the representation
+  Isabelle symbols, see \<^ML_type>\<open>Symbol.symbol\<close> in Isabelle/ML \<^cite>\<open>"isabelle-implementation"\<close>. The position \<open>id\<close> belongs to the representation
   of command transactions in the Isabelle/PIDE protocol: it normally does not
   occur in externalized positions.
 
   \<^item> \<^bold>\<open>type\<close>~\<open>message = {kind: string, message: string, pos?: position}\<close> where
   the \<open>kind\<close> provides some hint about the role and importance of the message.
   The main message kinds are \<^verbatim>\<open>writeln\<close> (for regular output), \<^verbatim>\<open>warning\<close>,
   \<^verbatim>\<open>error\<close>.
 
   \<^item> \<^bold>\<open>type\<close>~\<open>error_message = {kind:\<close>~\<^verbatim>\<open>"error"\<close>\<open>, message: string}\<close> refers to
   error messages in particular. These occur routinely with \<^verbatim>\<open>ERROR\<close> or
   \<^verbatim>\<open>FAILED\<close> replies, but also as initial command syntax errors (which are
   omitted in the command specifications below).
 
   \<^item> \<^bold>\<open>type\<close>~\<open>theory_progress = {kind:\<close>~\<^verbatim>\<open>"writeln"\<close>\<open>, message: string, theory:
   string, session: string, percentage?: int}\<close> reports formal progress in
   loading theories (e.g.\ when building a session image). Apart from a regular
   output message, it also reveals the formal theory name (e.g.\ \<^verbatim>\<open>"HOL.Nat"\<close>)
   and session name (e.g.\ \<^verbatim>\<open>"HOL"\<close>). Note that some rare theory names lack a
   proper session prefix, e.g.\ theory \<^verbatim>\<open>"Main"\<close> in session \<^verbatim>\<open>"HOL"\<close>. The
   optional percentage has the same meaning as in \<^bold>\<open>type\<close>~\<open>node_status\<close> below.
 
   \<^item> \<^bold>\<open>type\<close>~\<open>timing = {elapsed: double, cpu: double, gc: double}\<close> refers to
   common Isabelle timing information in seconds, usually with a precision of
   three digits after the point (whole milliseconds).
 
   \<^item> \<^bold>\<open>type\<close>~\<open>uuid = string\<close> refers to a Universally Unique Identifier (UUID)
   as plain text.\<^footnote>\<open>See \<^url>\<open>https://www.ietf.org/rfc/rfc4122.txt\<close> and
   \<^url>\<open>https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/util/UUID.html\<close>.\<close> Such
   identifiers are created as private random numbers of the server and only
   revealed to the client that creates a certain resource (e.g.\ task or
   session). A client may disclose this information for use in a different
   client connection: this allows to share sessions between multiple
   connections.
 
   Client commands need to provide syntactically wellformed UUIDs: this is
   trivial to achieve by using only identifiers that have been produced by the
   server beforehand.
 
   \<^item> \<^bold>\<open>type\<close>~\<open>task = {task: uuid}\<close> identifies a newly created asynchronous task
   and thus allows the client to control it by the \<^verbatim>\<open>cancel\<close> command. The same
   task identification is included in all messages produced by this task.
 
   \<^item> \<^bold>\<open>type\<close> \<open>session_id = {session_id: uuid}\<close> identifies a newly created PIDE
   session managed by the server. Sessions are independent of client
   connections and may be shared by different clients, as long as the internal
   session identifier is known.
 
   \<^item> \<^bold>\<open>type\<close> \<open>node = {node_name: string, theory_name: string}\<close> represents the
   internal node name of a theory. The \<open>node_name\<close> is derived from the
   canonical theory file-name (e.g.\ \<^verbatim>\<open>"~~/src/HOL/Examples/Seq.thy"\<close> after
   normalization within the file-system). The \<open>theory_name\<close> is the
   session-qualified theory name (e.g.\ \<^verbatim>\<open>HOL-Examples.Seq\<close>).
 
   \<^item> \<^bold>\<open>type\<close> \<open>node_status = {ok: bool, total: int, unprocessed: int, running:
   int, warned: int, failed: int, finished: int, canceled: bool, consolidated:
   bool, percentage: int}\<close> represents a formal theory node status of the PIDE
   document model as follows.
 
     \<^item> Fields \<open>total\<close>, \<open>unprocessed\<close>, \<open>running\<close>, \<open>warned\<close>, \<open>failed\<close>, \<open>finished\<close>
       account for individual commands within a theory node; \<open>ok\<close> is an
       abstraction for \<open>failed = 0\<close>.
 
     \<^item> The \<open>canceled\<close> flag tells if some command in the theory has been
       spontaneously canceled (by an Interrupt exception that could also
       indicate resource problems).
 
     \<^item> The \<open>consolidated\<close> flag indicates whether the outermost theory command
     structure has finished (or failed) and the final \<^theory_text>\<open>end\<close> command has been
     checked.
 
     \<^item> The \<open>percentage\<close> field tells how far the node has been processed. It
     ranges between 0 and 99 in normal operation, and reaches 100 when the node
     has been formally consolidated as described above.
 \<close>
 
 
 
 section \<open>Server commands and results\<close>
 
 text \<open>
   Here follows an overview of particular Isabelle server commands with their
   results, which are usually represented as JSON values with types according
   to \secref{sec:json-types}. The general format of input and output messages
   is described in \secref{sec:input-output-messages}. The relevant
   Isabelle/Scala source files are:
 
   \<^medskip>
   \begin{tabular}{l}
   \<^file>\<open>$ISABELLE_HOME/src/Pure/Tools/server_commands.scala\<close> \\
   \<^file>\<open>$ISABELLE_HOME/src/Pure/Tools/server.scala\<close> \\
   \<^file>\<open>$ISABELLE_HOME/src/Pure/General/json.scala\<close> \\
   \end{tabular}
 \<close>
 
 
 subsection \<open>Command \<^verbatim>\<open>help\<close>\<close>
 
 text \<open>
   \begin{tabular}{ll}
   regular result: & \<^verbatim>\<open>OK\<close> \<open>[string]\<close> \\
   \end{tabular}
   \<^medskip>
 
   The \<^verbatim>\<open>help\<close> command has no argument and returns the list of server command
   names. This is occasionally useful for interactive experimentation (see also
   @{tool client} in \secref{sec:tool-client}).
 \<close>
 
 
 subsection \<open>Command \<^verbatim>\<open>echo\<close>\<close>
 
 text \<open>
   \begin{tabular}{ll}
   argument: & \<open>any\<close> \\
   regular result: & \<^verbatim>\<open>OK\<close> \<open>any\<close> \\
   \end{tabular}
   \<^medskip>
 
   The \<^verbatim>\<open>echo\<close> command is the identity function: it returns its argument as
   regular result. This is occasionally useful for testing and interactive
   experimentation (see also @{tool client} in \secref{sec:tool-client}).
 
   The Scala type of \<^verbatim>\<open>echo\<close> is actually more general than given above:
   \<^verbatim>\<open>Unit\<close>, \<^verbatim>\<open>XML.Elem\<close>, \<^verbatim>\<open>JSON.T\<close> work uniformly. Note that \<^verbatim>\<open>XML.Elem\<close> might
   be difficult to type on the console in its YXML syntax
   (\secref{sec:yxml-vs-xml}).
 \<close>
 
 
 subsection \<open>Command \<^verbatim>\<open>shutdown\<close>\<close>
 
 text \<open>
   \begin{tabular}{ll}
   regular result: & \<^verbatim>\<open>OK\<close> \\
   \end{tabular}
   \<^medskip>
 
   The \<^verbatim>\<open>shutdown\<close> command has no argument and result value. It forces a
   shutdown of the connected server process, stopping all open sessions and
   closing the server socket. This may disrupt pending commands on other
   connections!
 
   \<^medskip>
   The command-line invocation \<^verbatim>\<open>isabelle server -x\<close> opens a server connection
   and issues a \<^verbatim>\<open>shutdown\<close> command (see also \secref{sec:tool-server}).
 \<close>
 
 
 subsection \<open>Command \<^verbatim>\<open>cancel\<close>\<close>
 
 text \<open>
   \begin{tabular}{ll}
   argument: & \<open>task\<close> \\
   regular result: & \<^verbatim>\<open>OK\<close> \\
   \end{tabular}
   \<^medskip>
 
   The command \<^verbatim>\<open>cancel {"task":\<close>~\<open>id\<close>\<^verbatim>\<open>}\<close> attempts to cancel the specified
   task.
 
   Cancellation is merely a hint that the client prefers an ongoing process to
   be stopped. The command always succeeds formally, but it may get ignored by
   a task that is still running; it might also refer to a non-existing or
   no-longer existing task (without producing an error).
 
   Successful cancellation typically leads to an asynchronous failure of type
   \<^verbatim>\<open>FAILED {\<close>\<open>task: uuid, message:\<close>~\<^verbatim>\<open>"Interrupt"}\<close>. A different message is
   also possible, depending how the task handles the event.
 \<close>
 
 
 subsection \<open>Command \<^verbatim>\<open>session_build\<close> \label{sec:command-session-build}\<close>
 
 text \<open>
   \begin{tabular}{lll}
   argument: & \<open>session_build_args\<close> \\
   immediate result: & \<^verbatim>\<open>OK\<close> \<open>task\<close> \\
   notifications: & \<^verbatim>\<open>NOTE\<close> \<open>task \<oplus> (theory_progress | message)\<close> \\
   regular result: & \<^verbatim>\<open>FINISHED\<close> \<open>task \<oplus> session_build_results\<close> \\
   error result: & \<^verbatim>\<open>FAILED\<close> \<open>task \<oplus> error_message \<oplus> session_build_results\<close> \\[2ex]
   \end{tabular}
 
   \begin{tabular}{lll}
   \<^bold>\<open>type\<close> \<open>session_build_args =\<close> \\
   \quad\<open>{session: string,\<close> \\
   \quad~~\<open>preferences?: string,\<close> & \<^bold>\<open>default:\<close> server preferences \\
   \quad~~\<open>options?: [string],\<close> \\
   \quad~~\<open>dirs?: [string],\<close> \\
   \quad~~\<open>include_sessions: [string],\<close> \\
   \quad~~\<open>verbose?: bool}\<close> \\[2ex]
   \end{tabular}
 
   \begin{tabular}{ll}
   \<^bold>\<open>type\<close> \<open>session_build_result =\<close> \\
   \quad\<open>{session: string,\<close> \\
   \quad~~\<open>ok: bool,\<close> \\
   \quad~~\<open>return_code: int,\<close> \\
   \quad~~\<open>timeout: bool,\<close> \\
   \quad~~\<open>timing: timing}\<close> \\[2ex]
 
   \<^bold>\<open>type\<close> \<open>session_build_results =\<close> \\
   \quad\<open>{ok: bool,\<close> \\
   \quad~~\<open>return_code: int,\<close> \\
   \quad~~\<open>sessions: [session_build_result]}\<close> \\
   \end{tabular}
 \<close>
 
 text \<open>
   The \<^verbatim>\<open>session_build\<close> command prepares a session image for interactive use of
   theories. This is a limited version of command-line tool @{tool build}
   (\secref{sec:tool-build}), with specific options to request a formal context
   for an interactive PIDE session.
 
   The build process is asynchronous, with notifications that inform about the
   progress of loaded theories. Some further informative messages are output as
   well.
 
   Coordination of independent build processes is at the discretion of the
   client (or end-user), just as for @{tool build} and @{tool jedit}. There is
   no built-in coordination of conflicting builds with overlapping hierarchies
   of session images. In the worst case, a session image produced by one task
   may get overwritten by another task!
 \<close>
 
 
 subsubsection \<open>Arguments\<close>
 
 text \<open>
   The \<open>session\<close> field specifies the target session name. The build process
   will produce all required ancestor images according to the overall session
   graph.
 
   \<^medskip>
   The environment of Isabelle system options is determined from \<open>preferences\<close>
   that are augmented by \<open>options\<close>, which is a list individual updates of the
   form the \<open>name\<close>\<^verbatim>\<open>=\<close>\<open>value\<close> or \<open>name\<close> (the latter abbreviates
   \<open>name\<close>\<^verbatim>\<open>=true\<close>); see also command-line option \<^verbatim>\<open>-o\<close> for @{tool build}. The
   preferences are loaded from the file
   \<^path>\<open>$ISABELLE_HOME_USER/etc/preferences\<close> by default, but the client may
   provide alternative contents for it (as text, not a file-name). This could
   be relevant in situations where client and server run in different
   operating-system contexts.
 
   \<^medskip>
   The \<open>dirs\<close> field specifies additional directories for session ROOT and ROOTS
   files (\secref{sec:session-root}). This augments the name space of available
   sessions; see also option \<^verbatim>\<open>-d\<close> in @{tool build}.
 
   \<^medskip>
   The \<open>include_sessions\<close> field specifies sessions whose theories should be
   included in the overall name space of session-qualified theory names. This
   corresponds to a \<^bold>\<open>sessions\<close> specification in ROOT files
   (\secref{sec:session-root}). It enables the \<^verbatim>\<open>use_theories\<close> command
   (\secref{sec:command-use-theories}) to refer to sources from other sessions
   in a robust manner, instead of relying on directory locations.
 
   \<^medskip>
   The \<open>verbose\<close> field set to \<^verbatim>\<open>true\<close> yields extra verbosity. The effect is
   similar to option \<^verbatim>\<open>-v\<close> in @{tool build}.
 \<close>
 
 
 subsubsection \<open>Intermediate output\<close>
 
 text \<open>
   The asynchronous notifications of command \<^verbatim>\<open>session_build\<close> mainly serve as
   progress indicator: the output resembles that of the session build window of
-  Isabelle/jEdit after startup @{cite "isabelle-jedit"}.
+  Isabelle/jEdit after startup \<^cite>\<open>"isabelle-jedit"\<close>.
 
   For the client it is usually sufficient to print the messages in plain text,
   but note that \<open>theory_progress\<close> also reveals formal \<open>theory\<close> and
   \<open>session\<close> names directly.
 \<close>
 
 
 subsubsection \<open>Results\<close>
 
 text \<open>
   The overall \<open>session_build_results\<close> contain both a summary and an entry
   \<open>session_build_result\<close> for each session in the build hierarchy. The result
   is always provided, independently of overall success (\<^verbatim>\<open>FINISHED\<close> task) or
   failure (\<^verbatim>\<open>FAILED\<close> task).
 
   The \<open>ok\<close> field tells abstractly, whether all required session builds came
   out as \<open>ok\<close>, i.e.\ with zero \<open>return_code\<close>. A non-zero \<open>return_code\<close>
   indicates an error according to usual POSIX conventions for process exit.
 
   The individual \<open>session_build_result\<close> entries provide extra fields:
 
   \<^item> \<open>timeout\<close> tells if the build process was aborted after running too long,
 
   \<^item> \<open>timing\<close> gives the overall process timing in the usual Isabelle format
   with elapsed, CPU, GC time.
 \<close>
 
 
 subsubsection \<open>Examples\<close>
 
 text \<open>
   Build of a session image from the Isabelle distribution:
   @{verbatim [display] \<open>session_build {"session": "HOL-Algebra"}\<close>}
 
   Build a session image from the Archive of Formal Proofs:
   @{verbatim [display] \<open>session_build {"session": "Coinductive", "dirs": ["$AFP_BASE/thys"]}\<close>}
 \<close>
 
 
 subsection \<open>Command \<^verbatim>\<open>session_start\<close> \label{sec:command-session-start}\<close>
 
 text \<open>
   \begin{tabular}{lll}
   argument: & \<open>session_build_args \<oplus> {print_mode?: [string]}\<close> \\
   immediate result: & \<^verbatim>\<open>OK\<close> \<open>task\<close> \\
   notifications: & \<^verbatim>\<open>NOTE\<close> \<open>task \<oplus> (theory_progress | message)\<close> \\
   regular result: & \<^verbatim>\<open>FINISHED\<close> \<open>task \<oplus> session_id \<oplus> {tmp_dir: string}\<close> \\
   error result: & \<^verbatim>\<open>FAILED\<close> \<open>task \<oplus> error_message\<close> \\[2ex]
   \end{tabular}
 
   \<^medskip>
   The \<^verbatim>\<open>session_start\<close> command starts a new Isabelle/PIDE session with
   underlying Isabelle/ML process, based on a session image that it produces on
   demand using \<^verbatim>\<open>session_build\<close>. Thus it accepts all \<open>session_build_args\<close> and
   produces similar notifications, but the detailed \<open>session_build_results\<close> are
   omitted.
 
   The session build and startup process is asynchronous: when the task is
   finished, the session remains active for commands, until a \<^verbatim>\<open>session_stop\<close>
   or \<^verbatim>\<open>shutdown\<close> command is sent to the server.
 
   Sessions are independent of client connections: it is possible to start a
   session and later apply \<^verbatim>\<open>use_theories\<close> on different connections, as long as
   the internal session identifier is known: shared theory imports will be used
   only once (and persist until purged explicitly).
 \<close>
 
 
 subsubsection \<open>Arguments\<close>
 
 text \<open>
   Most arguments are shared with \<^verbatim>\<open>session_build\<close>
   (\secref{sec:command-session-build}).
 
   \<^medskip>
   The \<open>print_mode\<close> field adds identifiers of print modes to be made active for
   this session. For example, \<^verbatim>\<open>"print_mode": ["ASCII"]\<close> prefers ASCII
   replacement syntax over mathematical Isabelle symbols. See also option \<^verbatim>\<open>-m\<close>
   in @{tool process} (\secref{sec:tool-process}).
 \<close>
 
 
 subsubsection \<open>Results\<close>
 
 text \<open>
   The \<open>session_id\<close> provides the internal identification of the session object
   within the server process. It can remain active as long as the server is
   running, independently of the current client connection.
 
   \<^medskip>
   The \<open>tmp_dir\<close> field refers to a temporary directory that is specifically
   created for this session and deleted after it has been stopped. This may
   serve as auxiliary file-space for the \<^verbatim>\<open>use_theories\<close> command, but
   concurrent use requires some care in naming temporary files, e.g.\ by
   using sub-directories with globally unique names.
 
   As \<open>tmp_dir\<close> is the default \<open>master_dir\<close> for commands \<^verbatim>\<open>use_theories\<close> and
   \<^verbatim>\<open>purge_theories\<close>, theory files copied there may be used without further
   path specification.
 \<close>
 
 
 subsubsection \<open>Examples\<close>
 
 text \<open>
   Start a default Isabelle/HOL session:
   @{verbatim [display] \<open>session_start {"session": "HOL"}\<close>}
 
   Start a session from the Archive of Formal Proofs:
   @{verbatim [display] \<open>session_start {"session": "Coinductive", "dirs": ["$AFP_BASE/thys"]}\<close>}
 \<close>
 
 
 subsection \<open>Command \<^verbatim>\<open>session_stop\<close>\<close>
 
 text \<open>
   \begin{tabular}{ll}
   argument: & \<open>session_id\<close> \\
   immediate result: & \<^verbatim>\<open>OK\<close> \<open>task\<close> \\
   regular result: & \<^verbatim>\<open>FINISHED\<close> \<open>task \<oplus> session_stop_result\<close> \\
   error result: & \<^verbatim>\<open>FAILED\<close> \<open>task \<oplus> error_message \<oplus> session_stop_result\<close> \\[2ex]
   \end{tabular}
 
   \begin{tabular}{l}
   \<^bold>\<open>type\<close> \<open>session_stop_result = {ok: bool, return_code: int}\<close>
   \end{tabular}
 
   \<^medskip>
   The \<^verbatim>\<open>session_stop\<close> command forces a shutdown of the identified PIDE
   session. This asynchronous tasks usually finishes quickly. Failure only
   happens in unusual situations, according to the return code of the
   underlying Isabelle/ML process.
 \<close>
 
 
 subsubsection \<open>Arguments\<close>
 
 text \<open>
   The \<open>session_id\<close> provides the UUID originally created by the server for this
   session.
 \<close>
 
 
 subsubsection \<open>Results\<close>
 
 text \<open>
   The \<open>ok\<close> field tells abstractly, whether the Isabelle/ML process has
   terminated properly.
 
   The \<open>return_code\<close> field expresses this information according to usual POSIX
   conventions for process exit.
 \<close>
 
 
 subsection \<open>Command \<^verbatim>\<open>use_theories\<close> \label{sec:command-use-theories}\<close>
 
 text \<open>
   \begin{tabular}{ll}
   argument: & \<open>use_theories_arguments\<close> \\
   immediate result: & \<^verbatim>\<open>OK\<close> \<open>task\<close> \\
   regular result: & \<^verbatim>\<open>FINISHED\<close> \<open>use_theories_results\<close> \\
   \end{tabular}
 
   \begin{tabular}{ll}
   \<^bold>\<open>type\<close> \<open>use_theories_arguments =\<close> \\
   \quad\<open>{session_id: uuid,\<close> \\
   \quad~~\<open>theories: [string],\<close> \\
   \quad~~\<open>master_dir?: string,\<close> & \<^bold>\<open>default:\<close> session \<open>tmp_dir\<close> \\
   \quad~~\<open>pretty_margin?: double,\<close> & \<^bold>\<open>default:\<close> \<^verbatim>\<open>76\<close> \\
   \quad~~\<open>unicode_symbols?: bool,\<close> \\
   \quad~~\<open>export_pattern?: string,\<close> \\
   \quad~~\<open>check_delay?: double,\<close>  & \<^bold>\<open>default:\<close> \<^verbatim>\<open>0.5\<close> \\
   \quad~~\<open>check_limit?: int,\<close> \\
   \quad~~\<open>watchdog_timeout?: double,\<close> & \<^bold>\<open>default:\<close> \<^verbatim>\<open>600.0\<close> \\
   \quad~~\<open>nodes_status_delay?: double}\<close>  & \<^bold>\<open>default:\<close> \<^verbatim>\<open>-1.0\<close> \\
   \end{tabular}
 
   \begin{tabular}{ll}
   \<^bold>\<open>type\<close> \<open>export =\<close> \\
   \quad~~\<open>{name: string, base64: bool, body: string}\<close> \\
   \<^bold>\<open>type\<close> \<open>node_results =\<close> \\
   \quad~~\<open>{status: node_status, messages: [message], exports: [export]}\<close> \\
   \<^bold>\<open>type\<close> \<open>nodes_status =\<close> \\
   \quad~~\<open>[node \<oplus> {status: node_status}]\<close> \\
   \<^bold>\<open>type\<close> \<open>use_theories_results =\<close> \\
   \quad\<open>{ok: bool,\<close> \\
   \quad~~\<open>errors: [message],\<close> \\
   \quad~~\<open>nodes: [node \<oplus> node_results]}\<close> \\
   \end{tabular}
 
   \<^medskip>
   The \<^verbatim>\<open>use_theories\<close> command updates the identified session by adding the
   current version of theory files to it, while dependencies are resolved
   implicitly. The command succeeds eventually, when all theories have status
   \<^emph>\<open>terminated\<close> or \<^emph>\<open>consolidated\<close> in the sense of \<open>node_status\<close>
   (\secref{sec:json-types}).
 
   Already used theories persist in the session until purged explicitly
   (\secref{sec:command-purge-theories}). This also means that repeated
   invocations of \<^verbatim>\<open>use_theories\<close> are idempotent: it could make sense to do
   that with different values for \<open>pretty_margin\<close> or \<open>unicode_symbols\<close> to get
   different formatting for \<open>errors\<close> or \<open>messages\<close>.
 
   \<^medskip> A non-empty \<open>export_pattern\<close> means that theory \<open>exports\<close> are retrieved
   (see \secref{sec:tool-export}). An \<open>export\<close> \<open>name\<close> roughly follows
   file-system standards: ``\<^verbatim>\<open>/\<close>'' separated list of base names (excluding
   special names like ``\<^verbatim>\<open>.\<close>'' or ``\<^verbatim>\<open>..\<close>''). The \<open>base64\<close> field specifies the
   format of the \<open>body\<close> string: it is true for a byte vector that cannot be
   represented as plain text in UTF-8 encoding, which means the string needs to
   be decoded as in \<^verbatim>\<open>java.util.Base64.getDecoder.decode(String)\<close>.
 
   \<^medskip> The status of PIDE processing is checked every \<open>check_delay\<close> seconds, and
   bounded by \<open>check_limit\<close> attempts (default: 0, i.e.\ unbounded). A
   \<open>check_limit > 0\<close> effectively specifies a global timeout of \<open>check_delay \<times>
   check_limit\<close> seconds.
 
   \<^medskip> If \<open>watchdog_timeout\<close> is greater than 0, it specifies the timespan (in
   seconds) after the last command status change of Isabelle/PIDE, before
   finishing with a potentially non-terminating or deadlocked execution.
 
   \<^medskip> A non-negative \<open>nodes_status_delay\<close> enables continuous notifications of
   kind \<open>nodes_status\<close>, with a field of name and type \<open>nodes_status\<close>. The time
   interval is specified in seconds; by default it is negative and thus
   disabled.
 \<close>
 
 
 subsubsection \<open>Arguments\<close>
 
 text \<open>
   The \<open>session_id\<close> is the identifier provided by the server, when the session
   was created (possibly on a different client connection).
 
   \<^medskip>
   The \<open>theories\<close> field specifies theory names as in theory \<^theory_text>\<open>imports\<close> or in
   ROOT \<^bold>\<open>theories\<close>.
 
   \<^medskip>
   The \<open>master_dir\<close> field specifies the master directory of imported theories:
   it acts like the ``current working directory'' for locating theory files.
   This is irrelevant for \<open>theories\<close> with an absolute path name (e.g.\
   \<^verbatim>\<open>"~~/src/HOL/Examples/Seq.thy"\<close>) or session-qualified theory name (e.g.\
   \<^verbatim>\<open>"HOL-Examples.Seq"\<close>).
 
   \<^medskip>
   The \<open>pretty_margin\<close> field specifies the line width for pretty-printing. The
   default is suitable for classic console output. Formatting happens at the
   end of \<^verbatim>\<open>use_theories\<close>, when all prover messages are exported to the client.
 
   \<^medskip>
   The \<open>unicode_symbols\<close> field set to \<^verbatim>\<open>true\<close> renders message output for direct
   output on a Unicode capable channel, ideally with the Isabelle fonts as in
   Isabelle/jEdit. The default is to keep the symbolic representation of
   Isabelle text, e.g.\ \<^verbatim>\<open>\<forall>\<close> instead of its rendering as \<open>\<forall>\<close>. This means the
   client needs to perform its own rendering before presenting it to the
   end-user.
 \<close>
 
 
 subsubsection \<open>Results\<close>
 
 text \<open>
   The \<open>ok\<close> field indicates overall success of processing the specified
   theories with all their dependencies.
 
   When \<open>ok\<close> is \<^verbatim>\<open>false\<close>, the \<open>errors\<close> field lists all errors cumulatively
   (including imported theories). The messages contain position information for
   the original theory nodes.
 
   \<^medskip>
   The \<open>nodes\<close> field provides detailed information about each imported theory
   node. The individual fields are as follows:
 
   \<^item> \<open>node_name\<close>: the canonical name for the theory node, based on its
   file-system location;
 
   \<^item> \<open>theory_name\<close>: the logical theory name;
 
   \<^item> \<open>status\<close>: the overall node status, e.g.\ see the visualization in the
-  \<open>Theories\<close> panel of Isabelle/jEdit @{cite "isabelle-jedit"};
+  \<open>Theories\<close> panel of Isabelle/jEdit \<^cite>\<open>"isabelle-jedit"\<close>;
 
   \<^item> \<open>messages\<close>: the main bulk of prover messages produced in this theory
   (with kind \<^verbatim>\<open>writeln\<close>, \<^verbatim>\<open>warning\<close>, \<^verbatim>\<open>error\<close>).
 \<close>
 
 
 subsubsection \<open>Examples\<close>
 
 text \<open>
   Process some example theory from the Isabelle distribution, within the
   context of an already started session for Isabelle/HOL (see also
   \secref{sec:command-session-start}):
   @{verbatim [display] \<open>use_theories {"session_id": ..., "theories": ["~~/src/HOL/Examples/Seq"]}\<close>}
 
   \<^medskip>
   Process some example theories in the context of their (single) parent
   session:
 
   @{verbatim [display] \<open>session_start {"session": "HOL-Library"}
 use_theories {"session_id": ..., "theories": ["~~/src/HOL/Unix/Unix"]}
 session_stop {"session_id": ...}\<close>}
 
   \<^medskip>
   Process some example theories that import other theories via
   session-qualified theory names:
 
   @{verbatim [display] \<open>session_start {"session": "HOL", "include_sessions": ["HOL-Unix"]}
 use_theories {"session_id": ..., "theories": ["HOL-Unix.Unix"]}
 session_stop {"session_id": ...}\<close>}
 \<close>
 
 
 subsection \<open>Command \<^verbatim>\<open>purge_theories\<close> \label{sec:command-purge-theories}\<close>
 
 text \<open>
   \begin{tabular}{ll}
   argument: & \<open>purge_theories_arguments\<close> \\
   regular result: & \<^verbatim>\<open>OK\<close> \<open>purge_theories_result\<close> \\
   \end{tabular}
 
   \begin{tabular}{lll}
   \<^bold>\<open>type\<close> \<open>purge_theories_arguments =\<close> \\
   \quad\<open>{session_id: uuid,\<close> \\
   \quad~~\<open>theories: [string],\<close> \\
   \quad~~\<open>master_dir?: string,\<close> & \<^bold>\<open>default:\<close> session \<open>tmp_dir\<close> \\
   \quad~~\<open>all?: bool}\<close> \\[2ex]
   \end{tabular}
 
   \begin{tabular}{ll}
   \<^bold>\<open>type\<close> \<open>purge_theories_result = {purged: [string]}\<close> \\
   \end{tabular}
 
   \<^medskip>
   The \<^verbatim>\<open>purge_theories\<close> command updates the identified session by removing
   theories that are no longer required: theories that are used in pending
   \<^verbatim>\<open>use_theories\<close> tasks or imported by other theories are retained.
 \<close>
 
 
 subsubsection \<open>Arguments\<close>
 
 text \<open>
   The \<open>session_id\<close> is the identifier provided by the server, when the session
   was created (possibly on a different client connection).
 
   \<^medskip>
   The \<open>theories\<close> field specifies theory names to be purged: imported
   dependencies are \<^emph>\<open>not\<close> completed. Instead it is possible to provide the
   already completed import graph returned by \<^verbatim>\<open>use_theories\<close> as \<open>nodes\<close> /
   \<open>node_name\<close>.
 
   \<^medskip>
   The \<open>master_dir\<close> field specifies the master directory as in \<^verbatim>\<open>use_theories\<close>.
   This is irrelevant, when passing fully-qualified theory node names (e.g.\
   \<open>node_name\<close> from \<open>nodes\<close> in \<open>use_theories_results\<close>).
 
   \<^medskip>
   The \<open>all\<close> field set to \<^verbatim>\<open>true\<close> attempts to purge all presently loaded
   theories.
 \<close>
 
 
 subsubsection \<open>Results\<close>
 
 text \<open>
   The \<open>purged\<close> field gives the theory nodes that were actually removed.
 
   \<^medskip>
   The \<open>retained\<close> field gives the remaining theory nodes, i.e.\ the complement
   of \<open>purged\<close>.
 \<close>
 
 end
diff --git a/src/Doc/System/Sessions.thy b/src/Doc/System/Sessions.thy
--- a/src/Doc/System/Sessions.thy
+++ b/src/Doc/System/Sessions.thy
@@ -1,1011 +1,1011 @@
 (*:maxLineLen=78:*)
 
 theory Sessions
 imports Base
 begin
 
 chapter \<open>Isabelle sessions and build management \label{ch:session}\<close>
 
 text \<open>
   An Isabelle \<^emph>\<open>session\<close> consists of a collection of related theories that may
   be associated with formal documents (\chref{ch:present}). There is also a
   notion of \<^emph>\<open>persistent heap\<close> image to capture the state of a session,
   similar to object-code in compiled programming languages. Thus the concept
   of session resembles that of a ``project'' in common IDE environments, but
   the specific name emphasizes the connection to interactive theorem proving:
   the session wraps-up the results of user-interaction with the prover in a
   persistent form.
 
   Application sessions are built on a given parent session, which may be built
   recursively on other parents. Following this path in the hierarchy
   eventually leads to some major object-logic session like \<open>HOL\<close>, which itself
   is based on \<open>Pure\<close> as the common root of all sessions.
 
   Processing sessions may take considerable time. Isabelle build management
   helps to organize this efficiently. This includes support for parallel build
   jobs, in addition to the multithreaded theory and proof checking that is
   already provided by the prover process itself.
 \<close>
 
 
 section \<open>Session ROOT specifications \label{sec:session-root}\<close>
 
 text \<open>
   Session specifications reside in files called \<^verbatim>\<open>ROOT\<close> within certain
   directories, such as the home locations of registered Isabelle components or
   additional project directories given by the user.
 
   The ROOT file format follows the lexical conventions of the \<^emph>\<open>outer syntax\<close>
-  of Isabelle/Isar, see also @{cite "isabelle-isar-ref"}. This defines common
+  of Isabelle/Isar, see also \<^cite>\<open>"isabelle-isar-ref"\<close>. This defines common
   forms like identifiers, names, quoted strings, verbatim text, nested
   comments etc. The grammar for @{syntax chapter_def}, @{syntax chapter_entry}
   and @{syntax session_entry} is given as syntax diagram below. Each ROOT file
   may contain multiple specifications like this. Chapters help to organize
   browser info (\secref{sec:info}), but have no formal meaning. The default
   chapter is ``\<open>Unsorted\<close>''. Chapter definitions, which are optional, allow to
   associate additional information.
 
-  Isabelle/jEdit @{cite "isabelle-jedit"} includes a simple editing mode
+  Isabelle/jEdit \<^cite>\<open>"isabelle-jedit"\<close> includes a simple editing mode
   \<^verbatim>\<open>isabelle-root\<close> for session ROOT files, which is enabled by default for any
   file of that name.
 
   \<^rail>\<open>
     @{syntax_def chapter_def}: @'chapter_definition' @{syntax name} \<newline>
       groups? description?
     ;
 
     @{syntax_def chapter_entry}: @'chapter' @{syntax name}
     ;
 
     @{syntax_def session_entry}: @'session' @{syntax system_name} groups? dir? '=' \<newline>
       (@{syntax system_name} '+')? description? options? \<newline>
       sessions? directories? (theories*) \<newline>
       (document_theories?) (document_files*) \<newline>
       (export_files*) (export_classpath?)
     ;
     groups: '(' (@{syntax name} +) ')'
     ;
     dir: @'in' @{syntax embedded}
     ;
     description: @'description' @{syntax text}
     ;
     options: @'options' opts
     ;
     opts: '[' ( (@{syntax name} '=' value | @{syntax name}) + ',' ) ']'
     ;
     value: @{syntax name} | @{syntax real}
     ;
     sessions: @'sessions' (@{syntax system_name}+)
     ;
     directories: @'directories' (dir+)
     ;
     theories: @'theories' opts? (theory_entry+)
     ;
     theory_entry: @{syntax system_name} ('(' @'global' ')')?
     ;
     document_theories: @'document_theories' (@{syntax name}+)
     ;
     document_files: @'document_files' ('(' dir ')')? (@{syntax embedded}+)
     ;
     export_files: @'export_files' ('(' dir ')')? ('[' nat ']')? \<newline>
       (@{syntax embedded}+)
     ;
     export_classpath: @'export_classpath' (@{syntax embedded}*)
   \<close>
 
   \<^descr> \isakeyword{chapter{\isacharunderscorekeyword}definition}~\<open>A (groups)\<close>
   associates a collection of groups with chapter \<open>A\<close>. All sessions that belong
   to this chapter will automatically become members of these groups.
 
   \<^descr> \isakeyword{session}~\<open>A = B + body\<close> defines a new session \<open>A\<close> based on
   parent session \<open>B\<close>, with its content given in \<open>body\<close> (imported sessions and
   theories). Note that a parent (like \<open>HOL\<close>) is mandatory in practical
   applications: only Isabelle/Pure can bootstrap itself from nothing.
 
   All such session specifications together describe a hierarchy (graph) of
   sessions, with globally unique names. The new session name \<open>A\<close> should be
   sufficiently long and descriptive to stand on its own in a potentially large
   library.
 
   \<^descr> \isakeyword{session}~\<open>A (groups)\<close> indicates a collection of groups where
   the new session is a member. Group names are uninterpreted and merely follow
   certain conventions. For example, the Isabelle distribution tags some
   important sessions by the group name called ``\<open>main\<close>''. Other projects may
   invent their own conventions, but this requires some care to avoid clashes
   within this unchecked name space.
 
   \<^descr> \isakeyword{session}~\<open>A\<close>~\isakeyword{in}~\<open>dir\<close> specifies an explicit
   directory for this session; by default this is the current directory of the
   \<^verbatim>\<open>ROOT\<close> file.
 
   All theory files are located relatively to the session directory. The prover
   process is run within the same as its current working directory.
 
   \<^descr> \isakeyword{description}~\<open>text\<close> is a free-form description for this
   session (or chapter), e.g. for presentation purposes.
 
   \<^descr> \isakeyword{options}~\<open>[x = a, y = b, z]\<close> defines separate options
   (\secref{sec:system-options}) that are used when processing this session,
   but \<^emph>\<open>without\<close> propagation to child sessions. Note that \<open>z\<close> abbreviates \<open>z =
   true\<close> for Boolean options.
 
   \<^descr> \isakeyword{sessions}~\<open>names\<close> specifies sessions that are \<^emph>\<open>imported\<close> into
   the current name space of theories. This allows to refer to a theory \<open>A\<close>
   from session \<open>B\<close> by the qualified name \<open>B.A\<close> --- although it is loaded again
   into the current ML process, which is in contrast to a theory that is
   already present in the \<^emph>\<open>parent\<close> session.
 
   Theories that are imported from other sessions are excluded from the current
   session document.
 
   \<^descr> \isakeyword{directories}~\<open>dirs\<close> specifies additional directories for
   import of theory files via \isakeyword{theories} within \<^verbatim>\<open>ROOT\<close> or
   \<^theory_text>\<open>imports\<close> within a theory; \<open>dirs\<close> are relative to the main session
   directory (cf.\ \isakeyword{session} \dots \isakeyword{in}~\<open>dir\<close>). These
   directories need to be exclusively assigned to a unique session, without
   implicit sharing of file-system locations.
 
   \<^descr> \isakeyword{theories}~\<open>options names\<close> specifies a block of theories that
   are processed within an environment that is augmented by the given options,
   in addition to the global session options given before. Any number of blocks
   of \isakeyword{theories} may be given. Options are only active for each
   \isakeyword{theories} block separately.
 
   A theory name that is followed by \<open>(\<close>\isakeyword{global}\<open>)\<close> is treated
   literally in other session specifications or theory imports --- the normal
   situation is to qualify theory names by the session name; this ensures
   globally unique names in big session graphs. Global theories are usually the
   entry points to major logic sessions: \<open>Pure\<close>, \<open>Main\<close>, \<open>Complex_Main\<close>,
   \<open>HOLCF\<close>, \<open>IFOL\<close>, \<open>FOL\<close>, \<open>ZF\<close>, \<open>ZFC\<close> etc. Regular Isabelle applications
   should not claim any global theory names.
 
   \<^descr> \isakeyword{document_theories}~\<open>names\<close> specifies theories from other
   sessions that should be included in the generated document source directory.
   These theories need to be explicit imports in the current session, or
   implicit imports from the underlying hierarchy of parent sessions. The
   generated \<^verbatim>\<open>session.tex\<close> file is not affected: the session's {\LaTeX} setup
   needs to \<^verbatim>\<open>\input{\<close>\<open>\<dots>\<close>\<^verbatim>\<open>}\<close> generated \<^verbatim>\<open>.tex\<close> files separately.
 
   \<^descr> \isakeyword{document_files}~\<open>(\<close>\isakeyword{in}~\<open>base_dir) files\<close> lists
   source files for document preparation, typically \<^verbatim>\<open>.tex\<close> and \<^verbatim>\<open>.sty\<close> for
   {\LaTeX}. Only these explicitly given files are copied from the base
   directory to the document output directory, before formal document
   processing is started (see also \secref{sec:tool-document}). The local path
   structure of the \<open>files\<close> is preserved, which allows to reconstruct the
   original directory hierarchy of \<open>base_dir\<close>. The default \<open>base_dir\<close> is
   \<^verbatim>\<open>document\<close> within the session root directory.
 
   \<^descr> \isakeyword{export_files}~\<open>(\<close>\isakeyword{in}~\<open>target_dir) [number]
   patterns\<close> specifies theory exports that may get written to the file-system,
   e.g. via @{tool_ref build} with option \<^verbatim>\<open>-e\<close> (\secref{sec:tool-build}). The
   \<open>target_dir\<close> specification is relative to the session root directory; its
   default is \<^verbatim>\<open>export\<close>. Exports are selected via \<open>patterns\<close> as in @{tool_ref
   export} (\secref{sec:tool-export}). The number given in brackets (default:
   0) specifies the prefix of elements that should be removed from each name:
   it allows to reduce the resulting directory hierarchy at the danger of
   overwriting files due to loss of uniqueness.
 
   \<^descr> \isakeyword{export_classpath}~\<open>patterns\<close> specifies export artifacts that
   should be included into the local Java/Scala classpath of this session
   context. This is only relevant for tools that allow dynamic loading of
   service classes (\secref{sec:scala-build}), while most other Isabelle/Scala
   tools require global configuration during system startup. An empty list of
   \<open>patterns\<close> defaults to \<^verbatim>\<open>"*:classpath/*.jar"\<close>, which fits to the naming
   convention of JAR modules produced by the Isabelle/Isar command
-  \<^theory_text>\<open>scala_build_generated_files\<close> @{cite "isabelle-isar-ref"}.
+  \<^theory_text>\<open>scala_build_generated_files\<close> \<^cite>\<open>"isabelle-isar-ref"\<close>.
 \<close>
 
 
 subsubsection \<open>Examples\<close>
 
 text \<open>
   See \<^file>\<open>~~/src/HOL/ROOT\<close> for a diversity of practically relevant situations,
   although it uses relatively complex quasi-hierarchic naming conventions like
   \<^verbatim>\<open>HOL-SPARK\<close>, \<^verbatim>\<open>HOL-SPARK-Examples\<close>. An alternative is to use unqualified
   names that are relatively long and descriptive, as in the Archive of Formal
   Proofs (\<^url>\<open>https://isa-afp.org\<close>), for example.
 \<close>
 
 
 section \<open>System build options \label{sec:system-options}\<close>
 
 text \<open>
   See \<^file>\<open>~~/etc/options\<close> for the main defaults provided by the Isabelle
-  distribution. Isabelle/jEdit @{cite "isabelle-jedit"} includes a simple
+  distribution. Isabelle/jEdit \<^cite>\<open>"isabelle-jedit"\<close> includes a simple
   editing mode \<^verbatim>\<open>isabelle-options\<close> for this file-format.
 
   The following options are particularly relevant to build Isabelle sessions,
   in particular with document preparation (\chref{ch:present}).
 
     \<^item> @{system_option_def "browser_info"} controls output of HTML browser
     info, see also \secref{sec:info}.
 
     \<^item> @{system_option_def "document"} controls document output for a
     particular session or theory; \<^verbatim>\<open>document=pdf\<close> or \<^verbatim>\<open>document=true\<close> means
     enabled, \<^verbatim>\<open>document=""\<close> or \<^verbatim>\<open>document=false\<close> means disabled (especially
     for particular theories).
 
     \<^item> @{system_option_def "document_output"} specifies an alternative
     directory for generated output of the document preparation system; the
     default is within the @{setting "ISABELLE_BROWSER_INFO"} hierarchy as
     explained in \secref{sec:info}. See also @{tool mkroot}, which generates a
     default configuration with output readily available to the author of the
     document.
 
     \<^item> @{system_option_def "document_echo"} informs about document file names
     during session presentation.
 
     \<^item> @{system_option_def "document_variants"} specifies document variants as
     a colon-separated list of \<open>name=tags\<close> entries. The default name is
     \<^verbatim>\<open>document\<close>, without additional tags.
 
     Tags are specified as a comma separated list of modifier/name pairs and
     tell {\LaTeX} how to interpret certain Isabelle command regions:
     ``\<^verbatim>\<open>+\<close>\<open>foo\<close>'' (or just ``\<open>foo\<close>'') means to keep, ``\<^verbatim>\<open>-\<close>\<open>foo\<close>'' to drop,
     and ``\<^verbatim>\<open>/\<close>\<open>foo\<close>'' to fold text tagged as \<open>foo\<close>. The builtin default is
     equivalent to the tag specification
     ``\<^verbatim>\<open>+document,+theory,+proof,+ML,+visible,-invisible,+important,+unimportant\<close>'';
     see also the {\LaTeX} macros \<^verbatim>\<open>\isakeeptag\<close>, \<^verbatim>\<open>\isadroptag\<close>, and
     \<^verbatim>\<open>\isafoldtag\<close>, in \<^file>\<open>~~/lib/texinputs/isabelle.sty\<close>.
 
     In contrast, \<^verbatim>\<open>document_variants=document:outline=/proof,/ML\<close> indicates
     two documents: the one called \<^verbatim>\<open>document\<close> with default tags, and the other
     called \<^verbatim>\<open>outline\<close> where proofs and ML sections are folded.
 
     Document variant names are just a matter of conventions. It is also
     possible to use different document variant names (without tags) for
     different document root entries, see also \secref{sec:tool-document}.
 
     \<^item> @{system_option_def "document_tags"} specifies alternative command tags
     as a comma-separated list of items: either ``\<open>command\<close>\<^verbatim>\<open>%\<close>\<open>tag\<close>'' for a
     specific command, or ``\<^verbatim>\<open>%\<close>\<open>tag\<close>'' as default for all other commands. This
     is occasionally useful to control the global visibility of commands via
     session options (e.g.\ in \<^verbatim>\<open>ROOT\<close>).
 
     \<^item> @{system_option_def "document_comment_latex"} enables regular {\LaTeX}
     \<^verbatim>\<open>comment.sty\<close>, instead of the historic version for plain {\TeX}
     (default). The latter is much faster, but in conflict with {\LaTeX}
     classes like Dagstuhl
     LIPIcs\<^footnote>\<open>\<^url>\<open>https://github.com/dagstuhl-publishing/styles\<close>\<close>.
 
     \<^item> @{system_option_def "document_bibliography"} explicitly enables the use
     of \<^verbatim>\<open>bibtex\<close>; the default is to check the presence of \<^verbatim>\<open>root.bib\<close>, but it
     could have a different name.
 
     \<^item> @{system_option_def "document_heading_prefix"} specifies a prefix for
     the {\LaTeX} macro names generated from Isar commands like \<^theory_text>\<open>chapter\<close>,
     \<^theory_text>\<open>section\<close> etc. The default is \<^verbatim>\<open>isamarkup\<close>, e.g. \<^theory_text>\<open>section\<close> becomes
     \<^verbatim>\<open>\isamarkupsection\<close>.
 
     \<^item> @{system_option_def "threads"} determines the number of worker threads
     for parallel checking of theories and proofs. The default \<open>0\<close> means that a
     sensible maximum value is determined by the underlying hardware. For
     machines with many cores or with hyperthreading, this sometimes requires
     manual adjustment (on the command-line or within personal settings or
     preferences, not within a session \<^verbatim>\<open>ROOT\<close>).
 
     \<^item> @{system_option_def "condition"} specifies a comma-separated list of
     process environment variables (or Isabelle settings) that are required for
     the subsequent theories to be processed. Conditions are considered
     ``true'' if the corresponding environment value is defined and non-empty.
 
     \<^item> @{system_option_def "timeout"} and @{system_option_def "timeout_scale"}
     specify a real wall-clock timeout for the session as a whole: the two
     values are multiplied and taken as the number of seconds. Typically,
     @{system_option "timeout"} is given for individual sessions, and
     @{system_option "timeout_scale"} as global adjustment to overall hardware
     performance.
 
     The timer is controlled outside the ML process by the JVM that runs
     Isabelle/Scala. Thus it is relatively reliable in canceling processes that
     get out of control, even if there is a deadlock without CPU time usage.
 
     \<^item> @{system_option_def "profiling"} specifies a mode for global ML
     profiling. Possible values are the empty string (disabled), \<^verbatim>\<open>time\<close> for
     \<^ML>\<open>profile_time\<close> and \<^verbatim>\<open>allocations\<close> for \<^ML>\<open>profile_allocations\<close>.
     Results appear near the bottom of the session log file.
 
     \<^item> @{system_option_def system_log} specifies an optional log file for
     low-level messages produced by \<^ML>\<open>Output.system_message\<close> in
     Isabelle/ML; the standard value ``\<^verbatim>\<open>-\<close>'' refers to console progress of the
     build job.
 
     \<^item> @{system_option_def "system_heaps"} determines the directories for
     session heap images: \<^path>\<open>$ISABELLE_HEAPS\<close> is the user directory and
     \<^path>\<open>$ISABELLE_HEAPS_SYSTEM\<close> the system directory (usually within the
     Isabelle application). For \<^verbatim>\<open>system_heaps=false\<close>, heaps are stored in the
     user directory and may be loaded from both directories. For
     \<^verbatim>\<open>system_heaps=true\<close>, store and load happens only in the system directory.
 
   The @{tool_def options} tool prints Isabelle system options. Its
   command-line usage is:
   @{verbatim [display]
 \<open>Usage: isabelle options [OPTIONS] [MORE_OPTIONS ...]
 
   Options are:
     -b           include $ISABELLE_BUILD_OPTIONS
     -g OPTION    get value of OPTION
     -l           list options
     -x FILE      export to FILE in YXML format
 
   Report Isabelle system options, augmented by MORE_OPTIONS given as
   arguments NAME=VAL or NAME.\<close>}
 
   The command line arguments provide additional system options of the form
   \<open>name\<close>\<^verbatim>\<open>=\<close>\<open>value\<close> or \<open>name\<close> for Boolean options.
 
   Option \<^verbatim>\<open>-b\<close> augments the implicit environment of system options by the ones
   of @{setting ISABELLE_BUILD_OPTIONS}, cf.\ \secref{sec:tool-build}.
 
   Option \<^verbatim>\<open>-g\<close> prints the value of the given option. Option \<^verbatim>\<open>-l\<close> lists all
   options with their declaration and current value.
 
   Option \<^verbatim>\<open>-x\<close> specifies a file to export the result in YXML format, instead
   of printing it in human-readable form.
 \<close>
 
 
 section \<open>Invoking the build process \label{sec:tool-build}\<close>
 
 text \<open>
   The @{tool_def build} tool invokes the build process for Isabelle sessions.
   It manages dependencies between sessions, related sources of theories and
   auxiliary files, and target heap images. Accordingly, it runs instances of
   the prover process with optional document preparation. Its command-line
   usage is:\<^footnote>\<open>Isabelle/Scala provides the same functionality via
   \<^scala_method>\<open>isabelle.Build.build\<close>.\<close>
   @{verbatim [display]
 \<open>Usage: isabelle build [OPTIONS] [SESSIONS ...]
 
   Options are:
     -B NAME      include session NAME and all descendants
     -D DIR       include session directory and select its sessions
     -N           cyclic shuffling of NUMA CPU nodes (performance tuning)
     -P DIR       enable HTML/PDF presentation in directory (":" for default)
     -R           refer to requirements of selected sessions
     -S           soft build: only observe changes of sources, not heap images
     -X NAME      exclude sessions from group NAME and all descendants
     -a           select all sessions
     -b           build heap images
     -c           clean build
     -d DIR       include session directory
     -e           export files from session specification into file-system
     -f           fresh build
     -g NAME      select session group NAME
     -j INT       maximum number of parallel jobs (default 1)
     -k KEYWORD   check theory sources for conflicts with proposed keywords
     -l           list session source files
     -n           no build -- take existing build databases
     -o OPTION    override Isabelle system OPTION (via NAME=VAL or NAME)
     -v           verbose
     -x NAME      exclude session NAME and all descendants
 
   Build and manage Isabelle sessions, depending on implicit settings:
 
   ISABELLE_TOOL_JAVA_OPTIONS="..."
   ISABELLE_BUILD_OPTIONS="..."
 
   ML_PLATFORM="..."
   ML_HOME="..."
   ML_SYSTEM="..."
   ML_OPTIONS="..."\<close>}
 
   \<^medskip>
   Isabelle sessions are defined via session ROOT files as described in
   (\secref{sec:session-root}). The totality of sessions is determined by
   collecting such specifications from all Isabelle component directories
   (\secref{sec:components}), augmented by more directories given via options
   \<^verbatim>\<open>-d\<close>~\<open>DIR\<close> on the command line. Each such directory may contain a session
   \<^verbatim>\<open>ROOT\<close> file with several session specifications.
 
   Any session root directory may refer recursively to further directories of
   the same kind, by listing them in a catalog file \<^verbatim>\<open>ROOTS\<close> line-by-line. This
   helps to organize large collections of session specifications, or to make
   \<^verbatim>\<open>-d\<close> command line options persistent (e.g.\ in
   \<^verbatim>\<open>$ISABELLE_HOME_USER/ROOTS\<close>).
 
   \<^medskip>
   The subset of sessions to be managed is determined via individual \<open>SESSIONS\<close>
   given as command-line arguments, or session groups that are given via one or
   more options \<^verbatim>\<open>-g\<close>~\<open>NAME\<close>. Option \<^verbatim>\<open>-a\<close> selects all sessions. The build tool
   takes session dependencies into account: the set of selected sessions is
   completed by including all ancestors.
 
   \<^medskip>
   One or more options \<^verbatim>\<open>-B\<close>~\<open>NAME\<close> specify base sessions to be included (all
   descendants wrt.\ the session parent or import graph).
 
   \<^medskip>
   One or more options \<^verbatim>\<open>-x\<close>~\<open>NAME\<close> specify sessions to be excluded (all
   descendants wrt.\ the session parent or import graph). Option \<^verbatim>\<open>-X\<close> is
   analogous to this, but excluded sessions are specified by session group
   membership.
 
   \<^medskip>
   Option \<^verbatim>\<open>-R\<close> reverses the selection in the sense that it refers to its
   requirements: all ancestor sessions excluding the original selection. This
   allows to prepare the stage for some build process with different options,
   before running the main build itself (without option \<^verbatim>\<open>-R\<close>).
 
   \<^medskip>
   Option \<^verbatim>\<open>-D\<close> is similar to \<^verbatim>\<open>-d\<close>, but selects all sessions that are defined
   in the given directories.
 
   \<^medskip>
   Option \<^verbatim>\<open>-S\<close> indicates a ``soft build'': the selection is restricted to
   those sessions that have changed sources (according to actually imported
   theories). The status of heap images is ignored.
 
   \<^medskip>
   The build process depends on additional options
   (\secref{sec:system-options}) that are passed to the prover eventually. The
   settings variable @{setting_ref ISABELLE_BUILD_OPTIONS} allows to provide
   additional defaults, e.g.\ \<^verbatim>\<open>ISABELLE_BUILD_OPTIONS="document=pdf
   threads=4"\<close>. Moreover, the environment of system build options may be
   augmented on the command line via \<^verbatim>\<open>-o\<close>~\<open>name\<close>\<^verbatim>\<open>=\<close>\<open>value\<close> or \<^verbatim>\<open>-o\<close>~\<open>name\<close>,
   which abbreviates \<^verbatim>\<open>-o\<close>~\<open>name\<close>\<^verbatim>\<open>=true\<close> for Boolean or string options.
   Multiple occurrences of \<^verbatim>\<open>-o\<close> on the command-line are applied in the given
   order.
 
   \<^medskip>
   Option \<^verbatim>\<open>-P\<close> enables PDF/HTML presentation in the given directory, where
   ``\<^verbatim>\<open>-P:\<close>'' refers to the default @{setting_ref ISABELLE_BROWSER_INFO} (or
   @{setting_ref ISABELLE_BROWSER_INFO_SYSTEM}). This applies only to
   explicitly selected sessions; note that option \<^verbatim>\<open>-R\<close> allows to select all
   requirements separately.
 
   \<^medskip>
   Option \<^verbatim>\<open>-b\<close> ensures that heap images are produced for all selected
   sessions. By default, images are only saved for inner nodes of the hierarchy
   of sessions, as required for other sessions to continue later on.
 
   \<^medskip>
   Option \<^verbatim>\<open>-c\<close> cleans the selected sessions (all descendants wrt.\ the session
   parent or import graph) before performing the specified build operation.
 
   \<^medskip>
   Option \<^verbatim>\<open>-e\<close> executes the \isakeyword{export_files} directives from the ROOT
   specification of all explicitly selected sessions: the status of the session
   build database needs to be OK, but the session could have been built
   earlier. Using \isakeyword{export_files}, a session may serve as abstract
   interface for add-on build artefacts, but these are only materialized on
   explicit request: without option \<^verbatim>\<open>-e\<close> there is no effect on the physical
   file-system yet.
 
   \<^medskip>
   Option \<^verbatim>\<open>-f\<close> forces a fresh build of all selected sessions and their
   requirements.
 
   \<^medskip> Option \<^verbatim>\<open>-n\<close> omits the actual build process after the preparatory stage
   (including optional cleanup). The overall return code always the status of
   the set of selected sessions. Add-on builds (like presentation) are run for
   successful sessions, i.e.\ already finished ones.
 
   \<^medskip>
   Option \<^verbatim>\<open>-j\<close> specifies the maximum number of parallel build jobs (prover
   processes). Each prover process is subject to a separate limit of parallel
   worker threads, cf.\ system option @{system_option_ref threads}.
 
   \<^medskip>
   Option \<^verbatim>\<open>-N\<close> enables cyclic shuffling of NUMA CPU nodes. This may help
   performance tuning on Linux servers with separate CPU/memory modules.
 
   \<^medskip>
   Option \<^verbatim>\<open>-v\<close> increases the general level of verbosity.
 
   \<^medskip>
   Option \<^verbatim>\<open>-l\<close> lists the source files that contribute to a session.
 
   \<^medskip>
   Option \<^verbatim>\<open>-k\<close> specifies a newly proposed keyword for outer syntax. It is
   possible to use option \<^verbatim>\<open>-k\<close> repeatedly to check multiple keywords. The
   theory sources are checked for conflicts wrt.\ this hypothetical change of
   syntax, e.g.\ to reveal occurrences of identifiers that need to be quoted.
 \<close>
 
 
 subsubsection \<open>Examples\<close>
 
 text \<open>
   Build a specific logic image:
   @{verbatim [display] \<open>  isabelle build -b HOLCF\<close>}
 
   \<^smallskip>
   Build the main group of logic images:
   @{verbatim [display] \<open>  isabelle build -b -g main\<close>}
 
   \<^smallskip>
   Build all descendants (and requirements) of \<^verbatim>\<open>FOL\<close> and \<^verbatim>\<open>ZF\<close>:
   @{verbatim [display] \<open>  isabelle build -B FOL -B ZF\<close>}
 
   \<^smallskip>
   Build all sessions where sources have changed (ignoring heaps):
   @{verbatim [display] \<open>  isabelle build -a -S\<close>}
 
   \<^smallskip>
   Provide a general overview of the status of all Isabelle sessions, without
   building anything:
   @{verbatim [display] \<open>  isabelle build -a -n -v\<close>}
 
   \<^smallskip>
   Build all sessions with HTML browser info and PDF document preparation:
   @{verbatim [display] \<open>  isabelle build -a -o browser_info -o document\<close>}
 
   \<^smallskip>
   Build all sessions with a maximum of 8 parallel prover processes and 4
   worker threads each (on a machine with many cores):
   @{verbatim [display] \<open>  isabelle build -a -j8 -o threads=4\<close>}
 
   \<^smallskip>
   Build some session images with cleanup of their descendants, while retaining
   their ancestry:
   @{verbatim [display] \<open>  isabelle build -b -c HOL-Library HOL-Algebra\<close>}
 
   \<^smallskip>
   HTML/PDF presentation for sessions that happen to be properly built already,
   without rebuilding anything except the missing browser info:
   @{verbatim [display] \<open>  isabelle build -a -n -o browser_info\<close>}
 
   \<^smallskip>
   Clean all sessions without building anything:
   @{verbatim [display] \<open>  isabelle build -a -n -c\<close>}
 
   \<^smallskip>
   Build all sessions from some other directory hierarchy, according to the
   settings variable \<^verbatim>\<open>AFP\<close> that happens to be defined inside the Isabelle
   environment:
   @{verbatim [display] \<open>  isabelle build -D '$AFP'\<close>}
 
   \<^smallskip>
   Inform about the status of all sessions required for AFP, without building
   anything yet:
   @{verbatim [display] \<open>  isabelle build -D '$AFP' -R -v -n\<close>}
 \<close>
 
 
 section \<open>Print messages from build database \label{sec:tool-log}\<close>
 
 text \<open>
   The @{tool_def "log"} tool prints prover messages from the build
   database of the given session. Its command-line usage is:
 
   @{verbatim [display]
 \<open>Usage: isabelle log [OPTIONS] [SESSIONS ...]
 
   Options are:
     -H REGEX     filter messages by matching against head
     -M REGEX     filter messages by matching against body
     -T NAME      restrict to given theories (multiple options possible)
     -U           output Unicode symbols
     -m MARGIN    margin for pretty printing (default: 76.0)
     -o OPTION    override Isabelle system OPTION (via NAME=VAL or NAME)
     -v           print all messages, including information etc.
 
   Print messages from the build database of the given sessions, without any
   checks against current sources nor session structure: results from old
   sessions or failed builds can be printed as well.
 
   Multiple options -H and -M are conjunctive: all given patterns need to
   match. Patterns match any substring, but ^ or $ may be used to match the
   start or end explicitly.\<close>}
 
   The specified session databases are taken as is, with formal checking
   against current sources: There is \<^emph>\<open>no\<close> implicit build process involved, so
   it is possible to retrieve error messages from a failed session as well. The
   order of messages follows the source positions of source files; thus the
   result is mostly deterministic, independent of the somewhat erratic
   evaluation of parallel processing.
 
   \<^medskip> Option \<^verbatim>\<open>-o\<close> allows to change system options, as in @{tool build}
   (\secref{sec:tool-build}). This may affect the storage space for the build
   database, notably via @{system_option system_heaps}, or @{system_option
   build_database_server} and its relatives.
 
   \<^medskip> Option \<^verbatim>\<open>-T\<close> restricts output to given theories: multiple entries are
   possible by repeating this option on the command-line. The default is to
   refer to \<^emph>\<open>all\<close> theories used in the original session build process.
 
   \<^medskip> Options \<^verbatim>\<open>-m\<close> and \<^verbatim>\<open>-U\<close> modify pretty printing and output of Isabelle
   symbols. The default is for an old-fashioned ASCII terminal at 80 characters
   per line (76 + 4 characters to prefix warnings or errors).
 
   \<^medskip> Option \<^verbatim>\<open>-v\<close> prints all messages from the session database that are
   normally inlined into the source text, including information messages etc.
 
   \<^medskip> Options \<^verbatim>\<open>-H\<close> and \<^verbatim>\<open>-M\<close> filter messages according to their header or body
   content, respectively. The header follows a very basic format that makes it
   easy to match message kinds (e.g. \<^verbatim>\<open>Warning\<close> or \<^verbatim>\<open>Error\<close>) and file names
   (e.g. \<^verbatim>\<open>src/HOL/Nat.thy\<close>). The body is usually pretty-printed, but for
   matching it is treated like one long line: blocks are ignored and breaks are
   turned into plain spaces (according to their formal width).
 
   The syntax for patters follows regular expressions of the Java
   platform.\<^footnote>\<open>\<^url>\<open>https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/util/regex/Pattern.html\<close>\<close>
 \<close>
 
 subsubsection \<open>Examples\<close>
 
 text \<open>
   Print messages from theory \<^verbatim>\<open>HOL.Nat\<close> of session \<^verbatim>\<open>HOL\<close>, using Unicode
   rendering of Isabelle symbols and a margin of 100 characters:
   @{verbatim [display] \<open>  isabelle log -T HOL.Nat -U -m 100 HOL\<close>}
 
   Print warnings about ambiguous input (inner syntax) of session
   \<^verbatim>\<open>HOL-Library\<close>, which is built beforehand:
   @{verbatim [display] \<open>  isabelle build HOL-Library
   isabelle log -H "Warning" -M "Ambiguous input" HOL-Library\<close>}
 
   Print all errors from all sessions, e.g. from a partial build of
   Isabelle/AFP:
   @{verbatim [display] \<open>  isabelle log -H "Error" $(isabelle sessions -a -d AFP/thys)\<close>}
 \<close>
 
 
 section \<open>Retrieve theory exports \label{sec:tool-export}\<close>
 
 text \<open>
   The @{tool_def "export"} tool retrieves theory exports from the session
   database. Its command-line usage is: @{verbatim [display]
 \<open>Usage: isabelle export [OPTIONS] SESSION
 
   Options are:
     -O DIR       output directory for exported files (default: "export")
     -d DIR       include session directory
     -l           list exports
     -n           no build of session
     -o OPTION    override Isabelle system OPTION (via NAME=VAL or NAME)
     -p NUM       prune path of exported files by NUM elements
     -x PATTERN   extract files matching pattern (e.g. "*:**" for all)
 
   List or export theory exports for SESSION: named blobs produced by
   isabelle build. Option -l or -x is required; option -x may be repeated.
 
   The PATTERN language resembles glob patterns in the shell, with ? and *
   (both excluding ":" and "/"), ** (excluding ":"), and [abc] or [^abc],
   and variants {pattern1,pattern2,pattern3}.\<close>}
 
   \<^medskip>
   The specified session is updated via @{tool build}
   (\secref{sec:tool-build}), with the same options \<^verbatim>\<open>-d\<close>, \<^verbatim>\<open>-o\<close>. The option
   \<^verbatim>\<open>-n\<close> suppresses the implicit build process: it means that a potentially
   outdated session database is used!
 
   \<^medskip>
   Option \<^verbatim>\<open>-l\<close> lists all stored exports, with compound names
   \<open>theory\<close>\<^verbatim>\<open>:\<close>\<open>name\<close>.
 
   \<^medskip>
   Option \<^verbatim>\<open>-x\<close> extracts stored exports whose compound name matches the given
   pattern. Note that wild cards ``\<^verbatim>\<open>?\<close>'' and ``\<^verbatim>\<open>*\<close>'' do not match the
   separators ``\<^verbatim>\<open>:\<close>'' and ``\<^verbatim>\<open>/\<close>''; the wild card \<^verbatim>\<open>**\<close> matches over directory
   name hierarchies separated by ``\<^verbatim>\<open>/\<close>''. Thus the pattern ``\<^verbatim>\<open>*:**\<close>'' matches
   \<^emph>\<open>all\<close> theory exports. Multiple options \<^verbatim>\<open>-x\<close> refer to the union of all
   specified patterns.
 
   Option \<^verbatim>\<open>-O\<close> specifies an alternative output directory for option \<^verbatim>\<open>-x\<close>: the
   default is \<^verbatim>\<open>export\<close> within the current directory. Each theory creates its
   own sub-directory hierarchy, using the session-qualified theory name.
 
   Option \<^verbatim>\<open>-p\<close> specifies the number of elements that should be pruned from
   each name: it allows to reduce the resulting directory hierarchy at the
   danger of overwriting files due to loss of uniqueness.
 \<close>
 
 
 section \<open>Dump PIDE session database \label{sec:tool-dump}\<close>
 
 text \<open>
   The @{tool_def "dump"} tool dumps information from the cumulative PIDE
   session database (which is processed on the spot). Its command-line usage
   is: @{verbatim [display]
 \<open>Usage: isabelle dump [OPTIONS] [SESSIONS ...]
 
   Options are:
     -A NAMES     dump named aspects (default: ...)
     -B NAME      include session NAME and all descendants
     -D DIR       include session directory and select its sessions
     -O DIR       output directory for dumped files (default: "dump")
     -R           refer to requirements of selected sessions
     -X NAME      exclude sessions from group NAME and all descendants
     -a           select all sessions
     -b NAME      base logic image (default "Pure")
     -d DIR       include session directory
     -g NAME      select session group NAME
     -o OPTION    override Isabelle system OPTION (via NAME=VAL or NAME)
     -v           verbose
     -x NAME      exclude session NAME and all descendants
 
   Dump cumulative PIDE session database, with the following aspects:
     ...\<close>}
 
   \<^medskip> Options \<^verbatim>\<open>-B\<close>, \<^verbatim>\<open>-D\<close>, \<^verbatim>\<open>-R\<close>, \<^verbatim>\<open>-X\<close>, \<^verbatim>\<open>-a\<close>, \<^verbatim>\<open>-d\<close>, \<^verbatim>\<open>-g\<close>, \<^verbatim>\<open>-x\<close> and the
   remaining command-line arguments specify sessions as in @{tool build}
   (\secref{sec:tool-build}): the cumulative PIDE database of all their loaded
   theories is dumped to the output directory of option \<^verbatim>\<open>-O\<close> (default: \<^verbatim>\<open>dump\<close>
   in the current directory).
 
   \<^medskip> Option \<^verbatim>\<open>-b\<close> specifies an optional base logic image, for improved
   scalability of the PIDE session. Its theories are only processed if it is
   included in the overall session selection.
 
   \<^medskip> Option \<^verbatim>\<open>-o\<close> overrides Isabelle system options as for @{tool build}
   (\secref{sec:tool-build}).
 
   \<^medskip> Option \<^verbatim>\<open>-v\<close> increases the general level of verbosity.
 
   \<^medskip> Option \<^verbatim>\<open>-A\<close> specifies named aspects of the dump, as a comma-separated
   list. The default is to dump all known aspects, as given in the command-line
   usage of the tool. The underlying Isabelle/Scala operation
   \<^scala_method>\<open>isabelle.Dump.dump\<close> takes aspects as user-defined
   operations on the final PIDE state and document version. This allows to
   imitate Prover IDE rendering under program control.
 \<close>
 
 
 subsubsection \<open>Examples\<close>
 
 text \<open>
   Dump all Isabelle/ZF sessions (which are rather small):
   @{verbatim [display] \<open>  isabelle dump -v -B ZF\<close>}
 
   \<^smallskip>
   Dump the quite substantial \<^verbatim>\<open>HOL-Analysis\<close> session, with full bootstrap
   from Isabelle/Pure:
   @{verbatim [display] \<open>  isabelle dump -v HOL-Analysis\<close>}
 
   \<^smallskip>
   Dump all sessions connected to HOL-Analysis, using main Isabelle/HOL as
   basis:
   @{verbatim [display] \<open>  isabelle dump -v -b HOL -B HOL-Analysis\<close>}
 
   This results in uniform PIDE markup for everything, except for the
   Isabelle/Pure bootstrap process itself. Producing that on the spot requires
   several GB of heap space, both for the Isabelle/Scala and Isabelle/ML
   process (in 64bit mode). Here are some relevant settings (\secref{sec:boot})
   for such ambitious applications:
   @{verbatim [display]
 \<open>  ISABELLE_TOOL_JAVA_OPTIONS="-Xms4g -Xmx32g -Xss16m"
   ML_OPTIONS="--minheap 4G --maxheap 32G"
 \<close>}
 \<close>
 
 
 section \<open>Update theory sources based on PIDE markup \label{sec:tool-update}\<close>
 
 text \<open>
   The @{tool_def "update"} tool updates theory sources based on markup that is
   produced by the regular @{tool build} process \secref{sec:tool-build}). Its
   command-line usage is: @{verbatim [display]
 \<open>Usage: isabelle update [OPTIONS] [SESSIONS ...]
 
   Options are:
     -B NAME      include session NAME and all descendants
     -D DIR       include session directory and select its sessions
     -R           refer to requirements of selected sessions
     -X NAME      exclude sessions from group NAME and all descendants
     -a           select all sessions
     -b           build heap images
     -c           clean build
     -d DIR       include session directory
     -f           fresh build
     -g NAME      select session group NAME
     -j INT       maximum number of parallel jobs (default 1)
     -l NAME      additional base logic
     -n           no build -- take existing build databases
     -o OPTION    override Isabelle system OPTION (via NAME=VAL or NAME)
     -u OPT       override "update" option for selected sessions
     -v           verbose
     -x NAME      exclude session NAME and all descendants
 
   Update theory sources based on PIDE markup produced by "isabelle build".\<close>}
 
   \<^medskip> Most options are the same as for @{tool build} (\secref{sec:tool-build}).
 
   \<^medskip> Option \<^verbatim>\<open>-l\<close> specifies one or more base logics: these sessions and their
   ancestors are \<^emph>\<open>excluded\<close> from the update.
 
   \<^medskip> Option \<^verbatim>\<open>-u\<close> refers to specific \<^verbatim>\<open>update\<close> options, by relying on naming
   convention: ``\<^verbatim>\<open>-u\<close>~\<open>OPT\<close>'' is a shortcut for ``\<^verbatim>\<open>-o\<close>~\<^verbatim>\<open>update_\<close>\<open>OPT\<close>''.
 
   \<^medskip> The following \<^verbatim>\<open>update\<close> options are supported:
 
     \<^item> @{system_option_ref update_inner_syntax_cartouches} to update inner
     syntax (types, terms, etc.)~to use cartouches, instead of double-quoted
     strings or atomic identifiers. For example, ``\<^theory_text>\<open>lemma \<doublequote>x =
     x\<doublequote>\<close>'' is replaced by ``\<^theory_text>\<open>lemma \<open>x = x\<close>\<close>'', and ``\<^theory_text>\<open>assume
     A\<close>'' is replaced by ``\<^theory_text>\<open>assume \<open>A\<close>\<close>''.
 
     \<^item> @{system_option update_mixfix_cartouches} to update mixfix templates to
     use cartouches instead of double-quoted strings. For example, ``\<^theory_text>\<open>(infixl
     \<doublequote>+\<doublequote> 65)\<close>'' is replaced by ``\<^theory_text>\<open>(infixl \<open>+\<close>
     65)\<close>''.
 
     \<^item> @{system_option_ref update_control_cartouches} to update antiquotations
     to use the compact form with control symbol and cartouche argument. For
     example, ``\<open>@{term \<doublequote>x + y\<doublequote>}\<close>'' is replaced by
     ``\<open>\<^term>\<open>x + y\<close>\<close>'' (the control symbol is literally \<^verbatim>\<open>\<^term>\<close>.)
 
     \<^item> @{system_option_ref update_path_cartouches} to update file-system paths
     to use cartouches: this depends on language markup provided by semantic
     processing of parsed input.
 
     \<^item> @{system_option_ref update_cite} to update {\LaTeX} \<^verbatim>\<open>\cite\<close> commands
     and old-style \<^verbatim>\<open>@{cite "name"}\<close> document antiquotations.
 
   It is also possible to produce custom updates in Isabelle/ML, by reporting
   \<^ML>\<open>Markup.update\<close> with the precise source position and a replacement
   text. This operation should be made conditional on specific system options,
   similar to the ones above. Searching the above option names in ML sources of
   \<^dir>\<open>$ISABELLE_HOME/src/Pure\<close> provides some examples.
 
   Updates can be in conflict by producing nested or overlapping edits: this
   may require to run @{tool update} multiple times.
 \<close>
 
 
 subsubsection \<open>Examples\<close>
 
 text \<open>
   Update some cartouche notation in all theory sources required for session
   \<^verbatim>\<open>HOL-Analysis\<close> (and ancestors):
 
   @{verbatim [display] \<open>  isabelle update -u mixfix_cartouches HOL-Analysis\<close>}
 
   \<^smallskip> Update the same for all application sessions based on \<^verbatim>\<open>HOL-Analysis\<close>, but
   do not change the underlying \<^verbatim>\<open>HOL\<close> (and \<^verbatim>\<open>Pure\<close>) session:
 
   @{verbatim [display] \<open>  isabelle update -u mixfix_cartouches -l HOL -B HOL-Analysis\<close>}
 
   \<^smallskip> Update all sessions that happen to be properly built beforehand:
 
   @{verbatim [display] \<open>  isabelle update -u mixfix_cartouches -n -a\<close>}
 \<close>
 
 
 section \<open>Explore sessions structure\<close>
 
 text \<open>
   The @{tool_def "sessions"} tool explores the sessions structure. Its
   command-line usage is:
   @{verbatim [display]
 \<open>Usage: isabelle sessions [OPTIONS] [SESSIONS ...]
 
   Options are:
     -B NAME      include session NAME and all descendants
     -D DIR       include session directory and select its sessions
     -R           refer to requirements of selected sessions
     -X NAME      exclude sessions from group NAME and all descendants
     -a           select all sessions
     -b           follow session build dependencies (default: source imports)
     -d DIR       include session directory
     -g NAME      select session group NAME
     -x NAME      exclude session NAME and all descendants
 
   Explore the structure of Isabelle sessions and print result names in
   topological order (on stdout).\<close>}
 
   Arguments and options for session selection resemble @{tool build}
   (\secref{sec:tool-build}).
 \<close>
 
 
 subsubsection \<open>Examples\<close>
 
 text \<open>
   All sessions of the Isabelle distribution:
   @{verbatim [display] \<open>  isabelle sessions -a\<close>}
 
   \<^medskip>
   Sessions that are imported by \<^verbatim>\<open>ZF\<close>:
   @{verbatim [display] \<open>  isabelle sessions ZF\<close>}
 
   \<^medskip>
   Sessions that are required to build \<^verbatim>\<open>ZF\<close>:
   @{verbatim [display] \<open>  isabelle sessions -b ZF\<close>}
 
   \<^medskip>
   Sessions that are based on \<^verbatim>\<open>ZF\<close> (and imported by it):
   @{verbatim [display] \<open>  isabelle sessions -B ZF\<close>}
 
   \<^medskip>
   All sessions of Isabelle/AFP (based in directory \<^path>\<open>AFP\<close>):
   @{verbatim [display] \<open>  isabelle sessions -D AFP/thys\<close>}
 
   \<^medskip>
   Sessions required by Isabelle/AFP (based in directory \<^path>\<open>AFP\<close>):
   @{verbatim [display] \<open>  isabelle sessions -R -D AFP/thys\<close>}
 \<close>
 
 
 section \<open>Synchronize source repositories and session images for Isabelle and AFP\<close>
 
 text \<open>
   The @{tool_def sync} tool synchronizes a local Isabelle and AFP source
   repository, possibly with prebuilt \<^verbatim>\<open>.jar\<close> files and session images. Its
   command-line usage is: @{verbatim [display]
 \<open>Usage: isabelle sync [OPTIONS] TARGET
 
   Options are:
     -A ROOT      include AFP with given root directory (":" for $AFP_BASE)
     -H           purge heaps directory on target
     -I NAME      include session heap image and build database
                  (based on accidental local state)
     -J           preserve *.jar files
     -P           protect spaces in target file names: more robust, less portable
     -S PATH      SSH control path for connection multiplexing
     -T           thorough treatment of file content and directory times
     -a REV       explicit AFP revision (default: state of working directory)
     -n           no changes: dry-run
     -p PORT      SSH port
     -r REV       explicit revision (default: state of working directory)
     -v           verbose
 
   Synchronize Isabelle + AFP repositories, based on "isabelle hg_sync".\<close>}
 
   The approach is to apply @{tool hg_sync} (see \secref{sec:tool-hg-sync}) on
   the underlying Isabelle repository, and an optional AFP repository.
   Consequently, the Isabelle installation needs to be a Mercurial repository
   clone: a regular download of the Isabelle distribution is not sufficient!
 
   On the target side, AFP is placed into @{setting ISABELLE_HOME} as immediate
   sub-directory with the literal name \<^verbatim>\<open>AFP\<close>; thus it can be easily included
   elsewhere, e.g. @{tool build}~\<^verbatim>\<open>-d\<close>~\<^verbatim>\<open>'~~/AFP'\<close> on the remote side.
 
   \<^medskip> Options \<^verbatim>\<open>-P\<close>, \<^verbatim>\<open>-S\<close>, \<^verbatim>\<open>-T\<close>, \<^verbatim>\<open>-n\<close>, \<^verbatim>\<open>-p\<close>, \<^verbatim>\<open>-v\<close> are the same as the
   underlying @{tool hg_sync}.
 
   \<^medskip> Options \<^verbatim>\<open>-r\<close> and \<^verbatim>\<open>-a\<close> are the same as option \<^verbatim>\<open>-r\<close> for @{tool hg_sync},
   but for the Isabelle and AFP repositories, respectively. The AFP version is
   only used if a corresponding repository is given via option \<^verbatim>\<open>-A\<close>, either
   with explicit root directory, or as \<^verbatim>\<open>-A:\<close> to refer to \<^verbatim>\<open>$AFP_BASE\<close> (this
   assumes AFP as component of the local Isabelle installation). If no AFP
   repository is given, an existing \<^verbatim>\<open>AFP\<close> directory on the target remains
   unchanged.
 
   \<^medskip> Option \<^verbatim>\<open>-J\<close> uploads existing \<^verbatim>\<open>.jar\<close> files from the working directory,
   which are usually Isabelle/Scala/Java modules under control of @{tool
   scala_build} via \<^verbatim>\<open>etc/build.props\<close> (see also \secref{sec:scala-build}).
   Thus the dependency management is accurate: bad uploads will be rebuilt
   eventually (or ignored). This might fail for very old Isabelle versions,
   when going into the past via option \<^verbatim>\<open>-r\<close>: here it is better to omit option
   \<^verbatim>\<open>-J\<close> and thus purge \<^verbatim>\<open>.jar\<close> files on the target (because they do not belong
   to the repository).
 
   \<^medskip> Option \<^verbatim>\<open>-I\<close> uploads a collection of session images. The set of \<^verbatim>\<open>-I\<close>
   options specifies the end-points in the session build graph, including all
   required ancestors. The result collection is uploaded using the underlying
   \<^verbatim>\<open>rsync\<close> policies, so unchanged images are not sent again. Session images
   are assembled within the target \<^verbatim>\<open>heaps\<close> directory: this scheme fits
   together with @{tool build}~\<^verbatim>\<open>-o system_heaps\<close>. Images are taken as-is from
   the local Isabelle installation, regardless of option \<^verbatim>\<open>-r\<close>. Upload of bad
   images could waste time and space, but running e.g. @{tool build} on the
   target will check dependencies accurately and rebuild outdated images on
   demand.
 
   \<^medskip> Option \<^verbatim>\<open>-H\<close> tells the underlying \<^verbatim>\<open>rsync\<close> process to purge the \<^verbatim>\<open>heaps\<close>
   directory on the target, before uploading new images via option \<^verbatim>\<open>-I\<close>. The
   default is to work monotonically: old material that is not overwritten
   remains unchanged. Over time, this may lead to unused garbage, due to
   changes in session names or the Poly/ML version. Option \<^verbatim>\<open>-H\<close> helps to avoid
   wasting file-system space.
 \<close>
 
 subsubsection \<open>Examples\<close>
 
 text \<open>
   For quick testing of Isabelle + AFP on a remote machine, upload changed
   sources, jars, and local sessions images for \<^verbatim>\<open>HOL\<close>:
 
   @{verbatim [display] \<open>  isabelle sync -A: -I HOL -J testmachine:test/isabelle_afp\<close>}
   Assuming that the local \<^verbatim>\<open>HOL\<close> hierarchy has been up-to-date, and the local
   and remote ML platforms coincide, a remote @{tool build} will proceed
   without building \<^verbatim>\<open>HOL\<close> again.
 
   \<^medskip> Here is a variation for extra-clean testing of Isabelle + AFP: no option
   \<^verbatim>\<open>-J\<close>, but option \<^verbatim>\<open>-T\<close> to disable the default ``quick check'' of \<^verbatim>\<open>rsync\<close>
   (which only inspects file sizes and date stamps); existing heaps are
   deleted:
   @{verbatim [display] \<open>  isabelle sync -A: -T -H testmachine:test/isabelle_afp\<close>}
 \<close>
 
 end
diff --git a/src/Doc/Tutorial/Advanced/simp2.thy b/src/Doc/Tutorial/Advanced/simp2.thy
--- a/src/Doc/Tutorial/Advanced/simp2.thy
+++ b/src/Doc/Tutorial/Advanced/simp2.thy
@@ -1,188 +1,188 @@
 (*<*)
 theory simp2 imports Main begin
 (*>*)
 
 section\<open>Simplification\<close>
 
 text\<open>\label{sec:simplification-II}\index{simplification|(}
 This section describes features not covered until now.  It also
 outlines the simplification process itself, which can be helpful
 when the simplifier does not do what you expect of it.
 \<close>
 
 subsection\<open>Advanced Features\<close>
 
 subsubsection\<open>Congruence Rules\<close>
 
 text\<open>\label{sec:simp-cong}
 While simplifying the conclusion $Q$
 of $P \Imp Q$, it is legal to use the assumption $P$.
 For $\Imp$ this policy is hardwired, but 
 contextual information can also be made available for other
 operators. For example, \<^prop>\<open>xs = [] --> xs@xs = xs\<close> simplifies to \<^term>\<open>True\<close> because we may use \<^prop>\<open>xs = []\<close> when simplifying \<^prop>\<open>xs@xs =
 xs\<close>. The generation of contextual information during simplification is
 controlled by so-called \bfindex{congruence rules}. This is the one for
 \<open>\<longrightarrow>\<close>:
 @{thm[display]imp_cong[no_vars]}
 It should be read as follows:
 In order to simplify \<^prop>\<open>P-->Q\<close> to \<^prop>\<open>P'-->Q'\<close>,
 simplify \<^prop>\<open>P\<close> to \<^prop>\<open>P'\<close>
 and assume \<^prop>\<open>P'\<close> when simplifying \<^prop>\<open>Q\<close> to \<^prop>\<open>Q'\<close>.
 
 Here are some more examples.  The congruence rules for bounded
 quantifiers supply contextual information about the bound variable:
 @{thm[display,eta_contract=false,margin=60]ball_cong[no_vars]}
 One congruence rule for conditional expressions supplies contextual
 information for simplifying the \<open>then\<close> and \<open>else\<close> cases:
 @{thm[display]if_cong[no_vars]}
 An alternative congruence rule for conditional expressions
 actually \emph{prevents} simplification of some arguments:
 @{thm[display]if_weak_cong[no_vars]}
 Only the first argument is simplified; the others remain unchanged.
 This makes simplification much faster and is faithful to the evaluation
 strategy in programming languages, which is why this is the default
 congruence rule for \<open>if\<close>. Analogous rules control the evaluation of
 \<open>case\<close> expressions.
 
 You can declare your own congruence rules with the attribute \attrdx{cong},
 either globally, in the usual manner,
 \begin{quote}
 \isacommand{declare} \textit{theorem-name} \<open>[cong]\<close>
 \end{quote}
 or locally in a \<open>simp\<close> call by adding the modifier
 \begin{quote}
 \<open>cong:\<close> \textit{list of theorem names}
 \end{quote}
 The effect is reversed by \<open>cong del\<close> instead of \<open>cong\<close>.
 
 \begin{warn}
 The congruence rule @{thm[source]conj_cong}
 @{thm[display]conj_cong[no_vars]}
 \par\noindent
 is occasionally useful but is not a default rule; you have to declare it explicitly.
 \end{warn}
 \<close>
 
 subsubsection\<open>Permutative Rewrite Rules\<close>
 
 text\<open>
 \index{rewrite rules!permutative|bold}%
 An equation is a \textbf{permutative rewrite rule} if the left-hand
 side and right-hand side are the same up to renaming of variables.  The most
 common permutative rule is commutativity: \<^prop>\<open>x+y = y+x\<close>.  Other examples
 include \<^prop>\<open>(x-y)-z = (x-z)-y\<close> in arithmetic and \<^prop>\<open>insert x (insert
 y A) = insert y (insert x A)\<close> for sets. Such rules are problematic because
 once they apply, they can be used forever. The simplifier is aware of this
 danger and treats permutative rules by means of a special strategy, called
 \bfindex{ordered rewriting}: a permutative rewrite
 rule is only applied if the term becomes smaller with respect to a fixed
 lexicographic ordering on terms. For example, commutativity rewrites
 \<^term>\<open>b+a\<close> to \<^term>\<open>a+b\<close>, but then stops because \<^term>\<open>a+b\<close> is strictly
 smaller than \<^term>\<open>b+a\<close>.  Permutative rewrite rules can be turned into
 simplification rules in the usual manner via the \<open>simp\<close> attribute; the
 simplifier recognizes their special status automatically.
 
 Permutative rewrite rules are most effective in the case of
 associative-commutative functions.  (Associativity by itself is not
 permutative.)  When dealing with an AC-function~$f$, keep the
 following points in mind:
 \begin{itemize}\index{associative-commutative function}
   
 \item The associative law must always be oriented from left to right,
   namely $f(f(x,y),z) = f(x,f(y,z))$.  The opposite orientation, if
   used with commutativity, can lead to nontermination.
 
 \item To complete your set of rewrite rules, you must add not just
   associativity~(A) and commutativity~(C) but also a derived rule, {\bf
     left-com\-mut\-ativ\-ity} (LC): $f(x,f(y,z)) = f(y,f(x,z))$.
 \end{itemize}
 Ordered rewriting with the combination of A, C, and LC sorts a term
 lexicographically:
 \[\def\maps#1{~\stackrel{#1}{\leadsto}~}
  f(f(b,c),a) \maps{A} f(b,f(c,a)) \maps{C} f(b,f(a,c)) \maps{LC} f(a,f(b,c)) \]
 
 Note that ordered rewriting for \<open>+\<close> and \<open>*\<close> on numbers is rarely
 necessary because the built-in arithmetic prover often succeeds without
 such tricks.
 \<close>
 
 subsection\<open>How the Simplifier Works\<close>
 
 text\<open>\label{sec:SimpHow}
 Roughly speaking, the simplifier proceeds bottom-up: subterms are simplified
 first.  A conditional equation is only applied if its condition can be
 proved, again by simplification.  Below we explain some special features of
 the rewriting process. 
 \<close>
 
 subsubsection\<open>Higher-Order Patterns\<close>
 
 text\<open>\index{simplification rule|(}
 So far we have pretended the simplifier can deal with arbitrary
 rewrite rules. This is not quite true.  For reasons of feasibility,
 the simplifier expects the
 left-hand side of each rule to be a so-called \emph{higher-order
-pattern}~@{cite "nipkow-patterns"}\indexbold{patterns!higher-order}. 
+pattern}~\<^cite>\<open>"nipkow-patterns"\<close>\indexbold{patterns!higher-order}. 
 This restricts where
 unknowns may occur.  Higher-order patterns are terms in $\beta$-normal
 form.  (This means there are no subterms of the form $(\lambda x. M)(N)$.)  
 Each occurrence of an unknown is of the form
 $\Var{f}~x@1~\dots~x@n$, where the $x@i$ are distinct bound
 variables. Thus all ordinary rewrite rules, where all unknowns are
 of base type, for example @{thm add.assoc}, are acceptable: if an unknown is
 of base type, it cannot have any arguments. Additionally, the rule
 \<open>(\<forall>x. ?P x \<and> ?Q x) = ((\<forall>x. ?P x) \<and> (\<forall>x. ?Q x))\<close> is also acceptable, in
 both directions: all arguments of the unknowns \<open>?P\<close> and
 \<open>?Q\<close> are distinct bound variables.
 
 If the left-hand side is not a higher-order pattern, all is not lost.
 The simplifier will still try to apply the rule provided it
 matches directly: without much $\lambda$-calculus hocus
 pocus.  For example, \<open>(?f ?x \<in> range ?f) = True\<close> rewrites
 \<^term>\<open>g a \<in> range g\<close> to \<^const>\<open>True\<close>, but will fail to match
 \<open>g(h b) \<in> range(\<lambda>x. g(h x))\<close>.  However, you can
 eliminate the offending subterms --- those that are not patterns ---
 by adding new variables and conditions.
 In our example, we eliminate \<open>?f ?x\<close> and obtain
  \<open>?y =
 ?f ?x \<Longrightarrow> (?y \<in> range ?f) = True\<close>, which is fine
 as a conditional rewrite rule since conditions can be arbitrary
 terms.  However, this trick is not a panacea because the newly
 introduced conditions may be hard to solve.
   
 There is no restriction on the form of the right-hand
 sides.  They may not contain extraneous term or type variables, though.
 \<close>
 
 subsubsection\<open>The Preprocessor\<close>
 
 text\<open>\label{sec:simp-preprocessor}
 When a theorem is declared a simplification rule, it need not be a
 conditional equation already.  The simplifier will turn it into a set of
 conditional equations automatically.  For example, \<^prop>\<open>f x =
 g x & h x = k x\<close> becomes the two separate
 simplification rules \<^prop>\<open>f x = g x\<close> and \<^prop>\<open>h x = k x\<close>. In
 general, the input theorem is converted as follows:
 \begin{eqnarray}
 \neg P &\mapsto& P = \hbox{\isa{False}} \nonumber\\
 P \longrightarrow Q &\mapsto& P \Longrightarrow Q \nonumber\\
 P \land Q &\mapsto& P,\ Q \nonumber\\
 \forall x.~P~x &\mapsto& P~\Var{x}\nonumber\\
 \forall x \in A.\ P~x &\mapsto& \Var{x} \in A \Longrightarrow P~\Var{x} \nonumber\\
 \<open>if\<close>\ P\ \<open>then\<close>\ Q\ \<open>else\<close>\ R &\mapsto&
  P \Longrightarrow Q,\ \neg P \Longrightarrow R \nonumber
 \end{eqnarray}
 Once this conversion process is finished, all remaining non-equations
 $P$ are turned into trivial equations $P =\isa{True}$.
 For example, the formula 
 \begin{center}\<^prop>\<open>(p \<longrightarrow> t=u \<and> ~r) \<and> s\<close>\end{center}
 is converted into the three rules
 \begin{center}
 \<^prop>\<open>p \<Longrightarrow> t = u\<close>,\quad  \<^prop>\<open>p \<Longrightarrow> r = False\<close>,\quad  \<^prop>\<open>s = True\<close>.
 \end{center}
 \index{simplification rule|)}
 \index{simplification|)}
 \<close>
 (*<*)
 end
 (*>*)
diff --git a/src/Doc/Tutorial/CTL/Base.thy b/src/Doc/Tutorial/CTL/Base.thy
--- a/src/Doc/Tutorial/CTL/Base.thy
+++ b/src/Doc/Tutorial/CTL/Base.thy
@@ -1,91 +1,91 @@
 (*<*)theory Base imports Main begin(*>*)
 
 section\<open>Case Study: Verified Model Checking\<close>
 
 text\<open>\label{sec:VMC}
 This chapter ends with a case study concerning model checking for 
 Computation Tree Logic (CTL), a temporal logic.
 Model checking is a popular technique for the verification of finite
 state systems (implementations) with respect to temporal logic formulae
-(specifications) @{cite "ClarkeGP-book" and "Huth-Ryan-book"}. Its foundations are set theoretic
+(specifications) \<^cite>\<open>"ClarkeGP-book" and "Huth-Ryan-book"\<close>. Its foundations are set theoretic
 and this section will explore them in HOL\@. This is done in two steps.  First
 we consider a simple modal logic called propositional dynamic
 logic (PDL)\@.  We then proceed to the temporal logic CTL, which is
 used in many real
 model checkers. In each case we give both a traditional semantics (\<open>\<Turnstile>\<close>) and a
 recursive function \<^term>\<open>mc\<close> that maps a formula into the set of all states of
 the system where the formula is valid. If the system has a finite number of
 states, \<^term>\<open>mc\<close> is directly executable: it is a model checker, albeit an
 inefficient one. The main proof obligation is to show that the semantics
 and the model checker agree.
 
 \underscoreon
 
 Our models are \emph{transition systems}:\index{transition systems}
 sets of \emph{states} with
 transitions between them.  Here is a simple example:
 \begin{center}
 \unitlength.5mm
 \thicklines
 \begin{picture}(100,60)
 \put(50,50){\circle{20}}
 \put(50,50){\makebox(0,0){$p,q$}}
 \put(61,55){\makebox(0,0)[l]{$s_0$}}
 \put(44,42){\vector(-1,-1){26}}
 \put(16,18){\vector(1,1){26}}
 \put(57,43){\vector(1,-1){26}}
 \put(10,10){\circle{20}}
 \put(10,10){\makebox(0,0){$q,r$}}
 \put(-1,15){\makebox(0,0)[r]{$s_1$}}
 \put(20,10){\vector(1,0){60}}
 \put(90,10){\circle{20}}
 \put(90,10){\makebox(0,0){$r$}}
 \put(98, 5){\line(1,0){10}}
 \put(108, 5){\line(0,1){10}}
 \put(108,15){\vector(-1,0){10}}
 \put(91,21){\makebox(0,0)[bl]{$s_2$}}
 \end{picture}
 \end{center}
 Each state has a unique name or number ($s_0,s_1,s_2$), and in each state
 certain \emph{atomic propositions} ($p,q,r$) hold.  The aim of temporal logic
 is to formalize statements such as ``there is no path starting from $s_2$
 leading to a state where $p$ or $q$ holds,'' which is true, and ``on all paths
 starting from $s_0$, $q$ always holds,'' which is false.
 
 Abstracting from this concrete example, we assume there is a type of
 states:
 \<close>
 
 typedecl state
 
 text\<open>\noindent
 Command \commdx{typedecl} merely declares a new type but without
 defining it (see \S\ref{sec:typedecl}). Thus we know nothing
 about the type other than its existence. That is exactly what we need
 because \<^typ>\<open>state\<close> really is an implicit parameter of our model.  Of
 course it would have been more generic to make \<^typ>\<open>state\<close> a type
 parameter of everything but declaring \<^typ>\<open>state\<close> globally as above
 reduces clutter.  Similarly we declare an arbitrary but fixed
 transition system, i.e.\ a relation between states:
 \<close>
 
 consts M :: "(state \<times> state)set"
 
 text\<open>\noindent
 This is Isabelle's way of declaring a constant without defining it.
 Finally we introduce a type of atomic propositions
 \<close>
 
 typedecl "atom"
 
 text\<open>\noindent
 and a \emph{labelling function}
 \<close>
 
 consts L :: "state \<Rightarrow> atom set"
 
 text\<open>\noindent
 telling us which atomic propositions are true in each state.
 \<close>
 
 (*<*)end(*>*)
diff --git a/src/Doc/Tutorial/CTL/CTL.thy b/src/Doc/Tutorial/CTL/CTL.thy
--- a/src/Doc/Tutorial/CTL/CTL.thy
+++ b/src/Doc/Tutorial/CTL/CTL.thy
@@ -1,449 +1,449 @@
 (*<*)theory CTL imports Base begin(*>*)
 
 subsection\<open>Computation Tree Logic --- CTL\<close>
 
 text\<open>\label{sec:CTL}
 \index{CTL|(}%
 The semantics of PDL only needs reflexive transitive closure.
 Let us be adventurous and introduce a more expressive temporal operator.
 We extend the datatype
 \<open>formula\<close> by a new constructor
 \<close>
 (*<*)
 datatype formula = Atom "atom"
                   | Neg formula
                   | And formula formula
                   | AX formula
                   | EF formula(*>*)
                   | AF formula
 
 text\<open>\noindent
 which stands for ``\emph{A}lways in the \emph{F}uture'':
 on all infinite paths, at some point the formula holds.
 Formalizing the notion of an infinite path is easy
 in HOL: it is simply a function from \<^typ>\<open>nat\<close> to \<^typ>\<open>state\<close>.
 \<close>
 
 definition Paths :: "state \<Rightarrow> (nat \<Rightarrow> state)set" where
 "Paths s \<equiv> {p. s = p 0 \<and> (\<forall>i. (p i, p(i+1)) \<in> M)}"
 
 text\<open>\noindent
 This definition allows a succinct statement of the semantics of \<^const>\<open>AF\<close>:
 \footnote{Do not be misled: neither datatypes nor recursive functions can be
 extended by new constructors or equations. This is just a trick of the
 presentation (see \S\ref{sec:doc-prep-suppress}). In reality one has to define
 a new datatype and a new function.}
 \<close>
 (*<*)
 primrec valid :: "state \<Rightarrow> formula \<Rightarrow> bool" ("(_ \<Turnstile> _)" [80,80] 80) where
 "s \<Turnstile> Atom a  =  (a \<in> L s)" |
 "s \<Turnstile> Neg f   = (~(s \<Turnstile> f))" |
 "s \<Turnstile> And f g = (s \<Turnstile> f \<and> s \<Turnstile> g)" |
 "s \<Turnstile> AX f    = (\<forall>t. (s,t) \<in> M \<longrightarrow> t \<Turnstile> f)" |
 "s \<Turnstile> EF f    = (\<exists>t. (s,t) \<in> M\<^sup>* \<and> t \<Turnstile> f)" |
 (*>*)
 "s \<Turnstile> AF f    = (\<forall>p \<in> Paths s. \<exists>i. p i \<Turnstile> f)"
 
 text\<open>\noindent
 Model checking \<^const>\<open>AF\<close> involves a function which
 is just complicated enough to warrant a separate definition:
 \<close>
 
 definition af :: "state set \<Rightarrow> state set \<Rightarrow> state set" where
 "af A T \<equiv> A \<union> {s. \<forall>t. (s, t) \<in> M \<longrightarrow> t \<in> T}"
 
 text\<open>\noindent
 Now we define \<^term>\<open>mc(AF f)\<close> as the least set \<^term>\<open>T\<close> that includes
 \<^term>\<open>mc f\<close> and all states all of whose direct successors are in \<^term>\<open>T\<close>:
 \<close>
 (*<*)
 primrec mc :: "formula \<Rightarrow> state set" where
 "mc(Atom a)  = {s. a \<in> L s}" |
 "mc(Neg f)   = -mc f" |
 "mc(And f g) = mc f \<inter> mc g" |
 "mc(AX f)    = {s. \<forall>t. (s,t) \<in> M  \<longrightarrow> t \<in> mc f}" |
 "mc(EF f)    = lfp(\<lambda>T. mc f \<union> M\<inverse> `` T)"|(*>*)
 "mc(AF f)    = lfp(af(mc f))"
 
 text\<open>\noindent
 Because \<^const>\<open>af\<close> is monotone in its second argument (and also its first, but
 that is irrelevant), \<^term>\<open>af A\<close> has a least fixed point:
 \<close>
 
 lemma mono_af: "mono(af A)"
 apply(simp add: mono_def af_def)
 apply blast
 done
 (*<*)
 lemma mono_ef: "mono(\<lambda>T. A \<union> M\<inverse> `` T)"
 apply(rule monoI)
 by(blast)
 
 lemma EF_lemma:
   "lfp(\<lambda>T. A \<union> M\<inverse> `` T) = {s. \<exists>t. (s,t) \<in> M\<^sup>* \<and> t \<in> A}"
 apply(rule equalityI)
  apply(rule subsetI)
  apply(simp)
  apply(erule lfp_induct_set)
   apply(rule mono_ef)
  apply(simp)
  apply(blast intro: rtrancl_trans)
 apply(rule subsetI)
 apply(simp, clarify)
 apply(erule converse_rtrancl_induct)
  apply(subst lfp_unfold[OF mono_ef])
  apply(blast)
 apply(subst lfp_unfold[OF mono_ef])
 by(blast)
 (*>*)
 text\<open>
 All we need to prove now is  \<^prop>\<open>mc(AF f) = {s. s \<Turnstile> AF f}\<close>, which states
 that \<^term>\<open>mc\<close> and \<open>\<Turnstile>\<close> agree for \<^const>\<open>AF\<close>\@.
 This time we prove the two inclusions separately, starting
 with the easy one:
 \<close>
 
 theorem AF_lemma1: "lfp(af A) \<subseteq> {s. \<forall>p \<in> Paths s. \<exists>i. p i \<in> A}"
 
 txt\<open>\noindent
 In contrast to the analogous proof for \<^const>\<open>EF\<close>, and just
 for a change, we do not use fixed point induction.  Park-induction,
 named after David Park, is weaker but sufficient for this proof:
 \begin{center}
 @{thm lfp_lowerbound[of _ "S",no_vars]} \hfill (@{thm[source]lfp_lowerbound})
 \end{center}
 The instance of the premise \<^prop>\<open>f S \<subseteq> S\<close> is proved pointwise,
 a decision that \isa{auto} takes for us:
 \<close>
 apply(rule lfp_lowerbound)
 apply(auto simp add: af_def Paths_def)
 
 txt\<open>
 @{subgoals[display,indent=0,margin=70,goals_limit=1]}
 In this remaining case, we set \<^term>\<open>t\<close> to \<^term>\<open>p(1::nat)\<close>.
 The rest is automatic, which is surprising because it involves
 finding the instantiation \<^term>\<open>\<lambda>i::nat. p(i+1)\<close>
 for \<open>\<forall>p\<close>.
 \<close>
 
 apply(erule_tac x = "p 1" in allE)
 apply(auto)
 done
 
 
 text\<open>
 The opposite inclusion is proved by contradiction: if some state
 \<^term>\<open>s\<close> is not in \<^term>\<open>lfp(af A)\<close>, then we can construct an
 infinite \<^term>\<open>A\<close>-avoiding path starting from~\<^term>\<open>s\<close>. The reason is
 that by unfolding \<^const>\<open>lfp\<close> we find that if \<^term>\<open>s\<close> is not in
 \<^term>\<open>lfp(af A)\<close>, then \<^term>\<open>s\<close> is not in \<^term>\<open>A\<close> and there is a
 direct successor of \<^term>\<open>s\<close> that is again not in \mbox{\<^term>\<open>lfp(af
 A)\<close>}. Iterating this argument yields the promised infinite
 \<^term>\<open>A\<close>-avoiding path. Let us formalize this sketch.
 
 The one-step argument in the sketch above
 is proved by a variant of contraposition:
 \<close>
 
 lemma not_in_lfp_afD:
  "s \<notin> lfp(af A) \<Longrightarrow> s \<notin> A \<and> (\<exists> t. (s,t) \<in> M \<and> t \<notin> lfp(af A))"
 apply(erule contrapos_np)
 apply(subst lfp_unfold[OF mono_af])
 apply(simp add: af_def)
 done
 
 text\<open>\noindent
 We assume the negation of the conclusion and prove \<^term>\<open>s \<in> lfp(af A)\<close>.
 Unfolding \<^const>\<open>lfp\<close> once and
 simplifying with the definition of \<^const>\<open>af\<close> finishes the proof.
 
 Now we iterate this process. The following construction of the desired
 path is parameterized by a predicate \<^term>\<open>Q\<close> that should hold along the path:
 \<close>
 
 primrec path :: "state \<Rightarrow> (state \<Rightarrow> bool) \<Rightarrow> (nat \<Rightarrow> state)" where
 "path s Q 0 = s" |
 "path s Q (Suc n) = (SOME t. (path s Q n,t) \<in> M \<and> Q t)"
 
 text\<open>\noindent
 Element \<^term>\<open>n+1::nat\<close> on this path is some arbitrary successor
 \<^term>\<open>t\<close> of element \<^term>\<open>n\<close> such that \<^term>\<open>Q t\<close> holds.  Remember that \<open>SOME t. R t\<close>
 is some arbitrary but fixed \<^term>\<open>t\<close> such that \<^prop>\<open>R t\<close> holds (see \S\ref{sec:SOME}). Of
 course, such a \<^term>\<open>t\<close> need not exist, but that is of no
 concern to us since we will only use \<^const>\<open>path\<close> when a
 suitable \<^term>\<open>t\<close> does exist.
 
 Let us show that if each state \<^term>\<open>s\<close> that satisfies \<^term>\<open>Q\<close>
 has a successor that again satisfies \<^term>\<open>Q\<close>, then there exists an infinite \<^term>\<open>Q\<close>-path:
 \<close>
 
 lemma infinity_lemma:
   "\<lbrakk> Q s; \<forall>s. Q s \<longrightarrow> (\<exists> t. (s,t) \<in> M \<and> Q t) \<rbrakk> \<Longrightarrow>
    \<exists>p\<in>Paths s. \<forall>i. Q(p i)"
 
 txt\<open>\noindent
 First we rephrase the conclusion slightly because we need to prove simultaneously
 both the path property and the fact that \<^term>\<open>Q\<close> holds:
 \<close>
 
 apply(subgoal_tac
   "\<exists>p. s = p 0 \<and> (\<forall>i::nat. (p i, p(i+1)) \<in> M \<and> Q(p i))")
 
 txt\<open>\noindent
 From this proposition the original goal follows easily:
 \<close>
 
  apply(simp add: Paths_def, blast)
 
 txt\<open>\noindent
 The new subgoal is proved by providing the witness \<^term>\<open>path s Q\<close> for \<^term>\<open>p\<close>:
 \<close>
 
 apply(rule_tac x = "path s Q" in exI)
 apply(clarsimp)
 
 txt\<open>\noindent
 After simplification and clarification, the subgoal has the following form:
 @{subgoals[display,indent=0,margin=70,goals_limit=1]}
 It invites a proof by induction on \<^term>\<open>i\<close>:
 \<close>
 
 apply(induct_tac i)
  apply(simp)
 
 txt\<open>\noindent
 After simplification, the base case boils down to
 @{subgoals[display,indent=0,margin=70,goals_limit=1]}
 The conclusion looks exceedingly trivial: after all, \<^term>\<open>t\<close> is chosen such that \<^prop>\<open>(s,t)\<in>M\<close>
 holds. However, we first have to show that such a \<^term>\<open>t\<close> actually exists! This reasoning
 is embodied in the theorem @{thm[source]someI2_ex}:
 @{thm[display,eta_contract=false]someI2_ex}
 When we apply this theorem as an introduction rule, \<open>?P x\<close> becomes
 \<^prop>\<open>(s, x) \<in> M \<and> Q x\<close> and \<open>?Q x\<close> becomes \<^prop>\<open>(s,x) \<in> M\<close> and we have to prove
 two subgoals: \<^prop>\<open>\<exists>a. (s, a) \<in> M \<and> Q a\<close>, which follows from the assumptions, and
 \<^prop>\<open>(s, x) \<in> M \<and> Q x \<Longrightarrow> (s,x) \<in> M\<close>, which is trivial. Thus it is not surprising that
 \<open>fast\<close> can prove the base case quickly:
 \<close>
 
  apply(fast intro: someI2_ex)
 
 txt\<open>\noindent
 What is worth noting here is that we have used \methdx{fast} rather than
 \<open>blast\<close>.  The reason is that \<open>blast\<close> would fail because it cannot
 cope with @{thm[source]someI2_ex}: unifying its conclusion with the current
 subgoal is non-trivial because of the nested schematic variables. For
 efficiency reasons \<open>blast\<close> does not even attempt such unifications.
 Although \<open>fast\<close> can in principle cope with complicated unification
 problems, in practice the number of unifiers arising is often prohibitive and
 the offending rule may need to be applied explicitly rather than
 automatically. This is what happens in the step case.
 
 The induction step is similar, but more involved, because now we face nested
 occurrences of \<open>SOME\<close>. As a result, \<open>fast\<close> is no longer able to
 solve the subgoal and we apply @{thm[source]someI2_ex} by hand.  We merely
 show the proof commands but do not describe the details:
 \<close>
 
 apply(simp)
 apply(rule someI2_ex)
  apply(blast)
 apply(rule someI2_ex)
  apply(blast)
 apply(blast)
 done
 
 text\<open>
 Function \<^const>\<open>path\<close> has fulfilled its purpose now and can be forgotten.
 It was merely defined to provide the witness in the proof of the
 @{thm[source]infinity_lemma}. Aficionados of minimal proofs might like to know
 that we could have given the witness without having to define a new function:
 the term
 @{term[display]"rec_nat s (\<lambda>n t. SOME u. (t,u)\<in>M \<and> Q u)"}
 is extensionally equal to \<^term>\<open>path s Q\<close>,
 where \<^term>\<open>rec_nat\<close> is the predefined primitive recursor on \<^typ>\<open>nat\<close>.
 \<close>
 (*<*)
 lemma
 "\<lbrakk> Q s; \<forall> s. Q s \<longrightarrow> (\<exists> t. (s,t)\<in>M \<and> Q t) \<rbrakk> \<Longrightarrow>
  \<exists> p\<in>Paths s. \<forall> i. Q(p i)"
 apply(subgoal_tac
  "\<exists> p. s = p 0 \<and> (\<forall> i. (p i,p(Suc i))\<in>M \<and> Q(p i))")
  apply(simp add: Paths_def)
  apply(blast)
 apply(rule_tac x = "rec_nat s (\<lambda>n t. SOME u. (t,u)\<in>M \<and> Q u)" in exI)
 apply(simp)
 apply(intro strip)
 apply(induct_tac i)
  apply(simp)
  apply(fast intro: someI2_ex)
 apply(simp)
 apply(rule someI2_ex)
  apply(blast)
 apply(rule someI2_ex)
  apply(blast)
 by(blast)
 (*>*)
 
 text\<open>
 At last we can prove the opposite direction of @{thm[source]AF_lemma1}:
 \<close>
 
 theorem AF_lemma2: "{s. \<forall>p \<in> Paths s. \<exists>i. p i \<in> A} \<subseteq> lfp(af A)"
 
 txt\<open>\noindent
 The proof is again pointwise and then by contraposition:
 \<close>
 
 apply(rule subsetI)
 apply(erule contrapos_pp)
 apply simp
 
 txt\<open>
 @{subgoals[display,indent=0,goals_limit=1]}
 Applying the @{thm[source]infinity_lemma} as a destruction rule leaves two subgoals, the second
 premise of @{thm[source]infinity_lemma} and the original subgoal:
 \<close>
 
 apply(drule infinity_lemma)
 
 txt\<open>
 @{subgoals[display,indent=0,margin=65]}
 Both are solved automatically:
 \<close>
 
  apply(auto dest: not_in_lfp_afD)
 done
 
 text\<open>
 If you find these proofs too complicated, we recommend that you read
 \S\ref{sec:CTL-revisited}, where we show how inductive definitions lead to
 simpler arguments.
 
 The main theorem is proved as for PDL, except that we also derive the
 necessary equality \<open>lfp(af A) = ...\<close> by combining
 @{thm[source]AF_lemma1} and @{thm[source]AF_lemma2} on the spot:
 \<close>
 
 theorem "mc f = {s. s \<Turnstile> f}"
 apply(induct_tac f)
 apply(auto simp add: EF_lemma equalityI[OF AF_lemma1 AF_lemma2])
 done
 
 text\<open>
 
 The language defined above is not quite CTL\@. The latter also includes an
 until-operator \<^term>\<open>EU f g\<close> with semantics ``there \emph{E}xists a path
 where \<^term>\<open>f\<close> is true \emph{U}ntil \<^term>\<open>g\<close> becomes true''.  We need
 an auxiliary function:
 \<close>
 
 primrec
 until:: "state set \<Rightarrow> state set \<Rightarrow> state \<Rightarrow> state list \<Rightarrow> bool" where
 "until A B s []    = (s \<in> B)" |
 "until A B s (t#p) = (s \<in> A \<and> (s,t) \<in> M \<and> until A B t p)"
 (*<*)definition
  eusem :: "state set \<Rightarrow> state set \<Rightarrow> state set" where
 "eusem A B \<equiv> {s. \<exists>p. until A B s p}"(*>*)
 
 text\<open>\noindent
 Expressing the semantics of \<^term>\<open>EU\<close> is now straightforward:
 @{prop[display]"s \<Turnstile> EU f g = (\<exists>p. until {t. t \<Turnstile> f} {t. t \<Turnstile> g} s p)"}
 Note that \<^term>\<open>EU\<close> is not definable in terms of the other operators!
 
 Model checking \<^term>\<open>EU\<close> is again a least fixed point construction:
 @{text[display]"mc(EU f g) = lfp(\<lambda>T. mc g \<union> mc f \<inter> (M\<inverse> `` T))"}
 
 \begin{exercise}
 Extend the datatype of formulae by the above until operator
 and prove the equivalence between semantics and model checking, i.e.\ that
 @{prop[display]"mc(EU f g) = {s. s \<Turnstile> EU f g}"}
 %For readability you may want to annotate {term EU} with its customary syntax
 %{text[display]"| EU formula formula    E[_ U _]"}
 %which enables you to read and write {text"E[f U g]"} instead of {term"EU f g"}.
 \end{exercise}
-For more CTL exercises see, for example, Huth and Ryan @{cite "Huth-Ryan-book"}.
+For more CTL exercises see, for example, Huth and Ryan \<^cite>\<open>"Huth-Ryan-book"\<close>.
 \<close>
 
 (*<*)
 definition eufix :: "state set \<Rightarrow> state set \<Rightarrow> state set \<Rightarrow> state set" where
 "eufix A B T \<equiv> B \<union> A \<inter> (M\<inverse> `` T)"
 
 lemma "lfp(eufix A B) \<subseteq> eusem A B"
 apply(rule lfp_lowerbound)
 apply(auto simp add: eusem_def eufix_def)
  apply(rule_tac x = "[]" in exI)
  apply simp
 apply(rule_tac x = "xa#xb" in exI)
 apply simp
 done
 
 lemma mono_eufix: "mono(eufix A B)"
 apply(simp add: mono_def eufix_def)
 apply blast
 done
 
 lemma "eusem A B \<subseteq> lfp(eufix A B)"
 apply(clarsimp simp add: eusem_def)
 apply(erule rev_mp)
 apply(rule_tac x = x in spec)
 apply(induct_tac p)
  apply(subst lfp_unfold[OF mono_eufix])
  apply(simp add: eufix_def)
 apply(clarsimp)
 apply(subst lfp_unfold[OF mono_eufix])
 apply(simp add: eufix_def)
 apply blast
 done
 
 (*
 definition eusem :: "state set \<Rightarrow> state set \<Rightarrow> state set" where
 "eusem A B \<equiv> {s. \<exists>p\<in>Paths s. \<exists>j. p j \<in> B \<and> (\<forall>i < j. p i \<in> A)}"
 
 axiomatization where
 M_total: "\<exists>t. (s,t) \<in> M"
 
 consts apath :: "state \<Rightarrow> (nat \<Rightarrow> state)"
 primrec
 "apath s 0 = s"
 "apath s (Suc i) = (SOME t. (apath s i,t) \<in> M)"
 
 lemma [iff]: "apath s \<in> Paths s";
 apply(simp add: Paths_def);
 apply(blast intro: M_total[THEN someI_ex])
 done
 
 definition pcons :: "state \<Rightarrow> (nat \<Rightarrow> state) \<Rightarrow> (nat \<Rightarrow> state)" where
 "pcons s p == \<lambda>i. case i of 0 \<Rightarrow> s | Suc j \<Rightarrow> p j"
 
 lemma pcons_PathI: "[| (s,t) : M; p \<in> Paths t |] ==> pcons s p \<in> Paths s";
 by(simp add: Paths_def pcons_def split: nat.split);
 
 lemma "lfp(eufix A B) \<subseteq> eusem A B"
 apply(rule lfp_lowerbound)
 apply(clarsimp simp add: eusem_def eufix_def);
 apply(erule disjE);
  apply(rule_tac x = "apath x" in bexI);
   apply(rule_tac x = 0 in exI);
   apply simp;
  apply simp;
 apply(clarify);
 apply(rule_tac x = "pcons xb p" in bexI);
  apply(rule_tac x = "j+1" in exI);
  apply (simp add: pcons_def split: nat.split);
 apply (simp add: pcons_PathI)
 done
 *)
 (*>*)
 
 text\<open>Let us close this section with a few words about the executability of
 our model checkers.  It is clear that if all sets are finite, they can be
 represented as lists and the usual set operations are easily
 implemented. Only \<^const>\<open>lfp\<close> requires a little thought.  Fortunately, theory
-\<open>While_Combinator\<close> in the Library~@{cite "HOL-Library"} provides a
+\<open>While_Combinator\<close> in the Library~\<^cite>\<open>"HOL-Library"\<close> provides a
 theorem stating that in the case of finite sets and a monotone
 function~\<^term>\<open>F\<close>, the value of \mbox{\<^term>\<open>lfp F\<close>} can be computed by
 iterated application of \<^term>\<open>F\<close> to~\<^term>\<open>{}\<close> until a fixed point is
 reached. It is actually possible to generate executable functional programs
 from HOL definitions, but that is beyond the scope of the tutorial.%
 \index{CTL|)}\<close>
 (*<*)end(*>*)
diff --git a/src/Doc/Tutorial/CTL/PDL.thy b/src/Doc/Tutorial/CTL/PDL.thy
--- a/src/Doc/Tutorial/CTL/PDL.thy
+++ b/src/Doc/Tutorial/CTL/PDL.thy
@@ -1,204 +1,204 @@
 (*<*)theory PDL imports Base begin(*>*)
 
 subsection\<open>Propositional Dynamic Logic --- PDL\<close>
 
 text\<open>\index{PDL|(}
 The formulae of PDL are built up from atomic propositions via
 negation and conjunction and the two temporal
 connectives \<open>AX\<close> and \<open>EF\<close>\@. Since formulae are essentially
 syntax trees, they are naturally modelled as a datatype:%
 \footnote{The customary definition of PDL
-@{cite "HarelKT-DL"} looks quite different from ours, but the two are easily
+\<^cite>\<open>"HarelKT-DL"\<close> looks quite different from ours, but the two are easily
 shown to be equivalent.}
 \<close>
 
 datatype formula = Atom "atom"
                   | Neg formula
                   | And formula formula
                   | AX formula
                   | EF formula
 
 text\<open>\noindent
 This resembles the boolean expression case study in
 \S\ref{sec:boolex}.
 A validity relation between states and formulae specifies the semantics.
 The syntax annotation allows us to write \<open>s \<Turnstile> f\<close> instead of
 \hbox{\<open>valid s f\<close>}. The definition is by recursion over the syntax:
 \<close>
 
 primrec valid :: "state \<Rightarrow> formula \<Rightarrow> bool"   ("(_ \<Turnstile> _)" [80,80] 80)
 where
 "s \<Turnstile> Atom a  = (a \<in> L s)" |
 "s \<Turnstile> Neg f   = (\<not>(s \<Turnstile> f))" |
 "s \<Turnstile> And f g = (s \<Turnstile> f \<and> s \<Turnstile> g)" |
 "s \<Turnstile> AX f    = (\<forall>t. (s,t) \<in> M \<longrightarrow> t \<Turnstile> f)" |
 "s \<Turnstile> EF f    = (\<exists>t. (s,t) \<in> M\<^sup>* \<and> t \<Turnstile> f)"
 
 text\<open>\noindent
 The first three equations should be self-explanatory. The temporal formula
 \<^term>\<open>AX f\<close> means that \<^term>\<open>f\<close> is true in \emph{A}ll ne\emph{X}t states whereas
 \<^term>\<open>EF f\<close> means that there \emph{E}xists some \emph{F}uture state in which \<^term>\<open>f\<close> is
 true. The future is expressed via \<open>\<^sup>*\<close>, the reflexive transitive
 closure. Because of reflexivity, the future includes the present.
 
 Now we come to the model checker itself. It maps a formula into the
 set of states where the formula is true.  It too is defined by
 recursion over the syntax:\<close>
 
 primrec mc :: "formula \<Rightarrow> state set" where
 "mc(Atom a)  = {s. a \<in> L s}" |
 "mc(Neg f)   = -mc f" |
 "mc(And f g) = mc f \<inter> mc g" |
 "mc(AX f)    = {s. \<forall>t. (s,t) \<in> M  \<longrightarrow> t \<in> mc f}" |
 "mc(EF f)    = lfp(\<lambda>T. mc f \<union> (M\<inverse> `` T))"
 
 text\<open>\noindent
 Only the equation for \<^term>\<open>EF\<close> deserves some comments. Remember that the
 postfix \<open>\<inverse>\<close> and the infix \<open>``\<close> are predefined and denote the
 converse of a relation and the image of a set under a relation.  Thus
 \<^term>\<open>M\<inverse> `` T\<close> is the set of all predecessors of \<^term>\<open>T\<close> and the least
 fixed point (\<^term>\<open>lfp\<close>) of \<^term>\<open>\<lambda>T. mc f \<union> M\<inverse> `` T\<close> is the least set
 \<^term>\<open>T\<close> containing \<^term>\<open>mc f\<close> and all predecessors of \<^term>\<open>T\<close>. If you
 find it hard to see that \<^term>\<open>mc(EF f)\<close> contains exactly those states from
 which there is a path to a state where \<^term>\<open>f\<close> is true, do not worry --- this
 will be proved in a moment.
 
 First we prove monotonicity of the function inside \<^term>\<open>lfp\<close>
 in order to make sure it really has a least fixed point.
 \<close>
 
 lemma mono_ef: "mono(\<lambda>T. A \<union> (M\<inverse> `` T))"
 apply(rule monoI)
 apply blast
 done
 
 text\<open>\noindent
 Now we can relate model checking and semantics. For the \<open>EF\<close> case we need
 a separate lemma:
 \<close>
 
 lemma EF_lemma:
   "lfp(\<lambda>T. A \<union> (M\<inverse> `` T)) = {s. \<exists>t. (s,t) \<in> M\<^sup>* \<and> t \<in> A}"
 
 txt\<open>\noindent
 The equality is proved in the canonical fashion by proving that each set
 includes the other; the inclusion is shown pointwise:
 \<close>
 
 apply(rule equalityI)
  apply(rule subsetI)
  apply(simp)(*<*)apply(rename_tac s)(*>*)
 
 txt\<open>\noindent
 Simplification leaves us with the following first subgoal
 @{subgoals[display,indent=0,goals_limit=1]}
 which is proved by \<^term>\<open>lfp\<close>-induction:
 \<close>
 
  apply(erule lfp_induct_set)
   apply(rule mono_ef)
  apply(simp)
 txt\<open>\noindent
 Having disposed of the monotonicity subgoal,
 simplification leaves us with the following goal:
 \begin{isabelle}
 \ {\isadigit{1}}{\isachardot}\ {\isasymAnd}x{\isachardot}\ x\ {\isasymin}\ A\ {\isasymor}\isanewline
 \ \ \ \ \ \ \ \ \ x\ {\isasymin}\ M{\isasyminverse}\ {\isacharbackquote}{\isacharbackquote}\ {\isacharparenleft}lfp\ {\isacharparenleft}\dots{\isacharparenright}\ {\isasyminter}\ {\isacharbraceleft}x{\isachardot}\ {\isasymexists}t{\isachardot}\ {\isacharparenleft}x{\isacharcomma}\ t{\isacharparenright}\ {\isasymin}\ M\isactrlsup {\isacharasterisk}\ {\isasymand}\ t\ {\isasymin}\ A{\isacharbraceright}{\isacharparenright}\isanewline
 \ \ \ \ \ \ \ \ {\isasymLongrightarrow}\ {\isasymexists}t{\isachardot}\ {\isacharparenleft}x{\isacharcomma}\ t{\isacharparenright}\ {\isasymin}\ M\isactrlsup {\isacharasterisk}\ {\isasymand}\ t\ {\isasymin}\ A
 \end{isabelle}
 It is proved by \<open>blast\<close>, using the transitivity of 
 \isa{M\isactrlsup {\isacharasterisk}}.
 \<close>
 
  apply(blast intro: rtrancl_trans)
 
 txt\<open>
 We now return to the second set inclusion subgoal, which is again proved
 pointwise:
 \<close>
 
 apply(rule subsetI)
 apply(simp, clarify)
 
 txt\<open>\noindent
 After simplification and clarification we are left with
 @{subgoals[display,indent=0,goals_limit=1]}
 This goal is proved by induction on \<^term>\<open>(s,t)\<in>M\<^sup>*\<close>. But since the model
 checker works backwards (from \<^term>\<open>t\<close> to \<^term>\<open>s\<close>), we cannot use the
 induction theorem @{thm[source]rtrancl_induct}: it works in the
 forward direction. Fortunately the converse induction theorem
 @{thm[source]converse_rtrancl_induct} already exists:
 @{thm[display,margin=60]converse_rtrancl_induct[no_vars]}
 It says that if \<^prop>\<open>(a,b)\<in>r\<^sup>*\<close> and we know \<^prop>\<open>P b\<close> then we can infer
 \<^prop>\<open>P a\<close> provided each step backwards from a predecessor \<^term>\<open>z\<close> of
 \<^term>\<open>b\<close> preserves \<^term>\<open>P\<close>.
 \<close>
 
 apply(erule converse_rtrancl_induct)
 
 txt\<open>\noindent
 The base case
 @{subgoals[display,indent=0,goals_limit=1]}
 is solved by unrolling \<^term>\<open>lfp\<close> once
 \<close>
 
  apply(subst lfp_unfold[OF mono_ef])
 
 txt\<open>
 @{subgoals[display,indent=0,goals_limit=1]}
 and disposing of the resulting trivial subgoal automatically:
 \<close>
 
  apply(blast)
 
 txt\<open>\noindent
 The proof of the induction step is identical to the one for the base case:
 \<close>
 
 apply(subst lfp_unfold[OF mono_ef])
 apply(blast)
 done
 
 text\<open>
 The main theorem is proved in the familiar manner: induction followed by
 \<open>auto\<close> augmented with the lemma as a simplification rule.
 \<close>
 
 theorem "mc f = {s. s \<Turnstile> f}"
 apply(induct_tac f)
 apply(auto simp add: EF_lemma)
 done
 
 text\<open>
 \begin{exercise}
 \<^term>\<open>AX\<close> has a dual operator \<^term>\<open>EN\<close> 
 (``there exists a next state such that'')%
 \footnote{We cannot use the customary \<open>EX\<close>: it is reserved
 as the \textsc{ascii}-equivalent of \<open>\<exists>\<close>.}
 with the intended semantics
 @{prop[display]"(s \<Turnstile> EN f) = (\<exists>t. (s,t) \<in> M \<and> t \<Turnstile> f)"}
 Fortunately, \<^term>\<open>EN f\<close> can already be expressed as a PDL formula. How?
 
 Show that the semantics for \<^term>\<open>EF\<close> satisfies the following recursion equation:
 @{prop[display]"(s \<Turnstile> EF f) = (s \<Turnstile> f | s \<Turnstile> EN(EF f))"}
 \end{exercise}
 \index{PDL|)}
 \<close>
 (*<*)
 theorem main: "mc f = {s. s \<Turnstile> f}"
 apply(induct_tac f)
 apply(auto simp add: EF_lemma)
 done
 
 lemma aux: "s \<Turnstile> f = (s \<in> mc f)"
 apply(simp add: main)
 done
 
 lemma "(s \<Turnstile> EF f) = (s \<Turnstile> f | s \<Turnstile> Neg(AX(Neg(EF f))))"
 apply(simp only: aux)
 apply(simp)
 apply(subst lfp_unfold[OF mono_ef], fast)
 done
 
 end
 (*>*)
diff --git a/src/Doc/Tutorial/Datatype/Nested.thy b/src/Doc/Tutorial/Datatype/Nested.thy
--- a/src/Doc/Tutorial/Datatype/Nested.thy
+++ b/src/Doc/Tutorial/Datatype/Nested.thy
@@ -1,158 +1,158 @@
 (*<*)
 theory Nested imports ABexpr begin
 (*>*)
 
 text\<open>
 \index{datatypes!and nested recursion}%
 So far, all datatypes had the property that on the right-hand side of their
 definition they occurred only at the top-level: directly below a
 constructor. Now we consider \emph{nested recursion}, where the recursive
 datatype occurs nested in some other datatype (but not inside itself!).
 Consider the following model of terms
 where function symbols can be applied to a list of arguments:
 \<close>
 (*<*)hide_const Var(*>*)
 datatype ('v,'f)"term" = Var 'v | App 'f "('v,'f)term list"
 
 text\<open>\noindent
 Note that we need to quote \<open>term\<close> on the left to avoid confusion with
 the Isabelle command \isacommand{term}.
 Parameter \<^typ>\<open>'v\<close> is the type of variables and \<^typ>\<open>'f\<close> the type of
 function symbols.
 A mathematical term like $f(x,g(y))$ becomes \<^term>\<open>App f [Var x, App g
   [Var y]]\<close>, where \<^term>\<open>f\<close>, \<^term>\<open>g\<close>, \<^term>\<open>x\<close>, \<^term>\<open>y\<close> are
 suitable values, e.g.\ numbers or strings.
 
 What complicates the definition of \<open>term\<close> is the nested occurrence of
 \<open>term\<close> inside \<open>list\<close> on the right-hand side. In principle,
 nested recursion can be eliminated in favour of mutual recursion by unfolding
 the offending datatypes, here \<open>list\<close>. The result for \<open>term\<close>
 would be something like
 \medskip
 
 \input{unfoldnested.tex}
 \medskip
 
 \noindent
 Although we do not recommend this unfolding to the user, it shows how to
 simulate nested recursion by mutual recursion.
 Now we return to the initial definition of \<open>term\<close> using
 nested recursion.
 
 Let us define a substitution function on terms. Because terms involve term
 lists, we need to define two substitution functions simultaneously:
 \<close>
 
 primrec
 subst :: "('v\<Rightarrow>('v,'f)term) \<Rightarrow> ('v,'f)term      \<Rightarrow> ('v,'f)term" and
 substs:: "('v\<Rightarrow>('v,'f)term) \<Rightarrow> ('v,'f)term list \<Rightarrow> ('v,'f)term list"
 where
 "subst s (Var x) = s x" |
   subst_App:
 "subst s (App f ts) = App f (substs s ts)" |
 
 "substs s [] = []" |
 "substs s (t # ts) = subst s t # substs s ts"
 
 text\<open>\noindent
 Individual equations in a \commdx{primrec} definition may be
 named as shown for @{thm[source]subst_App}.
 The significance of this device will become apparent below.
 
 Similarly, when proving a statement about terms inductively, we need
 to prove a related statement about term lists simultaneously. For example,
 the fact that the identity substitution does not change a term needs to be
 strengthened and proved as follows:
 \<close>
 
 lemma subst_id(*<*)(*referred to from ABexpr*)(*>*): "subst  Var t  = (t ::('v,'f)term)  \<and>
                   substs Var ts = (ts::('v,'f)term list)"
 apply(induct_tac t and ts rule: subst.induct substs.induct, simp_all)
 done
 
 text\<open>\noindent
 Note that \<^term>\<open>Var\<close> is the identity substitution because by definition it
 leaves variables unchanged: \<^prop>\<open>subst Var (Var x) = Var x\<close>. Note also
 that the type annotations are necessary because otherwise there is nothing in
 the goal to enforce that both halves of the goal talk about the same type
 parameters \<open>('v,'f)\<close>. As a result, induction would fail
 because the two halves of the goal would be unrelated.
 
 \begin{exercise}
 The fact that substitution distributes over composition can be expressed
 roughly as follows:
 @{text[display]"subst (f \<circ> g) t = subst f (subst g t)"}
 Correct this statement (you will find that it does not type-check),
 strengthen it, and prove it. (Note: \<open>\<circ>\<close> is function composition;
 its definition is found in theorem @{thm[source]o_def}).
 \end{exercise}
 \begin{exercise}\label{ex:trev-trev}
   Define a function \<^term>\<open>trev\<close> of type \<^typ>\<open>('v,'f)term => ('v,'f)term\<close>
 that recursively reverses the order of arguments of all function symbols in a
   term. Prove that \<^prop>\<open>trev(trev t) = t\<close>.
 \end{exercise}
 
 The experienced functional programmer may feel that our definition of
 \<^term>\<open>subst\<close> is too complicated in that \<^const>\<open>substs\<close> is
 unnecessary. The \<^term>\<open>App\<close>-case can be defined directly as
 @{term[display]"subst s (App f ts) = App f (map (subst s) ts)"}
 where \<^term>\<open>map\<close> is the standard list function such that
 \<open>map f [x1,...,xn] = [f x1,...,f xn]\<close>. This is true, but Isabelle
 insists on the conjunctive format. Fortunately, we can easily \emph{prove}
 that the suggested equation holds:
 \<close>
 (*<*)
 (* Exercise 1: *)
 lemma "subst  ((subst f) \<circ> g) t  = subst  f (subst g t) \<and>
        substs ((subst f) \<circ> g) ts = substs f (substs g ts)"
 apply (induct_tac t and ts rule: subst.induct substs.induct)
 apply (simp_all)
 done
 
 (* Exercise 2: *)
 
 primrec trev :: "('v,'f) term \<Rightarrow> ('v,'f) term"
   and trevs:: "('v,'f) term list \<Rightarrow> ('v,'f) term list"
 where
   "trev (Var v)    = Var v"
 | "trev (App f ts) = App f (trevs ts)"
 | "trevs [] = []"
 | "trevs (t#ts) = (trevs ts) @ [(trev t)]" 
 
 lemma [simp]: "\<forall> ys. trevs (xs @ ys) = (trevs ys) @ (trevs xs)" 
 apply (induct_tac xs, auto)
 done
 
 lemma "trev (trev t) = (t::('v,'f)term) \<and> 
        trevs (trevs ts) = (ts::('v,'f)term list)"
 apply (induct_tac t and ts rule: trev.induct trevs.induct, simp_all)
 done
 (*>*)
 
 lemma [simp]: "subst s (App f ts) = App f (map (subst s) ts)"
 apply(induct_tac ts, simp_all)
 done
 
 text\<open>\noindent
 What is more, we can now disable the old defining equation as a
 simplification rule:
 \<close>
 
 declare subst_App [simp del]
 
 text\<open>\noindent The advantage is that now we have replaced \<^const>\<open>substs\<close> by \<^const>\<open>map\<close>, we can profit from the large number of
 pre-proved lemmas about \<^const>\<open>map\<close>.  Unfortunately, inductive proofs
 about type \<open>term\<close> are still awkward because they expect a
 conjunction. One could derive a new induction principle as well (see
 \S\ref{sec:derive-ind}), but simpler is to stop using
 \isacommand{primrec} and to define functions with \isacommand{fun}
 instead.  Simple uses of \isacommand{fun} are described in
 \S\ref{sec:fun} below.  Advanced applications, including functions
 over nested datatypes like \<open>term\<close>, are discussed in a
-separate tutorial~@{cite "isabelle-function"}.
+separate tutorial~\<^cite>\<open>"isabelle-function"\<close>.
 
 Of course, you may also combine mutual and nested recursion of datatypes. For example,
 constructor \<open>Sum\<close> in \S\ref{sec:datatype-mut-rec} could take a list of
 expressions as its argument: \<open>Sum\<close>~@{typ[quotes]"'a aexp list"}.
 \<close>
 (*<*)end(*>*)
diff --git a/src/Doc/Tutorial/Documents/Documents.thy b/src/Doc/Tutorial/Documents/Documents.thy
--- a/src/Doc/Tutorial/Documents/Documents.thy
+++ b/src/Doc/Tutorial/Documents/Documents.thy
@@ -1,725 +1,725 @@
 (*<*)
 theory Documents imports Main begin
 (*>*)
 
 section \<open>Concrete Syntax \label{sec:concrete-syntax}\<close>
 
 text \<open>
   The core concept of Isabelle's framework for concrete syntax is that
   of \bfindex{mixfix annotations}.  Associated with any kind of
   constant declaration, mixfixes affect both the grammar productions
   for the parser and output templates for the pretty printer.
 
   In full generality, parser and pretty printer configuration is a
-  subtle affair~@{cite "isabelle-isar-ref"}.  Your syntax specifications need
+  subtle affair~\<^cite>\<open>"isabelle-isar-ref"\<close>.  Your syntax specifications need
   to interact properly with the existing setup of Isabelle/Pure and
   Isabelle/HOL\@.  To avoid creating ambiguities with existing
   elements, it is particularly important to give new syntactic
   constructs the right precedence.
 
   Below we introduce a few simple syntax declaration
   forms that already cover many common situations fairly well.
 \<close>
 
 
 subsection \<open>Infix Annotations\<close>
 
 text \<open>
   Syntax annotations may be included wherever constants are declared,
   such as \isacommand{definition} and \isacommand{primrec} --- and also
   \isacommand{datatype}, which declares constructor operations.
   Type-constructors may be annotated as well, although this is less
   frequently encountered in practice (the infix type \<open>\<times>\<close> comes
   to mind).
 
   Infix declarations\index{infix annotations} provide a useful special
   case of mixfixes.  The following example of the exclusive-or
   operation on boolean values illustrates typical infix declarations.
 \<close>
 
 definition xor :: "bool \<Rightarrow> bool \<Rightarrow> bool"    (infixl "[+]" 60)
 where "A [+] B \<equiv> (A \<and> \<not> B) \<or> (\<not> A \<and> B)"
 
 text \<open>
   \noindent Now \<open>xor A B\<close> and \<open>A [+] B\<close> refer to the
   same expression internally.  Any curried function with at least two
   arguments may be given infix syntax.  For partial applications with
   fewer than two operands, the operator is enclosed in parentheses.
   For instance, \<open>xor\<close> without arguments is represented as
   \<open>([+])\<close>; together with ordinary function application, this
   turns \<open>xor A\<close> into \<open>([+]) A\<close>.
 
   The keyword \isakeyword{infixl} seen above specifies an
   infix operator that is nested to the \emph{left}: in iterated
   applications the more complex expression appears on the left-hand
   side, and \<^term>\<open>A [+] B [+] C\<close> stands for \<open>(A [+] B) [+]
   C\<close>.  Similarly, \isakeyword{infixr} means nesting to the
   \emph{right}, reading \<^term>\<open>A [+] B [+] C\<close> as \<open>A [+] (B
   [+] C)\<close>.  A \emph{non-oriented} declaration via \isakeyword{infix}
   would render \<^term>\<open>A [+] B [+] C\<close> illegal, but demand explicit
   parentheses to indicate the intended grouping.
 
   The string @{text [source] "[+]"} in our annotation refers to the
   concrete syntax to represent the operator (a literal token), while
   the number \<open>60\<close> determines the precedence of the construct:
   the syntactic priorities of the arguments and result.  Isabelle/HOL
   already uses up many popular combinations of ASCII symbols for its
   own use, including both \<open>+\<close> and \<open>++\<close>.  Longer
   character combinations are more likely to be still available for
   user extensions, such as our~\<open>[+]\<close>.
 
   Operator precedences have a range of 0--1000.  Very low or high
   priorities are reserved for the meta-logic.  HOL syntax mainly uses
   the range of 10--100: the equality infix \<open>=\<close> is centered at
   50; logical connectives (like \<open>\<or>\<close> and \<open>\<and>\<close>) are
   below 50; algebraic ones (like \<open>+\<close> and \<open>*\<close>) are
   above 50.  User syntax should strive to coexist with common HOL
   forms, or use the mostly unused range 100--900.
 \<close>
 
 
 subsection \<open>Mathematical Symbols \label{sec:syntax-symbols}\<close>
 
 text \<open>
   Concrete syntax based on ASCII characters has inherent limitations.
   Mathematical notation demands a larger repertoire of glyphs.
   Several standards of extended character sets have been proposed over
   decades, but none has become universally available so far.  Isabelle
   has its own notion of \bfindex{symbols} as the smallest entities of
   source text, without referring to internal encodings.  There are
   three kinds of such ``generalized characters'':
 
   \begin{enumerate}
 
   \item 7-bit ASCII characters
 
   \item named symbols: \verb,\,\verb,<,$ident$\verb,>,
 
   \item named control symbols: \verb,\,\verb,<^,$ident$\verb,>,
 
   \end{enumerate}
 
   Here $ident$ is any sequence of letters. 
   This results in an infinite store of symbols, whose
   interpretation is left to further front-end tools.  For example, the
   Isabelle document processor (see \S\ref{sec:document-preparation})
   display the \verb,\,\verb,<forall>, symbol as~\<open>\<forall>\<close>.
 
   A list of standard Isabelle symbols is given in
-  @{cite "isabelle-isar-ref"}.  You may introduce your own
+  \<^cite>\<open>"isabelle-isar-ref"\<close>.  You may introduce your own
   interpretation of further symbols by configuring the appropriate
   front-end tool accordingly, e.g.\ by defining certain {\LaTeX}
   macros (see also \S\ref{sec:doc-prep-symbols}).  There are also a
   few predefined control symbols, such as \verb,\,\verb,<^sub>, and
   \verb,\,\verb,<^sup>, for sub- and superscript of the subsequent
   printable symbol, respectively.  For example, \<^verbatim>\<open>A\<^sup>\<star>\<close>, is
   output as \<open>A\<^sup>\<star>\<close>.
 
   A number of symbols are considered letters by the Isabelle lexer and
   can be used as part of identifiers. These are the greek letters
   \<open>\<alpha>\<close> (\verb+\+\verb+<alpha>+), \<open>\<beta>\<close>
   (\verb+\+\verb+<beta>+), etc. (excluding \<open>\<lambda>\<close>),
   special letters like \<open>\<A>\<close> (\verb+\+\verb+<A>+) and \<open>\<AA>\<close> (\verb+\+\verb+<AA>+).  Moreover the control symbol
   \verb+\+\verb+<^sub>+ may be used to subscript a single letter or digit
   in the trailing part of an identifier. This means that the input
 
   \medskip
   {\small\noindent \<^verbatim>\<open>\<forall>\<alpha>\<^sub>1. \<alpha>\<^sub>1 = \<Pi>\<^sub>\<A>\<close>}
 
   \medskip
   \noindent is recognized as the term \<^term>\<open>\<forall>\<alpha>\<^sub>1. \<alpha>\<^sub>1 = \<Pi>\<^sub>\<A>\<close> 
   by Isabelle.
 
   Replacing our previous definition of \<open>xor\<close> by the
   following specifies an Isabelle symbol for the new operator:
 \<close>
 
 (*<*)
 hide_const xor
 setup \<open>Sign.add_path "version1"\<close>
 (*>*)
 definition xor :: "bool \<Rightarrow> bool \<Rightarrow> bool"    (infixl "\<oplus>" 60)
 where "A \<oplus> B \<equiv> (A \<and> \<not> B) \<or> (\<not> A \<and> B)"
 (*<*)
 setup \<open>Sign.local_path\<close>
 (*>*)
 
 text \<open>
   It is possible to provide alternative syntax forms
-  through the \bfindex{print mode} concept~@{cite "isabelle-isar-ref"}.  By
+  through the \bfindex{print mode} concept~\<^cite>\<open>"isabelle-isar-ref"\<close>.  By
   convention, the mode of ``$xsymbols$'' is enabled whenever
   Proof~General's X-Symbol mode or {\LaTeX} output is active.  Now
   consider the following hybrid declaration of \<open>xor\<close>:
 \<close>
 
 (*<*)
 hide_const xor
 setup \<open>Sign.add_path "version2"\<close>
 (*>*)
 definition xor :: "bool \<Rightarrow> bool \<Rightarrow> bool"    (infixl "[+]\<ignore>" 60)
 where "A [+]\<ignore> B \<equiv> (A \<and> \<not> B) \<or> (\<not> A \<and> B)"
 
 notation (xsymbols) xor (infixl "\<oplus>\<ignore>" 60)
 (*<*)
 setup \<open>Sign.local_path\<close>
 (*>*)
 
 text \<open>\noindent
 The \commdx{notation} command associates a mixfix
 annotation with a known constant.  The print mode specification,
 here \<open>(xsymbols)\<close>, is optional.
 
 We may now write \<open>A [+] B\<close> or \<open>A \<oplus> B\<close> in input, while
 output uses the nicer syntax of $xsymbols$ whenever that print mode is
 active.  Such an arrangement is particularly useful for interactive
 development, where users may type ASCII text and see mathematical
 symbols displayed during proofs.\<close>
 
 
 subsection \<open>Prefix Annotations\<close>
 
 text \<open>
   Prefix syntax annotations\index{prefix annotation} are another form
-  of mixfixes @{cite "isabelle-isar-ref"}, without any template arguments or
+  of mixfixes \<^cite>\<open>"isabelle-isar-ref"\<close>, without any template arguments or
   priorities --- just some literal syntax.  The following example
   associates common symbols with the constructors of a datatype.
 \<close>
 
 datatype currency =
     Euro nat    ("\<euro>")
   | Pounds nat  ("\<pounds>")
   | Yen nat     ("\<yen>")
   | Dollar nat  ("$")
 
 text \<open>
   \noindent Here the mixfix annotations on the rightmost column happen
   to consist of a single Isabelle symbol each: \verb,\,\verb,<euro>,,
   \verb,\,\verb,<pounds>,, \verb,\,\verb,<yen>,, and \verb,$,.  Recall
   that a constructor like \<open>Euro\<close> actually is a function \<^typ>\<open>nat \<Rightarrow> currency\<close>.  The expression \<open>Euro 10\<close> will be
   printed as \<^term>\<open>\<euro> 10\<close>; only the head of the application is
   subject to our concrete syntax.  This rather simple form already
   achieves conformance with notational standards of the European
   Commission.
 
   Prefix syntax works the same way for other commands that introduce new constants, e.g. \isakeyword{primrec}.
 \<close>
 
 
 subsection \<open>Abbreviations \label{sec:abbreviations}\<close>
 
 text\<open>Mixfix syntax annotations merely decorate particular constant
 application forms with concrete syntax, for instance replacing
 \<open>xor A B\<close> by \<open>A \<oplus> B\<close>.  Occasionally, the relationship
 between some piece of notation and its internal form is more
 complicated.  Here we need \emph{abbreviations}.
 
 Command \commdx{abbreviation} introduces an uninterpreted notational
 constant as an abbreviation for a complex term. Abbreviations are
 unfolded upon parsing and re-introduced upon printing. This provides a
 simple mechanism for syntactic macros.
 
 A typical use of abbreviations is to introduce relational notation for
 membership in a set of pairs, replacing \<open>(x, y) \<in> sim\<close> by
 \<open>x \<approx> y\<close>. We assume that a constant \<open>sim\<close> of type
 \<^typ>\<open>('a \<times> 'a) set\<close> has been introduced at this point.\<close>
 (*<*)consts sim :: "('a \<times> 'a) set"(*>*)
 abbreviation sim2 :: "'a \<Rightarrow> 'a \<Rightarrow> bool"   (infix "\<approx>" 50)
 where "x \<approx> y  \<equiv>  (x, y) \<in> sim"
 
 text \<open>\noindent The given meta-equality is used as a rewrite rule
 after parsing (replacing \mbox{\<^prop>\<open>x \<approx> y\<close>} by \<open>(x,y) \<in>
 sim\<close>) and before printing (turning \<open>(x,y) \<in> sim\<close> back into
 \mbox{\<^prop>\<open>x \<approx> y\<close>}). The name of the dummy constant \<open>sim2\<close>
 does not matter, as long as it is unique.
 
 Another common application of abbreviations is to
 provide variant versions of fundamental relational expressions, such
 as \<open>\<noteq>\<close> for negated equalities.  The following declaration
 stems from Isabelle/HOL itself:
 \<close>
 
 abbreviation not_equal :: "'a \<Rightarrow> 'a \<Rightarrow> bool"    (infixl "~=\<ignore>" 50)
 where "x ~=\<ignore> y  \<equiv>  \<not> (x = y)"
 
 notation (xsymbols) not_equal (infix "\<noteq>\<ignore>" 50)
 
 text \<open>\noindent The notation \<open>\<noteq>\<close> is introduced separately to restrict it
 to the \emph{xsymbols} mode.
 
 Abbreviations are appropriate when the defined concept is a
 simple variation on an existing one.  But because of the automatic
 folding and unfolding of abbreviations, they do not scale up well to
 large hierarchies of concepts. Abbreviations do not replace
 definitions.
 
 Abbreviations are a simplified form of the general concept of
 \emph{syntax translations}; even heavier transformations may be
-written in ML @{cite "isabelle-isar-ref"}.
+written in ML \<^cite>\<open>"isabelle-isar-ref"\<close>.
 \<close>
 
 
 section \<open>Document Preparation \label{sec:document-preparation}\<close>
 
 text \<open>
   Isabelle/Isar is centered around the concept of \bfindex{formal
   proof documents}\index{documents|bold}.  The outcome of a formal
   development effort is meant to be a human-readable record, presented
   as browsable PDF file or printed on paper.  The overall document
   structure follows traditional mathematical articles, with sections,
   intermediate explanations, definitions, theorems and proofs.
 
   \medskip The Isabelle document preparation system essentially acts
   as a front-end to {\LaTeX}.  After checking specifications and
   proofs formally, the theory sources are turned into typesetting
   instructions in a schematic manner.  This lets you write authentic
   reports on theory developments with little effort: many technical
   consistency checks are handled by the system.
 
   Here is an example to illustrate the idea of Isabelle document
   preparation.
 \<close>
 
 text_raw \<open>\begin{quotation}\<close>
 
 text \<open>
   The following datatype definition of \<open>'a bintree\<close> models
   binary trees with nodes being decorated by elements of type \<^typ>\<open>'a\<close>.
 \<close>
 
 datatype 'a bintree =
      Leaf | Branch 'a  "'a bintree"  "'a bintree"
 
 text \<open>
   \noindent The datatype induction rule generated here is of the form
   @{thm [indent = 1, display] bintree.induct [no_vars]}
 \<close>
 
 text_raw \<open>\end{quotation}\<close>
 
 text \<open>
   \noindent The above document output has been produced as follows:
 
   \begin{ttbox}
   text {\ttlbrace}*
     The following datatype definition of {\at}{\ttlbrace}text "'a bintree"{\ttrbrace}
     models binary trees with nodes being decorated by elements
     of type {\at}{\ttlbrace}typ 'a{\ttrbrace}.
   *{\ttrbrace}
 
   datatype 'a bintree =
     Leaf | Branch 'a  "'a bintree"  "'a bintree"
   \end{ttbox}
   \begin{ttbox}
   text {\ttlbrace}*
     {\ttback}noindent The datatype induction rule generated here is
     of the form {\at}{\ttlbrace}thm [display] bintree.induct [no_vars]{\ttrbrace}
   *{\ttrbrace}
   \end{ttbox}\vspace{-\medskipamount}
 
   \noindent Here we have augmented the theory by formal comments
   (using \isakeyword{text} blocks), the informal parts may again refer
   to formal entities by means of ``antiquotations'' (such as
   \texttt{\at}\verb,{text "'a bintree"}, or
   \texttt{\at}\verb,{typ 'a},), see also \S\ref{sec:doc-prep-text}.
 \<close>
 
 
 subsection \<open>Isabelle Sessions\<close>
 
 text \<open>
   In contrast to the highly interactive mode of Isabelle/Isar theory
   development, the document preparation stage essentially works in
   batch-mode.  An Isabelle \bfindex{session} consists of a collection
   of source files that may contribute to an output document.  Each
   session is derived from a single parent, usually an object-logic
   image like \texttt{HOL}.  This results in an overall tree structure,
   which is reflected by the output location in the file system
   (the root directory is determined by the Isabelle settings variable
   \verb,ISABELLE_BROWSER_INFO,).
 
   \medskip The easiest way to manage Isabelle sessions is via
   \texttt{isabelle mkroot} (to generate an initial session source
   setup) and \texttt{isabelle build} (to run sessions as specified in
   the corresponding \texttt{ROOT} file).  These Isabelle tools are
   described in further detail in the \emph{Isabelle System Manual}
-  @{cite "isabelle-system"}.
+  \<^cite>\<open>"isabelle-system"\<close>.
 
   For example, a new session \texttt{MySession} (with document
   preparation) may be produced as follows:
 
 \begin{verbatim}
   isabelle mkroot MySession
   isabelle build -D MySession
 \end{verbatim}
 
   The \texttt{isabelle build} job also informs about the file-system
   location of the ultimate results.  The above dry run should be able
   to produce some \texttt{document.pdf} (with dummy title, empty table
   of contents etc.).  Any failure at this stage usually indicates
   technical problems of the {\LaTeX} installation.
 
   \medskip The detailed arrangement of the session sources is as
   follows.
 
   \begin{itemize}
 
   \item Directory \texttt{MySession} holds the required theory files
   $T@1$\texttt{.thy}, \dots, $T@n$\texttt{.thy}.
 
   \item File \texttt{MySession/ROOT} specifies the session options and
   content, with declarations for all wanted theories; it is sufficient
   to specify the terminal nodes of the theory dependency graph.
 
   \item Directory \texttt{MySession/document} contains everything
   required for the {\LaTeX} stage; only \texttt{root.tex} needs to be
   provided initially.
 
   The latter file holds appropriate {\LaTeX} code to commence a
   document (\verb,\documentclass, etc.), and to include the generated
   files $T@i$\texttt{.tex} for each theory.  Isabelle will generate a
   file \texttt{session.tex} holding {\LaTeX} commands to include all
   generated theory output files in topologically sorted order, so
   \verb,\input{session}, in the body of \texttt{root.tex} does the job
   in most situations.
 
   \end{itemize}
 
   One may now start to populate the directory \texttt{MySession} and
   its \texttt{ROOT} file accordingly.  The file
   \texttt{MySession/document/root.tex} should also be adapted at some
   point; the default version is mostly self-explanatory.  Note that
   \verb,\isabellestyle, enables fine-tuning of the general appearance
   of characters and mathematical symbols (see also
   \S\ref{sec:doc-prep-symbols}).
 
   Especially observe the included {\LaTeX} packages \texttt{isabelle}
   (mandatory), \texttt{isabellesym} (required for mathematical
   symbols), and the final \texttt{pdfsetup} (provides sane defaults
   for \texttt{hyperref}, including URL markup).  All three are
   distributed with Isabelle. Further packages may be required in
   particular applications, say for unusual mathematical symbols.
 
   \medskip Any additional files for the {\LaTeX} stage go into the
   \texttt{MySession/document} directory as well.  In particular,
   adding a file named \texttt{root.bib} causes an automatic run of
   \texttt{bibtex} to process a bibliographic database; see also
-  \texttt{isabelle document} @{cite "isabelle-system"}.
+  \texttt{isabelle document} \<^cite>\<open>"isabelle-system"\<close>.
 
   \medskip Any failure of the document preparation phase in an
   Isabelle batch session leaves the generated sources in their target
   location, identified by the accompanying error message.  This lets
   you trace {\LaTeX} problems with the generated files at hand.
 \<close>
 
 
 subsection \<open>Structure Markup\<close>
 
 text \<open>
   The large-scale structure of Isabelle documents follows existing
   {\LaTeX} conventions, with chapters, sections, subsubsections etc.
   The Isar language includes separate \bfindex{markup commands}, which
   do not affect the formal meaning of a theory (or proof), but result
   in corresponding {\LaTeX} elements.
 
   From the Isabelle perspective, each markup command takes a single
   $text$ argument (delimited by \verb,",~\<open>\<dots>\<close>~\verb,", or
   \verb,{,\verb,*,~\<open>\<dots>\<close>~\verb,*,\verb,},).  After stripping any
   surrounding white space, the argument is passed to a {\LaTeX} macro
   \verb,\isamarkupXYZ, for command \isakeyword{XYZ}.  These macros are
   defined in \verb,isabelle.sty, according to the meaning given in the
   rightmost column above.
 
   \medskip The following source fragment illustrates structure markup
   of a theory.  Note that {\LaTeX} labels may be included inside of
   section headings as well.
 
   \begin{ttbox}
   section {\ttlbrace}* Some properties of Foo Bar elements *{\ttrbrace}
 
   theory Foo_Bar
   imports Main
   begin
 
   subsection {\ttlbrace}* Basic definitions *{\ttrbrace}
 
   definition foo :: \dots
 
   definition bar :: \dots
 
   subsection {\ttlbrace}* Derived rules *{\ttrbrace}
 
   lemma fooI: \dots
   lemma fooE: \dots
 
   subsection {\ttlbrace}* Main theorem {\ttback}label{\ttlbrace}sec:main-theorem{\ttrbrace} *{\ttrbrace}
 
   theorem main: \dots
 
   end
   \end{ttbox}
 \<close>
 
 
 subsection \<open>Formal Comments and Antiquotations \label{sec:doc-prep-text}\<close>
 
 text \<open>
   Isabelle \bfindex{source comments}, which are of the form
   \verb,(,\verb,*,~\<open>\<dots>\<close>~\verb,*,\verb,),, essentially act like
   white space and do not really contribute to the content.  They
   mainly serve technical purposes to mark certain oddities in the raw
   input text.  In contrast, \bfindex{formal comments} are portions of
   text that are associated with formal Isabelle/Isar commands
   (\bfindex{marginal comments}), or as standalone paragraphs within a
   theory or proof context (\bfindex{text blocks}).
 
   \medskip Marginal comments are part of each command's concrete
-  syntax @{cite "isabelle-isar-ref"}; the common form is ``\verb,--,~$text$''
+  syntax \<^cite>\<open>"isabelle-isar-ref"\<close>; the common form is ``\verb,--,~$text$''
   where $text$ is delimited by \verb,",\<open>\<dots>\<close>\verb,", or
   \verb,{,\verb,*,~\<open>\<dots>\<close>~\verb,*,\verb,}, as before.  Multiple
   marginal comments may be given at the same time.  Here is a simple
   example:
 \<close>
 
 lemma "A --> A"
   \<comment> \<open>a triviality of propositional logic\<close>
   \<comment> \<open>(should not really bother)\<close>
   by (rule impI) \<comment> \<open>implicit assumption step involved here\<close>
 
 text \<open>
   \noindent The above output has been produced as follows:
 
 \begin{verbatim}
   lemma "A --> A"
     -- "a triviality of propositional logic"
     -- "(should not really bother)"
     by (rule impI) -- "implicit assumption step involved here"
 \end{verbatim}
 
   From the {\LaTeX} viewpoint, ``\verb,--,'' acts like a markup
   command, associated with the macro \verb,\isamarkupcmt, (taking a
   single argument).
 
   \medskip Text blocks are introduced by the commands \bfindex{text}
   and \bfindex{txt}. Each takes again a single $text$ argument,
   which is interpreted as a free-form paragraph in {\LaTeX}
   (surrounded by some additional vertical space).  The typesetting
   may be changed by redefining the {\LaTeX} environments of
   \verb,isamarkuptext, or \verb,isamarkuptxt,, respectively
   (via \verb,\renewenvironment,).
 
   \medskip The $text$ part of Isabelle markup commands essentially
   inserts \emph{quoted material} into a formal text, mainly for
   instruction of the reader.  An \bfindex{antiquotation} is again a
   formal object embedded into such an informal portion.  The
   interpretation of antiquotations is limited to some well-formedness
   checks, with the result being pretty printed to the resulting
   document.  Quoted text blocks together with antiquotations provide
   an attractive means of referring to formal entities, with good
   confidence in getting the technical details right (especially syntax
   and types).
 
   The general syntax of antiquotations is as follows:
   \texttt{{\at}{\ttlbrace}$name$ $arguments${\ttrbrace}}, or
   \texttt{{\at}{\ttlbrace}$name$ [$options$] $arguments${\ttrbrace}}
   for a comma-separated list of options consisting of a $name$ or
   \texttt{$name$=$value$} each.  The syntax of $arguments$ depends on
   the kind of antiquotation, it generally follows the same conventions
   for types, terms, or theorems as in the formal part of a theory.
 
   \medskip This sentence demonstrates quotations and antiquotations:
   \<^term>\<open>%x y. x\<close> is a well-typed term.
 
   \medskip\noindent The output above was produced as follows:
   \begin{ttbox}
 text {\ttlbrace}*
   This sentence demonstrates quotations and antiquotations:
   {\at}{\ttlbrace}term "%x y. x"{\ttrbrace} is a well-typed term.
 *{\ttrbrace}
   \end{ttbox}\vspace{-\medskipamount}
 
   The notational change from the ASCII character~\verb,%, to the
   symbol~\<open>\<lambda>\<close> reveals that Isabelle printed this term, after
   parsing and type-checking.  Document preparation enables symbolic
   output by default.
 
   \medskip The next example includes an option to show the type of all
   variables.  The antiquotation
   \texttt{{\at}}\verb,{term [show_types] "%x y. x"}, produces the
   output @{term [show_types] "%x y. x"}.  Type inference has figured
   out the most general typings in the present theory context.  Terms
   may acquire different typings due to constraints imposed by their
   environment; within a proof, for example, variables are given the
   same types as they have in the main goal statement.
 
   \medskip Several further kinds of antiquotations and options are
-  available @{cite "isabelle-isar-ref"}.  Here are a few commonly used
+  available \<^cite>\<open>"isabelle-isar-ref"\<close>.  Here are a few commonly used
   combinations:
 
   \medskip
 
   \begin{tabular}{ll}
   \texttt{\at}\verb,{typ,~$\tau$\verb,}, & print type $\tau$ \\
   \texttt{\at}\verb,{const,~$c$\verb,}, & check existence of $c$ and print it \\
   \texttt{\at}\verb,{term,~$t$\verb,}, & print term $t$ \\
   \texttt{\at}\verb,{prop,~$\phi$\verb,}, & print proposition $\phi$ \\
   \texttt{\at}\verb,{prop [display],~$\phi$\verb,}, & print large proposition $\phi$ (with linebreaks) \\
   \texttt{\at}\verb,{prop [source],~$\phi$\verb,}, & check proposition $\phi$, print its input \\
   \texttt{\at}\verb,{thm,~$a$\verb,}, & print fact $a$ \\
   \texttt{\at}\verb,{thm,~$a$~\verb,[no_vars]}, & print fact $a$, fixing schematic variables \\
   \texttt{\at}\verb,{thm [source],~$a$\verb,}, & check availability of fact $a$, print its name \\
   \texttt{\at}\verb,{text,~$s$\verb,}, & print uninterpreted text $s$ \\
   \end{tabular}
 
   \medskip
 
   Note that \attrdx{no_vars} given above is \emph{not} an
   antiquotation option, but an attribute of the theorem argument given
   here.  This might be useful with a diagnostic command like
   \isakeyword{thm}, too.
 
   \medskip The \texttt{\at}\verb,{text, $s$\verb,}, antiquotation is
   particularly interesting.  Embedding uninterpreted text within an
   informal body might appear useless at first sight.  Here the key
   virtue is that the string $s$ is processed as Isabelle output,
   interpreting Isabelle symbols appropriately.
 
   For example, \texttt{\at}\verb,{text "\<forall>\<exists>"}, produces \<open>\<forall>\<exists>\<close>, according to the standard interpretation of these symbol
   (cf.\ \S\ref{sec:doc-prep-symbols}).  Thus we achieve consistent
   mathematical notation in both the formal and informal parts of the
   document very easily, independently of the term language of
   Isabelle.  Manual {\LaTeX} code would leave more control over the
   typesetting, but is also slightly more tedious.
 \<close>
 
 
 subsection \<open>Interpretation of Symbols \label{sec:doc-prep-symbols}\<close>
 
 text \<open>
   As has been pointed out before (\S\ref{sec:syntax-symbols}),
   Isabelle symbols are the smallest syntactic entities --- a
   straightforward generalization of ASCII characters.  While Isabelle
   does not impose any interpretation of the infinite collection of
   named symbols, {\LaTeX} documents use canonical glyphs for certain
-  standard symbols @{cite "isabelle-isar-ref"}.
+  standard symbols \<^cite>\<open>"isabelle-isar-ref"\<close>.
 
   The {\LaTeX} code produced from Isabelle text follows a simple
   scheme.  You can tune the final appearance by redefining certain
   macros, say in \texttt{root.tex} of the document.
 
   \begin{enumerate}
 
   \item 7-bit ASCII characters: letters \texttt{A\dots Z} and
   \texttt{a\dots z} are output directly, digits are passed as an
   argument to the \verb,\isadigit, macro, other characters are
   replaced by specifically named macros of the form
   \verb,\isacharXYZ,.
 
   \item Named symbols: \verb,\,\verb,<XYZ>, is turned into
   \verb,{\isasymXYZ},; note the additional braces.
 
   \item Named control symbols: \verb,\,\verb,<^XYZ>, is turned into
   \verb,\isactrlXYZ,; subsequent symbols may act as arguments if the
   control macro is defined accordingly.
 
   \end{enumerate}
 
   You may occasionally wish to give new {\LaTeX} interpretations of
   named symbols.  This merely requires an appropriate definition of
   \verb,\isasymXYZ,, for \verb,\,\verb,<XYZ>, (see
   \texttt{isabelle.sty} for working examples).  Control symbols are
   slightly more difficult to get right, though.
 
   \medskip The \verb,\isabellestyle, macro provides a high-level
   interface to tune the general appearance of individual symbols.  For
   example, \verb,\isabellestyle{it}, uses the italics text style to
   mimic the general appearance of the {\LaTeX} math mode; double
   quotes are not printed at all.  The resulting quality of typesetting
   is quite good, so this should be the default style for work that
   gets distributed to a broader audience.
 \<close>
 
 
 subsection \<open>Suppressing Output \label{sec:doc-prep-suppress}\<close>
 
 text \<open>
   By default, Isabelle's document system generates a {\LaTeX} file for
   each theory that gets loaded while running the session.  The
   generated \texttt{session.tex} will include all of these in order of
   appearance, which in turn gets included by the standard
   \texttt{root.tex}.  Certainly one may change the order or suppress
   unwanted theories by ignoring \texttt{session.tex} and load
   individual files directly in \texttt{root.tex}.  On the other hand,
   such an arrangement requires additional maintenance whenever the
   collection of theories changes.
 
   Alternatively, one may tune the theory loading process in
   \texttt{ROOT} itself: some sequential order of \textbf{theories}
   sections may enforce a certain traversal of the dependency graph,
   although this could degrade parallel processing.  The nodes of each
   sub-graph that is specified here are presented in some topological
   order of their formal dependencies.
 
   Moreover, the system build option \verb,document=false, allows to
   disable document generation for some theories.  Its usage in the
   session \texttt{ROOT} is like this:
 
 \begin{verbatim}
   theories [document = false] T
 \end{verbatim}
 
   \medskip Theory output may be suppressed more selectively, either
   via \bfindex{tagged command regions} or \bfindex{ignored material}.
 
   Tagged command regions works by annotating commands with named tags,
   which correspond to certain {\LaTeX} markup that tells how to treat
   particular parts of a document when doing the actual type-setting.
   By default, certain Isabelle/Isar commands are implicitly marked up
   using the predefined tags ``\emph{theory}'' (for theory begin and
   end), ``\emph{proof}'' (for proof commands), and ``\emph{ML}'' (for
   commands involving ML code).  Users may add their own tags using the
   \verb,%,\emph{tag} notation right after a command name.  In the
   subsequent example we hide a particularly irrelevant proof:
 \<close>
 
 lemma "x = x" by %invisible (simp)
 
 text \<open>
   The original source has been ``\verb,lemma "x = x" by %invisible (simp),''.
   Tags observe the structure of proofs; adjacent commands with the
   same tag are joined into a single region.  The Isabelle document
   preparation system allows the user to specify how to interpret a
   tagged region, in order to keep, drop, or fold the corresponding
   parts of the document.  See the \emph{Isabelle System Manual}
-  @{cite "isabelle-system"} for further details, especially on
+  \<^cite>\<open>"isabelle-system"\<close> for further details, especially on
   \texttt{isabelle build} and \texttt{isabelle document}.
 
   Ignored material is specified by delimiting the original formal
   source with special source comments
   \verb,(,\verb,*,\verb,<,\verb,*,\verb,), and
   \verb,(,\verb,*,\verb,>,\verb,*,\verb,),.  These parts are stripped
   before the type-setting phase, without affecting the formal checking
   of the theory, of course.  For example, we may hide parts of a proof
   that seem unfit for general public inspection.  The following
   ``fully automatic'' proof is actually a fake:
 \<close>
 
 lemma "x \<noteq> (0::int) \<Longrightarrow> 0 < x * x"
   by (auto(*<*)simp add: zero_less_mult_iff(*>*))
 
 text \<open>
   \noindent The real source of the proof has been as follows:
 
 \begin{verbatim}
   by (auto(*<*)simp add: zero_less_mult_iff(*>*))
 \end{verbatim}
 %(*
 
   \medskip Suppressing portions of printed text demands care.  You
   should not misrepresent the underlying theory development.  It is
   easy to invalidate the visible text by hiding references to
   questionable axioms, for example.
 \<close>
 
 (*<*)
 end
 (*>*)
diff --git a/src/Doc/Tutorial/Fun/fun0.thy b/src/Doc/Tutorial/Fun/fun0.thy
--- a/src/Doc/Tutorial/Fun/fun0.thy
+++ b/src/Doc/Tutorial/Fun/fun0.thy
@@ -1,260 +1,260 @@
 (*<*)
 theory fun0 imports Main begin
 (*>*)
 
 text\<open>
 \subsection{Definition}
 \label{sec:fun-examples}
 
 Here is a simple example, the \rmindex{Fibonacci function}:
 \<close>
 
 fun fib :: "nat \<Rightarrow> nat" where
 "fib 0 = 0" |
 "fib (Suc 0) = 1" |
 "fib (Suc(Suc x)) = fib x + fib (Suc x)"
 
 text\<open>\noindent
 This resembles ordinary functional programming languages. Note the obligatory
 \isacommand{where} and \isa{|}. Command \isacommand{fun} declares and
 defines the function in one go. Isabelle establishes termination automatically
 because \<^const>\<open>fib\<close>'s argument decreases in every recursive call.
 
 Slightly more interesting is the insertion of a fixed element
 between any two elements of a list:
 \<close>
 
 fun sep :: "'a \<Rightarrow> 'a list \<Rightarrow> 'a list" where
 "sep a []     = []" |
 "sep a [x]    = [x]" |
 "sep a (x#y#zs) = x # a # sep a (y#zs)"
 
 text\<open>\noindent
 This time the length of the list decreases with the
 recursive call; the first argument is irrelevant for termination.
 
 Pattern matching\index{pattern matching!and \isacommand{fun}}
 need not be exhaustive and may employ wildcards:
 \<close>
 
 fun last :: "'a list \<Rightarrow> 'a" where
 "last [x]      = x" |
 "last (_#y#zs) = last (y#zs)"
 
 text\<open>
 Overlapping patterns are disambiguated by taking the order of equations into
 account, just as in functional programming:
 \<close>
 
 fun sep1 :: "'a \<Rightarrow> 'a list \<Rightarrow> 'a list" where
 "sep1 a (x#y#zs) = x # a # sep1 a (y#zs)" |
 "sep1 _ xs       = xs"
 
 text\<open>\noindent
 To guarantee that the second equation can only be applied if the first
 one does not match, Isabelle internally replaces the second equation
 by the two possibilities that are left: \<^prop>\<open>sep1 a [] = []\<close> and
 \<^prop>\<open>sep1 a [x] = [x]\<close>.  Thus the functions \<^const>\<open>sep\<close> and
 \<^const>\<open>sep1\<close> are identical.
 
 Because of its pattern matching syntax, \isacommand{fun} is also useful
 for the definition of non-recursive functions:
 \<close>
 
 fun swap12 :: "'a list \<Rightarrow> 'a list" where
 "swap12 (x#y#zs) = y#x#zs" |
 "swap12 zs       = zs"
 
 text\<open>
 After a function~$f$ has been defined via \isacommand{fun},
 its defining equations (or variants derived from them) are available
 under the name $f$\<open>.simps\<close> as theorems.
 For example, look (via \isacommand{thm}) at
 @{thm[source]sep.simps} and @{thm[source]sep1.simps} to see that they define
 the same function. What is more, those equations are automatically declared as
 simplification rules.
 
 \subsection{Termination}
 
 Isabelle's automatic termination prover for \isacommand{fun} has a
 fixed notion of the \emph{size} (of type \<^typ>\<open>nat\<close>) of an
 argument. The size of a natural number is the number itself. The size
 of a list is its length. For the general case see \S\ref{sec:general-datatype}.
 A recursive function is accepted if \isacommand{fun} can
 show that the size of one fixed argument becomes smaller with each
 recursive call.
 
 More generally, \isacommand{fun} allows any \emph{lexicographic
 combination} of size measures in case there are multiple
 arguments. For example, the following version of \rmindex{Ackermann's
 function} is accepted:\<close>
 
 fun ack2 :: "nat \<Rightarrow> nat \<Rightarrow> nat" where
 "ack2 n 0 = Suc n" |
 "ack2 0 (Suc m) = ack2 (Suc 0) m" |
 "ack2 (Suc n) (Suc m) = ack2 (ack2 n (Suc m)) m"
 
 text\<open>The order of arguments has no influence on whether
 \isacommand{fun} can prove termination of a function. For more details
-see elsewhere~@{cite bulwahnKN07}.
+see elsewhere~\<^cite>\<open>bulwahnKN07\<close>.
 
 \subsection{Simplification}
 \label{sec:fun-simplification}
 
 Upon a successful termination proof, the recursion equations become
 simplification rules, just as with \isacommand{primrec}.
 In most cases this works fine, but there is a subtle
 problem that must be mentioned: simplification may not
 terminate because of automatic splitting of \<open>if\<close>.
 \index{*if expressions!splitting of}
 Let us look at an example:
 \<close>
 
 fun gcd :: "nat \<Rightarrow> nat \<Rightarrow> nat" where
 "gcd m n = (if n=0 then m else gcd n (m mod n))"
 
 text\<open>\noindent
 The second argument decreases with each recursive call.
 The termination condition
 @{prop[display]"n ~= (0::nat) ==> m mod n < n"}
 is proved automatically because it is already present as a lemma in
 HOL\@.  Thus the recursion equation becomes a simplification
 rule. Of course the equation is nonterminating if we are allowed to unfold
 the recursive call inside the \<open>else\<close> branch, which is why programming
 languages and our simplifier don't do that. Unfortunately the simplifier does
 something else that leads to the same problem: it splits 
 each \<open>if\<close>-expression unless its
 condition simplifies to \<^term>\<open>True\<close> or \<^term>\<open>False\<close>.  For
 example, simplification reduces
 @{prop[display]"gcd m n = k"}
 in one step to
 @{prop[display]"(if n=0 then m else gcd n (m mod n)) = k"}
 where the condition cannot be reduced further, and splitting leads to
 @{prop[display]"(n=0 --> m=k) & (n ~= 0 --> gcd n (m mod n)=k)"}
 Since the recursive call \<^term>\<open>gcd n (m mod n)\<close> is no longer protected by
 an \<open>if\<close>, it is unfolded again, which leads to an infinite chain of
 simplification steps. Fortunately, this problem can be avoided in many
 different ways.
 
 The most radical solution is to disable the offending theorem
 @{thm[source]if_split},
 as shown in \S\ref{sec:AutoCaseSplits}.  However, we do not recommend this
 approach: you will often have to invoke the rule explicitly when
 \<open>if\<close> is involved.
 
 If possible, the definition should be given by pattern matching on the left
 rather than \<open>if\<close> on the right. In the case of \<^term>\<open>gcd\<close> the
 following alternative definition suggests itself:
 \<close>
 
 fun gcd1 :: "nat \<Rightarrow> nat \<Rightarrow> nat" where
 "gcd1 m 0 = m" |
 "gcd1 m n = gcd1 n (m mod n)"
 
 text\<open>\noindent
 The order of equations is important: it hides the side condition
 \<^prop>\<open>n ~= (0::nat)\<close>.  Unfortunately, not all conditionals can be
 expressed by pattern matching.
 
 A simple alternative is to replace \<open>if\<close> by \<open>case\<close>, 
 which is also available for \<^typ>\<open>bool\<close> and is not split automatically:
 \<close>
 
 fun gcd2 :: "nat \<Rightarrow> nat \<Rightarrow> nat" where
 "gcd2 m n = (case n=0 of True \<Rightarrow> m | False \<Rightarrow> gcd2 n (m mod n))"
 
 text\<open>\noindent
 This is probably the neatest solution next to pattern matching, and it is
 always available.
 
 A final alternative is to replace the offending simplification rules by
 derived conditional ones. For \<^term>\<open>gcd\<close> it means we have to prove
 these lemmas:
 \<close>
 
 lemma [simp]: "gcd m 0 = m"
 apply(simp)
 done
 
 lemma [simp]: "n \<noteq> 0 \<Longrightarrow> gcd m n = gcd n (m mod n)"
 apply(simp)
 done
 
 text\<open>\noindent
 Simplification terminates for these proofs because the condition of the \<open>if\<close> simplifies to \<^term>\<open>True\<close> or \<^term>\<open>False\<close>.
 Now we can disable the original simplification rule:
 \<close>
 
 declare gcd.simps [simp del]
 
 text\<open>
 \index{induction!recursion|(}
 \index{recursion induction|(}
 
 \subsection{Induction}
 \label{sec:fun-induction}
 
 Having defined a function we might like to prove something about it.
 Since the function is recursive, the natural proof principle is
 again induction. But this time the structural form of induction that comes
 with datatypes is unlikely to work well --- otherwise we could have defined the
 function by \isacommand{primrec}. Therefore \isacommand{fun} automatically
 proves a suitable induction rule $f$\<open>.induct\<close> that follows the
 recursion pattern of the particular function $f$. We call this
 \textbf{recursion induction}. Roughly speaking, it
 requires you to prove for each \isacommand{fun} equation that the property
 you are trying to establish holds for the left-hand side provided it holds
 for all recursive calls on the right-hand side. Here is a simple example
 involving the predefined \<^term>\<open>map\<close> functional on lists:
 \<close>
 
 lemma "map f (sep x xs) = sep (f x) (map f xs)"
 
 txt\<open>\noindent
 Note that \<^term>\<open>map f xs\<close>
 is the result of applying \<^term>\<open>f\<close> to all elements of \<^term>\<open>xs\<close>. We prove
 this lemma by recursion induction over \<^term>\<open>sep\<close>:
 \<close>
 
 apply(induct_tac x xs rule: sep.induct)
 
 txt\<open>\noindent
 The resulting proof state has three subgoals corresponding to the three
 clauses for \<^term>\<open>sep\<close>:
 @{subgoals[display,indent=0]}
 The rest is pure simplification:
 \<close>
 
 apply simp_all
 done
 
 text\<open>\noindent The proof goes smoothly because the induction rule
 follows the recursion of \<^const>\<open>sep\<close>.  Try proving the above lemma by
 structural induction, and you find that you need an additional case
 distinction.
 
 In general, the format of invoking recursion induction is
 \begin{quote}
 \isacommand{apply}\<open>(induct_tac\<close> $x@1 \dots x@n$ \<open>rule:\<close> $f$\<open>.induct)\<close>
 \end{quote}\index{*induct_tac (method)}%
 where $x@1~\dots~x@n$ is a list of free variables in the subgoal and $f$ the
 name of a function that takes $n$ arguments. Usually the subgoal will
 contain the term $f x@1 \dots x@n$ but this need not be the case. The
 induction rules do not mention $f$ at all. Here is @{thm[source]sep.induct}:
 \begin{isabelle}
 {\isasymlbrakk}~{\isasymAnd}a.~P~a~[];\isanewline
 ~~{\isasymAnd}a~x.~P~a~[x];\isanewline
 ~~{\isasymAnd}a~x~y~zs.~P~a~(y~\#~zs)~{\isasymLongrightarrow}~P~a~(x~\#~y~\#~zs){\isasymrbrakk}\isanewline
 {\isasymLongrightarrow}~P~u~v%
 \end{isabelle}
 It merely says that in order to prove a property \<^term>\<open>P\<close> of \<^term>\<open>u\<close> and
 \<^term>\<open>v\<close> you need to prove it for the three cases where \<^term>\<open>v\<close> is the
 empty list, the singleton list, and the list with at least two elements.
 The final case has an induction hypothesis:  you may assume that \<^term>\<open>P\<close>
 holds for the tail of that list.
 \index{induction!recursion|)}
 \index{recursion induction|)}
 \<close>
 (*<*)
 end
 (*>*)
diff --git a/src/Doc/Tutorial/Inductive/AB.thy b/src/Doc/Tutorial/Inductive/AB.thy
--- a/src/Doc/Tutorial/Inductive/AB.thy
+++ b/src/Doc/Tutorial/Inductive/AB.thy
@@ -1,304 +1,304 @@
 (*<*)theory AB imports Main begin(*>*)
 
 section\<open>Case Study: A Context Free Grammar\<close>
 
 text\<open>\label{sec:CFG}
 \index{grammars!defining inductively|(}%
 Grammars are nothing but shorthands for inductive definitions of nonterminals
 which represent sets of strings. For example, the production
 $A \to B c$ is short for
 \[ w \in B \Longrightarrow wc \in A \]
 This section demonstrates this idea with an example
 due to Hopcroft and Ullman, a grammar for generating all words with an
 equal number of $a$'s and~$b$'s:
 \begin{eqnarray}
 S &\to& \epsilon \mid b A \mid a B \nonumber\\
 A &\to& a S \mid b A A \nonumber\\
 B &\to& b S \mid a B B \nonumber
 \end{eqnarray}
 At the end we say a few words about the relationship between
-the original proof @{cite \<open>p.\ts81\<close> HopcroftUllman} and our formal version.
+the original proof \<^cite>\<open>\<open>p.\ts81\<close> in HopcroftUllman\<close> and our formal version.
 
 We start by fixing the alphabet, which consists only of \<^term>\<open>a\<close>'s
 and~\<^term>\<open>b\<close>'s:
 \<close>
 
 datatype alfa = a | b
 
 text\<open>\noindent
 For convenience we include the following easy lemmas as simplification rules:
 \<close>
 
 lemma [simp]: "(x \<noteq> a) = (x = b) \<and> (x \<noteq> b) = (x = a)"
 by (case_tac x, auto)
 
 text\<open>\noindent
 Words over this alphabet are of type \<^typ>\<open>alfa list\<close>, and
 the three nonterminals are declared as sets of such words.
 The productions above are recast as a \emph{mutual} inductive
 definition\index{inductive definition!simultaneous}
 of \<^term>\<open>S\<close>, \<^term>\<open>A\<close> and~\<^term>\<open>B\<close>:
 \<close>
 
 inductive_set
   S :: "alfa list set" and
   A :: "alfa list set" and
   B :: "alfa list set"
 where
   "[] \<in> S"
 | "w \<in> A \<Longrightarrow> b#w \<in> S"
 | "w \<in> B \<Longrightarrow> a#w \<in> S"
 
 | "w \<in> S        \<Longrightarrow> a#w   \<in> A"
 | "\<lbrakk> v\<in>A; w\<in>A \<rbrakk> \<Longrightarrow> b#v@w \<in> A"
 
 | "w \<in> S            \<Longrightarrow> b#w   \<in> B"
 | "\<lbrakk> v \<in> B; w \<in> B \<rbrakk> \<Longrightarrow> a#v@w \<in> B"
 
 text\<open>\noindent
 First we show that all words in \<^term>\<open>S\<close> contain the same number of \<^term>\<open>a\<close>'s and \<^term>\<open>b\<close>'s. Since the definition of \<^term>\<open>S\<close> is by mutual
 induction, so is the proof: we show at the same time that all words in
 \<^term>\<open>A\<close> contain one more \<^term>\<open>a\<close> than \<^term>\<open>b\<close> and all words in \<^term>\<open>B\<close> contain one more \<^term>\<open>b\<close> than \<^term>\<open>a\<close>.
 \<close>
 
 lemma correctness:
   "(w \<in> S \<longrightarrow> size[x\<leftarrow>w. x=a] = size[x\<leftarrow>w. x=b])     \<and>
    (w \<in> A \<longrightarrow> size[x\<leftarrow>w. x=a] = size[x\<leftarrow>w. x=b] + 1) \<and>
    (w \<in> B \<longrightarrow> size[x\<leftarrow>w. x=b] = size[x\<leftarrow>w. x=a] + 1)"
 
 txt\<open>\noindent
 These propositions are expressed with the help of the predefined \<^term>\<open>filter\<close> function on lists, which has the convenient syntax \<open>[x\<leftarrow>xs. P
 x]\<close>, the list of all elements \<^term>\<open>x\<close> in \<^term>\<open>xs\<close> such that \<^prop>\<open>P x\<close>
 holds. Remember that on lists \<open>size\<close> and \<open>length\<close> are synonymous.
 
 The proof itself is by rule induction and afterwards automatic:
 \<close>
 
 by (rule S_A_B.induct, auto)
 
 text\<open>\noindent
 This may seem surprising at first, and is indeed an indication of the power
 of inductive definitions. But it is also quite straightforward. For example,
 consider the production $A \to b A A$: if $v,w \in A$ and the elements of $A$
 contain one more $a$ than~$b$'s, then $bvw$ must again contain one more $a$
 than~$b$'s.
 
 As usual, the correctness of syntactic descriptions is easy, but completeness
 is hard: does \<^term>\<open>S\<close> contain \emph{all} words with an equal number of
 \<^term>\<open>a\<close>'s and \<^term>\<open>b\<close>'s? It turns out that this proof requires the
 following lemma: every string with two more \<^term>\<open>a\<close>'s than \<^term>\<open>b\<close>'s can be cut somewhere such that each half has one more \<^term>\<open>a\<close> than
 \<^term>\<open>b\<close>. This is best seen by imagining counting the difference between the
 number of \<^term>\<open>a\<close>'s and \<^term>\<open>b\<close>'s starting at the left end of the
 word. We start with 0 and end (at the right end) with 2. Since each move to the
 right increases or decreases the difference by 1, we must have passed through
 1 on our way from 0 to 2. Formally, we appeal to the following discrete
 intermediate value theorem @{thm[source]nat0_intermed_int_val}
 @{thm[display,margin=60]nat0_intermed_int_val[no_vars]}
 where \<^term>\<open>f\<close> is of type \<^typ>\<open>nat \<Rightarrow> int\<close>, \<^typ>\<open>int\<close> are the integers,
 \<open>\<bar>.\<bar>\<close> is the absolute value function\footnote{See
 Table~\ref{tab:ascii} in the Appendix for the correct \textsc{ascii}
 syntax.}, and \<^term>\<open>1::int\<close> is the integer 1 (see \S\ref{sec:numbers}).
 
 First we show that our specific function, the difference between the
 numbers of \<^term>\<open>a\<close>'s and \<^term>\<open>b\<close>'s, does indeed only change by 1 in every
 move to the right. At this point we also start generalizing from \<^term>\<open>a\<close>'s
 and \<^term>\<open>b\<close>'s to an arbitrary property \<^term>\<open>P\<close>. Otherwise we would have
 to prove the desired lemma twice, once as stated above and once with the
 roles of \<^term>\<open>a\<close>'s and \<^term>\<open>b\<close>'s interchanged.
 \<close>
 
 lemma step1: "\<forall>i < size w.
   \<bar>(int(size[x\<leftarrow>take (i+1) w. P x])-int(size[x\<leftarrow>take (i+1) w. \<not>P x]))
    - (int(size[x\<leftarrow>take i w. P x])-int(size[x\<leftarrow>take i w. \<not>P x]))\<bar> \<le> 1"
 
 txt\<open>\noindent
 The lemma is a bit hard to read because of the coercion function
 \<open>int :: nat \<Rightarrow> int\<close>. It is required because \<^term>\<open>size\<close> returns
 a natural number, but subtraction on type~\<^typ>\<open>nat\<close> will do the wrong thing.
 Function \<^term>\<open>take\<close> is predefined and \<^term>\<open>take i xs\<close> is the prefix of
 length \<^term>\<open>i\<close> of \<^term>\<open>xs\<close>; below we also need \<^term>\<open>drop i xs\<close>, which
 is what remains after that prefix has been dropped from \<^term>\<open>xs\<close>.
 
 The proof is by induction on \<^term>\<open>w\<close>, with a trivial base case, and a not
 so trivial induction step. Since it is essentially just arithmetic, we do not
 discuss it.
 \<close>
 
 apply(induct_tac w)
 apply(auto simp add: abs_if take_Cons split: nat.split)
 done
 
 text\<open>
 Finally we come to the above-mentioned lemma about cutting in half a word with two more elements of one sort than of the other sort:
 \<close>
 
 lemma part1:
  "size[x\<leftarrow>w. P x] = size[x\<leftarrow>w. \<not>P x]+2 \<Longrightarrow>
   \<exists>i\<le>size w. size[x\<leftarrow>take i w. P x] = size[x\<leftarrow>take i w. \<not>P x]+1"
 
 txt\<open>\noindent
 This is proved by \<open>force\<close> with the help of the intermediate value theorem,
 instantiated appropriately and with its first premise disposed of by lemma
 @{thm[source]step1}:
 \<close>
 
 apply(insert nat0_intermed_int_val[OF step1, of "P" "w" "1"])
 by force
 
 text\<open>\noindent
 
 Lemma @{thm[source]part1} tells us only about the prefix \<^term>\<open>take i w\<close>.
 An easy lemma deals with the suffix \<^term>\<open>drop i w\<close>:
 \<close>
 
 
 lemma part2:
   "\<lbrakk>size[x\<leftarrow>take i w @ drop i w. P x] =
     size[x\<leftarrow>take i w @ drop i w. \<not>P x]+2;
     size[x\<leftarrow>take i w. P x] = size[x\<leftarrow>take i w. \<not>P x]+1\<rbrakk>
    \<Longrightarrow> size[x\<leftarrow>drop i w. P x] = size[x\<leftarrow>drop i w. \<not>P x]+1"
 by(simp del: append_take_drop_id)
 
 text\<open>\noindent
 In the proof we have disabled the normally useful lemma
 \begin{isabelle}
 @{thm append_take_drop_id[no_vars]}
 \rulename{append_take_drop_id}
 \end{isabelle}
 to allow the simplifier to apply the following lemma instead:
 @{text[display]"[x\<in>xs@ys. P x] = [x\<in>xs. P x] @ [x\<in>ys. P x]"}
 
 To dispose of trivial cases automatically, the rules of the inductive
 definition are declared simplification rules:
 \<close>
 
 declare S_A_B.intros[simp]
 
 text\<open>\noindent
 This could have been done earlier but was not necessary so far.
 
 The completeness theorem tells us that if a word has the same number of
 \<^term>\<open>a\<close>'s and \<^term>\<open>b\<close>'s, then it is in \<^term>\<open>S\<close>, and similarly 
 for \<^term>\<open>A\<close> and \<^term>\<open>B\<close>:
 \<close>
 
 theorem completeness:
   "(size[x\<leftarrow>w. x=a] = size[x\<leftarrow>w. x=b]     \<longrightarrow> w \<in> S) \<and>
    (size[x\<leftarrow>w. x=a] = size[x\<leftarrow>w. x=b] + 1 \<longrightarrow> w \<in> A) \<and>
    (size[x\<leftarrow>w. x=b] = size[x\<leftarrow>w. x=a] + 1 \<longrightarrow> w \<in> B)"
 
 txt\<open>\noindent
 The proof is by induction on \<^term>\<open>w\<close>. Structural induction would fail here
 because, as we can see from the grammar, we need to make bigger steps than
 merely appending a single letter at the front. Hence we induct on the length
 of \<^term>\<open>w\<close>, using the induction rule @{thm[source]length_induct}:
 \<close>
 
 apply(induct_tac w rule: length_induct)
 apply(rename_tac w)
 
 txt\<open>\noindent
 The \<open>rule\<close> parameter tells \<open>induct_tac\<close> explicitly which induction
 rule to use. For details see \S\ref{sec:complete-ind} below.
 In this case the result is that we may assume the lemma already
 holds for all words shorter than \<^term>\<open>w\<close>. Because the induction step renames
 the induction variable we rename it back to \<open>w\<close>.
 
 The proof continues with a case distinction on \<^term>\<open>w\<close>,
 on whether \<^term>\<open>w\<close> is empty or not.
 \<close>
 
 apply(case_tac w)
  apply(simp_all)
 (*<*)apply(rename_tac x v)(*>*)
 
 txt\<open>\noindent
 Simplification disposes of the base case and leaves only a conjunction
 of two step cases to be proved:
 if \<^prop>\<open>w = a#v\<close> and @{prop[display]"size[x\<in>v. x=a] = size[x\<in>v. x=b]+2"} then
 \<^prop>\<open>b#v \<in> A\<close>, and similarly for \<^prop>\<open>w = b#v\<close>.
 We only consider the first case in detail.
 
 After breaking the conjunction up into two cases, we can apply
 @{thm[source]part1} to the assumption that \<^term>\<open>w\<close> contains two more \<^term>\<open>a\<close>'s than \<^term>\<open>b\<close>'s.
 \<close>
 
 apply(rule conjI)
  apply(clarify)
  apply(frule part1[of "\<lambda>x. x=a", simplified])
  apply(clarify)
 txt\<open>\noindent
 This yields an index \<^prop>\<open>i \<le> length v\<close> such that
 @{prop[display]"length [x\<leftarrow>take i v . x = a] = length [x\<leftarrow>take i v . x = b] + 1"}
 With the help of @{thm[source]part2} it follows that
 @{prop[display]"length [x\<leftarrow>drop i v . x = a] = length [x\<leftarrow>drop i v . x = b] + 1"}
 \<close>
 
  apply(drule part2[of "\<lambda>x. x=a", simplified])
   apply(assumption)
 
 txt\<open>\noindent
 Now it is time to decompose \<^term>\<open>v\<close> in the conclusion \<^prop>\<open>b#v \<in> A\<close>
 into \<^term>\<open>take i v @ drop i v\<close>,
 \<close>
 
  apply(rule_tac n1=i and t=v in subst[OF append_take_drop_id])
 
 txt\<open>\noindent
 (the variables \<^term>\<open>n1\<close> and \<^term>\<open>t\<close> are the result of composing the
 theorems @{thm[source]subst} and @{thm[source]append_take_drop_id})
 after which the appropriate rule of the grammar reduces the goal
 to the two subgoals \<^prop>\<open>take i v \<in> A\<close> and \<^prop>\<open>drop i v \<in> A\<close>:
 \<close>
 
  apply(rule S_A_B.intros)
 
 txt\<open>
 Both subgoals follow from the induction hypothesis because both \<^term>\<open>take i
 v\<close> and \<^term>\<open>drop i v\<close> are shorter than \<^term>\<open>w\<close>:
 \<close>
 
   apply(force simp add: min_less_iff_disj)
  apply(force split: nat_diff_split)
 
 txt\<open>
 The case \<^prop>\<open>w = b#v\<close> is proved analogously:
 \<close>
 
 apply(clarify)
 apply(frule part1[of "\<lambda>x. x=b", simplified])
 apply(clarify)
 apply(drule part2[of "\<lambda>x. x=b", simplified])
  apply(assumption)
 apply(rule_tac n1=i and t=v in subst[OF append_take_drop_id])
 apply(rule S_A_B.intros)
  apply(force simp add: min_less_iff_disj)
 by(force simp add: min_less_iff_disj split: nat_diff_split)
 
 text\<open>
 We conclude this section with a comparison of our proof with 
 Hopcroft\index{Hopcroft, J. E.} and Ullman's\index{Ullman, J. D.}
-@{cite \<open>p.\ts81\<close> HopcroftUllman}.
+\<^cite>\<open>\<open>p.\ts81\<close> in HopcroftUllman\<close>.
 For a start, the textbook
 grammar, for no good reason, excludes the empty word, thus complicating
 matters just a little bit: they have 8 instead of our 7 productions.
 
 More importantly, the proof itself is different: rather than
 separating the two directions, they perform one induction on the
 length of a word. This deprives them of the beauty of rule induction,
 and in the easy direction (correctness) their reasoning is more
 detailed than our \<open>auto\<close>. For the hard part (completeness), they
 consider just one of the cases that our \<open>simp_all\<close> disposes of
 automatically. Then they conclude the proof by saying about the
 remaining cases: ``We do this in a manner similar to our method of
 proof for part (1); this part is left to the reader''. But this is
 precisely the part that requires the intermediate value theorem and
 thus is not at all similar to the other cases (which are automatic in
 Isabelle). The authors are at least cavalier about this point and may
 even have overlooked the slight difficulty lurking in the omitted
 cases.  Such errors are found in many pen-and-paper proofs when they
 are scrutinized formally.%
 \index{grammars!defining inductively|)}
 \<close>
 
 (*<*)end(*>*)
diff --git a/src/Doc/Tutorial/Protocol/NS_Public.thy b/src/Doc/Tutorial/Protocol/NS_Public.thy
--- a/src/Doc/Tutorial/Protocol/NS_Public.thy
+++ b/src/Doc/Tutorial/Protocol/NS_Public.thy
@@ -1,400 +1,400 @@
 (*  Author:     Lawrence C Paulson, Cambridge University Computer Laboratory
     Copyright   1996  University of Cambridge
 
 Inductive relation "ns_public" for the Needham-Schroeder Public-Key protocol.
 Version incorporating Lowe's fix (inclusion of B's identity in round 2).
 *)(*<*)
 theory NS_Public imports Public begin(*>*)
 
 section\<open>Modelling the Protocol \label{sec:modelling}\<close>
 
 text_raw \<open>
 \begin{figure}
 \begin{isabelle}
 \<close>
 
 inductive_set ns_public :: "event list set"
   where
 
    Nil:  "[] \<in> ns_public"
 
 
  | Fake: "\<lbrakk>evsf \<in> ns_public;  X \<in> synth (analz (knows Spy evsf))\<rbrakk>
           \<Longrightarrow> Says Spy B X  # evsf \<in> ns_public"
 
 
  | NS1:  "\<lbrakk>evs1 \<in> ns_public;  Nonce NA \<notin> used evs1\<rbrakk>
           \<Longrightarrow> Says A B (Crypt (pubK B) \<lbrace>Nonce NA, Agent A\<rbrace>)
                  # evs1  \<in>  ns_public"
 
 
  | NS2:  "\<lbrakk>evs2 \<in> ns_public;  Nonce NB \<notin> used evs2;
            Says A' B (Crypt (pubK B) \<lbrace>Nonce NA, Agent A\<rbrace>) \<in> set evs2\<rbrakk>
           \<Longrightarrow> Says B A (Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace>)
                 # evs2  \<in>  ns_public"
 
 
  | NS3:  "\<lbrakk>evs3 \<in> ns_public;
            Says A  B (Crypt (pubK B) \<lbrace>Nonce NA, Agent A\<rbrace>) \<in> set evs3;
            Says B' A (Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace>)
               \<in> set evs3\<rbrakk>
           \<Longrightarrow> Says A B (Crypt (pubK B) (Nonce NB)) # evs3 \<in> ns_public"
 
 text_raw \<open>
 \end{isabelle}
 \caption{An Inductive Protocol Definition}\label{fig:ns_public}
 \end{figure}
 \<close>
 
 text \<open>
 Let us formalize the Needham-Schroeder public-key protocol, as corrected by
 Lowe:
 \begin{alignat*%
 }{2}
   &1.&\quad  A\to B  &: \comp{Na,A}\sb{Kb} \\
   &2.&\quad  B\to A  &: \comp{Na,Nb,B}\sb{Ka} \\
   &3.&\quad  A\to B  &: \comp{Nb}\sb{Kb}
 \end{alignat*%
 }
 
 Each protocol step is specified by a rule of an inductive definition.  An
 event trace has type \<open>event list\<close>, so we declare the constant
 \<open>ns_public\<close> to be a set of such traces.
 
 Figure~\ref{fig:ns_public} presents the inductive definition.  The
 \<open>Nil\<close> rule introduces the empty trace.  The \<open>Fake\<close> rule models the
 adversary's sending a message built from components taken from past
 traffic, expressed using the functions \<open>synth\<close> and
 \<open>analz\<close>. 
 The next three rules model how honest agents would perform the three
 protocol steps.  
 
 Here is a detailed explanation of rule \<open>NS2\<close>.
 A trace containing an event of the form
 @{term [display,indent=5] "Says A' B (Crypt (pubK B) \<lbrace>Nonce NA, Agent A\<rbrace>)"}
 may be extended by an event of the form
 @{term [display,indent=5] "Says B A (Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace>)"}
 where \<open>NB\<close> is a fresh nonce: \<^term>\<open>Nonce NB \<notin> used evs2\<close>.
 Writing the sender as \<open>A'\<close> indicates that \<open>B\<close> does not 
 know who sent the message.  Calling the trace variable \<open>evs2\<close> rather
 than simply \<open>evs\<close> helps us know where we are in a proof after many
 case-splits: every subgoal mentioning \<open>evs2\<close> involves message~2 of the
 protocol.
 
 Benefits of this approach are simplicity and clarity.  The semantic model
 is set theory, proofs are by induction and the translation from the informal
 notation to the inductive rules is straightforward. 
 \<close>
 
 section\<open>Proving Elementary Properties \label{sec:regularity}\<close>
 
 (*<*)
 declare knows_Spy_partsEs [elim]
 declare analz_subset_parts [THEN subsetD, dest]
 declare Fake_parts_insert [THEN subsetD, dest]
 
 (*A "possibility property": there are traces that reach the end*)
 lemma "\<exists>NB. \<exists>evs \<in> ns_public. Says A B (Crypt (pubK B) (Nonce NB)) \<in> set evs"
 apply (intro exI bexI)
 apply (rule_tac [2] ns_public.Nil [THEN ns_public.NS1, THEN ns_public.NS2,
                                    THEN ns_public.NS3])
 by possibility
 
 
 (**** Inductive proofs about ns_public ****)
 
 (** Theorems of the form X \<notin> parts (knows Spy evs) imply that NOBODY
     sends messages containing X! **)
 
 (*Spy never sees another agent's private key! (unless it's bad at start)*)
 (*>*)
 
 text \<open>
 Secrecy properties can be hard to prove.  The conclusion of a typical
 secrecy theorem is 
 \<^term>\<open>X \<notin> analz (knows Spy evs)\<close>.  The difficulty arises from
 having to reason about \<open>analz\<close>, or less formally, showing that the spy
 can never learn~\<open>X\<close>.  Much easier is to prove that \<open>X\<close> can never
 occur at all.  Such \emph{regularity} properties are typically expressed
 using \<open>parts\<close> rather than \<open>analz\<close>.
 
 The following lemma states that \<open>A\<close>'s private key is potentially
 known to the spy if and only if \<open>A\<close> belongs to the set \<open>bad\<close> of
 compromised agents.  The statement uses \<open>parts\<close>: the very presence of
 \<open>A\<close>'s private key in a message, whether protected by encryption or
 not, is enough to confirm that \<open>A\<close> is compromised.  The proof, like
 nearly all protocol proofs, is by induction over traces.
 \<close>
 
 lemma Spy_see_priK [simp]:
       "evs \<in> ns_public
        \<Longrightarrow> (Key (priK A) \<in> parts (knows Spy evs)) = (A \<in> bad)"
 apply (erule ns_public.induct, simp_all)
 txt \<open>
 The induction yields five subgoals, one for each rule in the definition of
 \<open>ns_public\<close>.  The idea is to prove that the protocol property holds initially
 (rule \<open>Nil\<close>), is preserved by each of the legitimate protocol steps (rules
 \<open>NS1\<close>--\<open>3\<close>), and even is preserved in the face of anything the
 spy can do (rule \<open>Fake\<close>).  
 
 The proof is trivial.  No legitimate protocol rule sends any keys
 at all, so only \<open>Fake\<close> is relevant. Indeed, simplification leaves
 only the \<open>Fake\<close> case, as indicated by the variable name \<open>evsf\<close>:
 @{subgoals[display,indent=0,margin=65]}
 \<close>
 by blast
 (*<*)
 lemma Spy_analz_priK [simp]:
       "evs \<in> ns_public \<Longrightarrow> (Key (priK A) \<in> analz (knows Spy evs)) = (A \<in> bad)"
 by auto
 (*>*)
 
 text \<open>
 The \<open>Fake\<close> case is proved automatically.  If
 \<^term>\<open>priK A\<close> is in the extended trace then either (1) it was already in the
 original trace or (2) it was
 generated by the spy, who must have known this key already. 
 Either way, the induction hypothesis applies.
 
 \emph{Unicity} lemmas are regularity lemmas stating that specified items
 can occur only once in a trace.  The following lemma states that a nonce
 cannot be used both as $Na$ and as $Nb$ unless
 it is known to the spy.  Intuitively, it holds because honest agents
 always choose fresh values as nonces; only the spy might reuse a value,
 and he doesn't know this particular value.  The proof script is short:
 induction, simplification, \<open>blast\<close>.  The first line uses the rule
 \<open>rev_mp\<close> to prepare the induction by moving two assumptions into the 
 induction formula.
 \<close>
 
 lemma no_nonce_NS1_NS2:
     "\<lbrakk>Crypt (pubK C) \<lbrace>NA', Nonce NA, Agent D\<rbrace> \<in> parts (knows Spy evs);
       Crypt (pubK B) \<lbrace>Nonce NA, Agent A\<rbrace> \<in> parts (knows Spy evs);
       evs \<in> ns_public\<rbrakk>
      \<Longrightarrow> Nonce NA \<in> analz (knows Spy evs)"
 apply (erule rev_mp, erule rev_mp)
 apply (erule ns_public.induct, simp_all)
 apply (blast intro: analz_insertI)+
 done
 
 text \<open>
 The following unicity lemma states that, if \isa{NA} is secret, then its
 appearance in any instance of message~1 determines the other components. 
 The proof is similar to the previous one.
 \<close>
 
 lemma unique_NA:
      "\<lbrakk>Crypt(pubK B)  \<lbrace>Nonce NA, Agent A \<rbrace> \<in> parts(knows Spy evs);
        Crypt(pubK B') \<lbrace>Nonce NA, Agent A'\<rbrace> \<in> parts(knows Spy evs);
        Nonce NA \<notin> analz (knows Spy evs); evs \<in> ns_public\<rbrakk>
       \<Longrightarrow> A=A' \<and> B=B'"
 (*<*)
 apply (erule rev_mp, erule rev_mp, erule rev_mp)
 apply (erule ns_public.induct, simp_all)
 (*Fake, NS1*)
 apply (blast intro: analz_insertI)+
 done
 (*>*)
 
 section\<open>Proving Secrecy Theorems \label{sec:secrecy}\<close>
 
 (*<*)
 (*Secrecy: Spy does not see the nonce sent in msg NS1 if A and B are secure
   The major premise "Says A B ..." makes it a dest-rule, so we use
   (erule rev_mp) rather than rule_format. *)
 theorem Spy_not_see_NA:
       "\<lbrakk>Says A B (Crypt(pubK B) \<lbrace>Nonce NA, Agent A\<rbrace>) \<in> set evs;
         A \<notin> bad;  B \<notin> bad;  evs \<in> ns_public\<rbrakk>
        \<Longrightarrow> Nonce NA \<notin> analz (knows Spy evs)"
 apply (erule rev_mp)
 apply (erule ns_public.induct, simp_all)
 apply spy_analz
 apply (blast dest: unique_NA intro: no_nonce_NS1_NS2)+
 done
 
 
 (*Authentication for A: if she receives message 2 and has used NA
   to start a run, then B has sent message 2.*)
 lemma A_trusts_NS2_lemma [rule_format]:
    "\<lbrakk>A \<notin> bad;  B \<notin> bad;  evs \<in> ns_public\<rbrakk>
     \<Longrightarrow> Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace> \<in> parts (knows Spy evs) \<longrightarrow>
         Says A B (Crypt(pubK B) \<lbrace>Nonce NA, Agent A\<rbrace>) \<in> set evs \<longrightarrow>
         Says B A (Crypt(pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace>) \<in> set evs"
 apply (erule ns_public.induct, simp_all)
 (*Fake, NS1*)
 apply (blast dest: Spy_not_see_NA)+
 done
 
 theorem A_trusts_NS2:
      "\<lbrakk>Says A  B (Crypt(pubK B) \<lbrace>Nonce NA, Agent A\<rbrace>) \<in> set evs;
        Says B' A (Crypt(pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace>) \<in> set evs;
        A \<notin> bad;  B \<notin> bad;  evs \<in> ns_public\<rbrakk>
       \<Longrightarrow> Says B A (Crypt(pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace>) \<in> set evs"
 by (blast intro: A_trusts_NS2_lemma)
 
 
 (*If the encrypted message appears then it originated with Alice in NS1*)
 lemma B_trusts_NS1 [rule_format]:
      "evs \<in> ns_public
       \<Longrightarrow> Crypt (pubK B) \<lbrace>Nonce NA, Agent A\<rbrace> \<in> parts (knows Spy evs) \<longrightarrow>
           Nonce NA \<notin> analz (knows Spy evs) \<longrightarrow>
           Says A B (Crypt (pubK B) \<lbrace>Nonce NA, Agent A\<rbrace>) \<in> set evs"
 apply (erule ns_public.induct, simp_all)
 (*Fake*)
 apply (blast intro!: analz_insertI)
 done
 
 
 
 (*** Authenticity properties obtained from NS2 ***)
 
 (*Unicity for NS2: nonce NB identifies nonce NA and agents A, B
   [unicity of B makes Lowe's fix work]
   [proof closely follows that for unique_NA] *)
 
 lemma unique_NB [dest]:
      "\<lbrakk>Crypt(pubK A)  \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace> \<in> parts(knows Spy evs);
        Crypt(pubK A') \<lbrace>Nonce NA', Nonce NB, Agent B'\<rbrace> \<in> parts(knows Spy evs);
        Nonce NB \<notin> analz (knows Spy evs); evs \<in> ns_public\<rbrakk>
       \<Longrightarrow> A=A' \<and> NA=NA' \<and> B=B'"
 apply (erule rev_mp, erule rev_mp, erule rev_mp)
 apply (erule ns_public.induct, simp_all)
 (*Fake, NS2*)
 apply (blast intro: analz_insertI)+
 done
 (*>*)
 
 text \<open>
 The secrecy theorems for Bob (the second participant) are especially
 important because they fail for the original protocol.  The following
 theorem states that if Bob sends message~2 to Alice, and both agents are
 uncompromised, then Bob's nonce will never reach the spy.
 \<close>
 
 theorem Spy_not_see_NB [dest]:
  "\<lbrakk>Says B A (Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace>) \<in> set evs;
    A \<notin> bad;  B \<notin> bad;  evs \<in> ns_public\<rbrakk>
   \<Longrightarrow> Nonce NB \<notin> analz (knows Spy evs)"
 txt \<open>
 To prove it, we must formulate the induction properly (one of the
 assumptions mentions~\<open>evs\<close>), apply induction, and simplify:
 \<close>
 
 apply (erule rev_mp, erule ns_public.induct, simp_all)
 (*<*)
 apply spy_analz
 defer
 apply (blast intro: no_nonce_NS1_NS2)
 apply (blast intro: no_nonce_NS1_NS2)
 (*>*)
 
 txt \<open>
 The proof states are too complicated to present in full.  
 Let's examine the simplest subgoal, that for message~1.  The following
 event has just occurred:
 \[ 1.\quad  A'\to B'  : \comp{Na',A'}\sb{Kb'} \]
 The variables above have been primed because this step
 belongs to a different run from that referred to in the theorem
 statement --- the theorem
 refers to a past instance of message~2, while this subgoal
 concerns message~1 being sent just now.
 In the Isabelle subgoal, instead of primed variables like $B'$ and $Na'$
 we have \<open>Ba\<close> and~\<open>NAa\<close>:
 @{subgoals[display,indent=0]}
 The simplifier has used a 
 default simplification rule that does a case
 analysis for each encrypted message on whether or not the decryption key
 is compromised.
 @{named_thms [display,indent=0,margin=50] analz_Crypt_if [no_vars] (analz_Crypt_if)}
 The simplifier has also used \<open>Spy_see_priK\<close>, proved in
 {\S}\ref{sec:regularity} above, to yield \<^term>\<open>Ba \<in> bad\<close>.
 
 Recall that this subgoal concerns the case
 where the last message to be sent was
 \[ 1.\quad  A'\to B'  : \comp{Na',A'}\sb{Kb'}. \]
 This message can compromise $Nb$ only if $Nb=Na'$ and $B'$ is compromised,
 allowing the spy to decrypt the message.  The Isabelle subgoal says
 precisely this, if we allow for its choice of variable names.
 Proving \<^term>\<open>NB \<noteq> NAa\<close> is easy: \<open>NB\<close> was
 sent earlier, while \<open>NAa\<close> is fresh; formally, we have
 the assumption \<^term>\<open>Nonce NAa \<notin> used evs1\<close>. 
 
 Note that our reasoning concerned \<open>B\<close>'s participation in another
 run.  Agents may engage in several runs concurrently, and some attacks work
 by interleaving the messages of two runs.  With model checking, this
 possibility can cause a state-space explosion, and for us it
 certainly complicates proofs.  The biggest subgoal concerns message~2.  It
 splits into several cases, such as whether or not the message just sent is
 the very message mentioned in the theorem statement.
 Some of the cases are proved by unicity, others by
 the induction hypothesis.  For all those complications, the proofs are
 automatic by \<open>blast\<close> with the theorem \<open>no_nonce_NS1_NS2\<close>.
 
 The remaining theorems about the protocol are not hard to prove.  The
 following one asserts a form of \emph{authenticity}: if
 \<open>B\<close> has sent an instance of message~2 to~\<open>A\<close> and has received the
 expected reply, then that reply really originated with~\<open>A\<close>.  The
 proof is a simple induction.
 \<close>
 
 (*<*)
 by (blast intro: no_nonce_NS1_NS2)
 
 lemma B_trusts_NS3_lemma [rule_format]:
      "\<lbrakk>A \<notin> bad;  B \<notin> bad;  evs \<in> ns_public\<rbrakk> \<Longrightarrow>
       Crypt (pubK B) (Nonce NB) \<in> parts (knows Spy evs) \<longrightarrow>
       Says B A (Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace>) \<in> set evs \<longrightarrow>
       Says A B (Crypt (pubK B) (Nonce NB)) \<in> set evs"
 by (erule ns_public.induct, auto)
 (*>*)
 theorem B_trusts_NS3:
  "\<lbrakk>Says B A  (Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace>) \<in> set evs;
    Says A' B (Crypt (pubK B) (Nonce NB)) \<in> set evs;
    A \<notin> bad;  B \<notin> bad;  evs \<in> ns_public\<rbrakk>
   \<Longrightarrow> Says A B (Crypt (pubK B) (Nonce NB)) \<in> set evs"
 (*<*)
 by (blast intro: B_trusts_NS3_lemma)
 
 (*** Overall guarantee for B ***)
 
 
 (*If NS3 has been sent and the nonce NB agrees with the nonce B joined with
   NA, then A initiated the run using NA.*)
 theorem B_trusts_protocol [rule_format]:
      "\<lbrakk>A \<notin> bad;  B \<notin> bad;  evs \<in> ns_public\<rbrakk> \<Longrightarrow>
       Crypt (pubK B) (Nonce NB) \<in> parts (knows Spy evs) \<longrightarrow>
       Says B A  (Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace>) \<in> set evs \<longrightarrow>
       Says A B (Crypt (pubK B) \<lbrace>Nonce NA, Agent A\<rbrace>) \<in> set evs"
 by (erule ns_public.induct, auto)
 (*>*)
 
 text \<open>
 From similar assumptions, we can prove that \<open>A\<close> started the protocol
 run by sending an instance of message~1 involving the nonce~\<open>NA\<close>\@. 
 For this theorem, the conclusion is 
 @{thm [display] (concl) B_trusts_protocol [no_vars]}
 Analogous theorems can be proved for~\<open>A\<close>, stating that nonce~\<open>NA\<close>
 remains secret and that message~2 really originates with~\<open>B\<close>.  Even the
 flawed protocol establishes these properties for~\<open>A\<close>;
 the flaw only harms the second participant.
 
 \medskip
 
 Detailed information on this protocol verification technique can be found
-elsewhere~@{cite "paulson-jcs"}, including proofs of an Internet
-protocol~@{cite "paulson-tls"}.  We must stress that the protocol discussed
+elsewhere~\<^cite>\<open>"paulson-jcs"\<close>, including proofs of an Internet
+protocol~\<^cite>\<open>"paulson-tls"\<close>.  We must stress that the protocol discussed
 in this chapter is trivial.  There are only three messages; no keys are
 exchanged; we merely have to prove that encrypted data remains secret. 
 Real world protocols are much longer and distribute many secrets to their
 participants.  To be realistic, the model has to include the possibility
 of keys being lost dynamically due to carelessness.  If those keys have
 been used to encrypt other sensitive information, there may be cascading
 losses.  We may still be able to establish a bound on the losses and to
 prove that other protocol runs function
-correctly~@{cite "paulson-yahalom"}.  Proofs of real-world protocols follow
+correctly~\<^cite>\<open>"paulson-yahalom"\<close>.  Proofs of real-world protocols follow
 the strategy illustrated above, but the subgoals can
 be much bigger and there are more of them.
 \index{protocols!security|)}
 \<close>
 
 (*<*)end(*>*)
diff --git a/src/Doc/Tutorial/Types/Axioms.thy b/src/Doc/Tutorial/Types/Axioms.thy
--- a/src/Doc/Tutorial/Types/Axioms.thy
+++ b/src/Doc/Tutorial/Types/Axioms.thy
@@ -1,258 +1,258 @@
 (*<*)theory Axioms imports Overloading "../Setup" begin(*>*)
 
 subsection \<open>Axioms\<close>
 
 text \<open>Attaching axioms to our classes lets us reason on the level of
 classes.  The results will be applicable to all types in a class, just
 as in axiomatic mathematics.
 
 \begin{warn}
 Proofs in this section use structured \emph{Isar} proofs, which are not
-covered in this tutorial; but see @{cite "Nipkow-TYPES02"}.%
+covered in this tutorial; but see \<^cite>\<open>"Nipkow-TYPES02"\<close>.%
 \end{warn}\<close>
 
 subsubsection \<open>Semigroups\<close>
 
 text\<open>We specify \emph{semigroups} as subclass of \<^class>\<open>plus\<close>:\<close>
 
 class semigroup = plus +
   assumes assoc: "(x \<oplus> y) \<oplus> z = x \<oplus> (y \<oplus> z)"
 
 text \<open>\noindent This @{command class} specification requires that
 all instances of \<^class>\<open>semigroup\<close> obey @{fact "assoc:"}~@{prop
 [source] "\<And>x y z :: 'a::semigroup. (x \<oplus> y) \<oplus> z = x \<oplus> (y \<oplus> z)"}.
 
 We can use this class axiom to derive further abstract theorems
 relative to class \<^class>\<open>semigroup\<close>:\<close>
 
 lemma assoc_left:
   fixes x y z :: "'a::semigroup"
   shows "x \<oplus> (y \<oplus> z) = (x \<oplus> y) \<oplus> z"
   using assoc by (rule sym)
 
 text \<open>\noindent The \<^class>\<open>semigroup\<close> constraint on type \<^typ>\<open>'a\<close> restricts instantiations of \<^typ>\<open>'a\<close> to types of class
 \<^class>\<open>semigroup\<close> and during the proof enables us to use the fact
 @{fact assoc} whose type parameter is itself constrained to class
 \<^class>\<open>semigroup\<close>.  The main advantage of classes is that theorems
 can be proved in the abstract and freely reused for each instance.
 
 On instantiation, we have to give a proof that the given operations
 obey the class axioms:\<close>
 
 instantiation nat :: semigroup
 begin
 
 instance proof
 
 txt \<open>\noindent The proof opens with a default proof step, which for
 instance judgements invokes method @{method intro_classes}.\<close>
 
 
   fix m n q :: nat
   show "(m \<oplus> n) \<oplus> q = m \<oplus> (n \<oplus> q)"
     by (induct m) simp_all
 qed
 
 end
 
 text \<open>\noindent Again, the interesting things enter the stage with
 parametric types:\<close>
 
 instantiation prod :: (semigroup, semigroup) semigroup
 begin
 
 instance proof
   fix p\<^sub>1 p\<^sub>2 p\<^sub>3 :: "'a::semigroup \<times> 'b::semigroup"
   show "p\<^sub>1 \<oplus> p\<^sub>2 \<oplus> p\<^sub>3 = p\<^sub>1 \<oplus> (p\<^sub>2 \<oplus> p\<^sub>3)"
     by (cases p\<^sub>1, cases p\<^sub>2, cases p\<^sub>3) (simp add: assoc)
 
 txt \<open>\noindent Associativity of product semigroups is established
 using the hypothetical associativity @{fact assoc} of the type
 components, which holds due to the \<^class>\<open>semigroup\<close> constraints
 imposed on the type components by the @{command instance} proposition.
 Indeed, this pattern often occurs with parametric types and type
 classes.\<close>
 
 qed
 
 end
 
 subsubsection \<open>Monoids\<close>
 
 text \<open>We define a subclass \<open>monoidl\<close> (a semigroup with a
 left-hand neutral) by extending \<^class>\<open>semigroup\<close> with one additional
 parameter \<open>neutral\<close> together with its property:\<close>
 
 class monoidl = semigroup +
   fixes neutral :: "'a" ("\<zero>")
   assumes neutl: "\<zero> \<oplus> x = x"
 
 text \<open>\noindent Again, we prove some instances, by providing
 suitable parameter definitions and proofs for the additional
 specifications.\<close>
 
 instantiation nat :: monoidl
 begin
 
 definition
   neutral_nat_def: "\<zero> = (0::nat)"
 
 instance proof
   fix n :: nat
   show "\<zero> \<oplus> n = n"
     unfolding neutral_nat_def by simp
 qed
 
 end
 
 text \<open>\noindent In contrast to the examples above, we here have both
 specification of class operations and a non-trivial instance proof.
 
 This covers products as well:
 \<close>
 
 instantiation prod :: (monoidl, monoidl) monoidl
 begin
 
 definition
   neutral_prod_def: "\<zero> = (\<zero>, \<zero>)"
 
 instance proof
   fix p :: "'a::monoidl \<times> 'b::monoidl"
   show "\<zero> \<oplus> p = p"
     by (cases p) (simp add: neutral_prod_def neutl)
 qed
 
 end
 
 text \<open>\noindent Fully-fledged monoids are modelled by another
 subclass which does not add new parameters but tightens the
 specification:\<close>
 
 class monoid = monoidl +
   assumes neutr: "x \<oplus> \<zero> = x"
 
 text \<open>\noindent Corresponding instances for \<^typ>\<open>nat\<close> and products
 are left as an exercise to the reader.\<close>
 
 subsubsection \<open>Groups\<close>
 
 text \<open>\noindent To finish our small algebra example, we add a \<open>group\<close> class:\<close>
 
 class group = monoidl +
   fixes inv :: "'a \<Rightarrow> 'a" ("\<div> _" [81] 80)
   assumes invl: "\<div> x \<oplus> x = \<zero>"
 
 text \<open>\noindent We continue with a further example for abstract
 proofs relative to type classes:\<close>
 
 lemma left_cancel:
   fixes x y z :: "'a::group"
   shows "x \<oplus> y = x \<oplus> z \<longleftrightarrow> y = z"
 proof
   assume "x \<oplus> y = x \<oplus> z"
   then have "\<div> x \<oplus> (x \<oplus> y) = \<div> x \<oplus> (x \<oplus> z)" by simp
   then have "(\<div> x \<oplus> x) \<oplus> y = (\<div> x \<oplus> x) \<oplus> z" by (simp add: assoc)
   then show "y = z" by (simp add: invl neutl)
 next
   assume "y = z"
   then show "x \<oplus> y = x \<oplus> z" by simp
 qed
 
 text \<open>\noindent Any \<open>group\<close> is also a \<open>monoid\<close>; this
 can be made explicit by claiming an additional subclass relation,
 together with a proof of the logical difference:\<close>
 
 instance group \<subseteq> monoid
 proof
   fix x
   from invl have "\<div> x \<oplus> x = \<zero>" .
   then have "\<div> x \<oplus> (x \<oplus> \<zero>) = \<div> x \<oplus> x"
     by (simp add: neutl invl assoc [symmetric])
   then show "x \<oplus> \<zero> = x" by (simp add: left_cancel)
 qed
 
 text \<open>\noindent The proof result is propagated to the type system,
 making \<open>group\<close> an instance of \<open>monoid\<close> by adding an
 additional edge to the graph of subclass relation; see also
 Figure~\ref{fig:subclass}.
 
 \begin{figure}[htbp]
  \begin{center}
    \small
    \unitlength 0.6mm
    \begin{picture}(40,60)(0,0)
      \put(20,60){\makebox(0,0){\<open>semigroup\<close>}}
      \put(20,40){\makebox(0,0){\<open>monoidl\<close>}}
      \put(00,20){\makebox(0,0){\<open>monoid\<close>}}
      \put(40,00){\makebox(0,0){\<open>group\<close>}}
      \put(20,55){\vector(0,-1){10}}
      \put(15,35){\vector(-1,-1){10}}
      \put(25,35){\vector(1,-3){10}}
    \end{picture}
    \hspace{8em}
    \begin{picture}(40,60)(0,0)
      \put(20,60){\makebox(0,0){\<open>semigroup\<close>}}
      \put(20,40){\makebox(0,0){\<open>monoidl\<close>}}
      \put(00,20){\makebox(0,0){\<open>monoid\<close>}}
      \put(40,00){\makebox(0,0){\<open>group\<close>}}
      \put(20,55){\vector(0,-1){10}}
      \put(15,35){\vector(-1,-1){10}}
      \put(05,15){\vector(3,-1){30}}
    \end{picture}
    \caption{Subclass relationship of monoids and groups:
       before and after establishing the relationship
       \<open>group \<subseteq> monoid\<close>;  transitive edges are left out.}
    \label{fig:subclass}
  \end{center}
 \end{figure}
 \<close>
 
 subsubsection \<open>Inconsistencies\<close>
 
 text \<open>The reader may be wondering what happens if we attach an
 inconsistent set of axioms to a class. So far we have always avoided
 to add new axioms to HOL for fear of inconsistencies and suddenly it
 seems that we are throwing all caution to the wind. So why is there no
 problem?
 
 The point is that by construction, all type variables in the axioms of
 a \isacommand{class} are automatically constrained with the class
 being defined (as shown for axiom @{thm[source]refl} above). These
 constraints are always carried around and Isabelle takes care that
 they are never lost, unless the type variable is instantiated with a
 type that has been shown to belong to that class. Thus you may be able
 to prove \<^prop>\<open>False\<close> from your axioms, but Isabelle will remind you
 that this theorem has the hidden hypothesis that the class is
 non-empty.
 
 Even if each individual class is consistent, intersections of
 (unrelated) classes readily become inconsistent in practice. Now we
 know this need not worry us.\<close>
 
 
 subsubsection\<open>Syntactic Classes and Predefined Overloading\<close>
 
 text \<open>In our algebra example, we have started with a \emph{syntactic
 class} \<^class>\<open>plus\<close> which only specifies operations but no axioms; it
 would have been also possible to start immediately with class \<^class>\<open>semigroup\<close>, specifying the \<open>\<oplus>\<close> operation and associativity at
 the same time.
 
 Which approach is more appropriate depends.  Usually it is more
 convenient to introduce operations and axioms in the same class: then
 the type checker will automatically insert the corresponding class
 constraints whenever the operations occur, reducing the need of manual
 annotations.  However, when operations are decorated with popular
 syntax, syntactic classes can be an option to re-use the syntax in
 different contexts; this is indeed the way most overloaded constants
 in HOL are introduced, of which the most important are listed in
 Table~\ref{tab:overloading} in the appendix.  Section
 \ref{sec:numeric-classes} covers a range of corresponding classes
 \emph{with} axioms.
 
 Further note that classes may contain axioms but \emph{no} operations.
 An example is class \<^class>\<open>finite\<close> from theory \<^theory>\<open>HOL.Finite_Set\<close>
 which specifies a type to be finite: @{lemma [source] "finite (UNIV :: 'a::finite
 set)" by (fact finite_UNIV)}.\<close>
 
 (*<*)end(*>*)
diff --git a/src/Doc/Tutorial/Types/Records.thy b/src/Doc/Tutorial/Types/Records.thy
--- a/src/Doc/Tutorial/Types/Records.thy
+++ b/src/Doc/Tutorial/Types/Records.thy
@@ -1,394 +1,394 @@
 
 section \<open>Records \label{sec:records}\<close>
 
 (*<*)
 theory Records imports Main begin
 (*>*)
 
 text \<open>
   \index{records|(}%
   Records are familiar from programming languages.  A record of $n$
   fields is essentially an $n$-tuple, but the record's components have
   names, which can make expressions easier to read and reduces the
   risk of confusing one field for another.
 
   A record of Isabelle/HOL covers a collection of fields, with select
   and update operations.  Each field has a specified type, which may
   be polymorphic.  The field names are part of the record type, and
   the order of the fields is significant --- as it is in Pascal but
   not in Standard ML.  If two different record types have field names
   in common, then the ambiguity is resolved in the usual way, by
   qualified names.
 
   Record types can also be defined by extending other record types.
   Extensible records make use of the reserved pseudo-field \cdx{more},
   which is present in every record type.  Generic record operations
   work on all possible extensions of a given type scheme; polymorphism
   takes care of structural sub-typing behind the scenes.  There are
   also explicit coercion functions between fixed record types.
 \<close>
 
 
 subsection \<open>Record Basics\<close>
 
 text \<open>
   Record types are not primitive in Isabelle and have a delicate
-  internal representation @{cite "NaraschewskiW-TPHOLs98"}, based on
+  internal representation \<^cite>\<open>"NaraschewskiW-TPHOLs98"\<close>, based on
   nested copies of the primitive product type.  A \commdx{record}
   declaration introduces a new record type scheme by specifying its
   fields, which are packaged internally to hold up the perception of
   the record as a distinguished entity.  Here is a simple example:
 \<close>
 
 record point =
   Xcoord :: int
   Ycoord :: int
 
 text \<open>\noindent
   Records of type \<^typ>\<open>point\<close> have two fields named \<^const>\<open>Xcoord\<close>
   and \<^const>\<open>Ycoord\<close>, both of type~\<^typ>\<open>int\<close>.  We now define a
   constant of type \<^typ>\<open>point\<close>:
 \<close>
 
 definition pt1 :: point where
 "pt1 \<equiv> (| Xcoord = 999, Ycoord = 23 |)"
 
 text \<open>\noindent
   We see above the ASCII notation for record brackets.  You can also
   use the symbolic brackets \<open>\<lparr>\<close> and \<open>\<rparr>\<close>.  Record type
   expressions can be also written directly with individual fields.
   The type name above is merely an abbreviation.
 \<close>
 
 definition pt2 :: "\<lparr>Xcoord :: int, Ycoord :: int\<rparr>" where
 "pt2 \<equiv> \<lparr>Xcoord = -45, Ycoord = 97\<rparr>"
 
 text \<open>
   For each field, there is a \emph{selector}\index{selector!record}
   function of the same name.  For example, if \<open>p\<close> has type \<^typ>\<open>point\<close> then \<open>Xcoord p\<close> denotes the value of the \<open>Xcoord\<close> field of~\<open>p\<close>.  Expressions involving field selection
   of explicit records are simplified automatically:
 \<close>
 
 lemma "Xcoord \<lparr>Xcoord = a, Ycoord = b\<rparr> = a"
   by simp
 
 text \<open>
   The \emph{update}\index{update!record} operation is functional.  For
   example, \<^term>\<open>p\<lparr>Xcoord := 0\<rparr>\<close> is a record whose \<^const>\<open>Xcoord\<close>
   value is zero and whose \<^const>\<open>Ycoord\<close> value is copied from~\<open>p\<close>.  Updates of explicit records are also simplified automatically:
 \<close>
 
 lemma "\<lparr>Xcoord = a, Ycoord = b\<rparr>\<lparr>Xcoord := 0\<rparr> =
          \<lparr>Xcoord = 0, Ycoord = b\<rparr>"
   by simp
 
 text \<open>
   \begin{warn}
   Field names are declared as constants and can no longer be used as
   variables.  It would be unwise, for example, to call the fields of
   type \<^typ>\<open>point\<close> simply \<open>x\<close> and~\<open>y\<close>.
   \end{warn}
 \<close>
 
 
 subsection \<open>Extensible Records and Generic Operations\<close>
 
 text \<open>
   \index{records!extensible|(}%
 
   Now, let us define coloured points (type \<open>cpoint\<close>) to be
   points extended with a field \<open>col\<close> of type \<open>colour\<close>:
 \<close>
 
 datatype colour = Red | Green | Blue
 
 record cpoint = point +
   col :: colour
 
 text \<open>\noindent
   The fields of this new type are \<^const>\<open>Xcoord\<close>, \<open>Ycoord\<close> and
   \<open>col\<close>, in that order.
 \<close>
 
 definition cpt1 :: cpoint where
 "cpt1 \<equiv> \<lparr>Xcoord = 999, Ycoord = 23, col = Green\<rparr>"
 
 text \<open>
   We can define generic operations that work on arbitrary
   instances of a record scheme, e.g.\ covering \<^typ>\<open>point\<close>, \<^typ>\<open>cpoint\<close>, and any further extensions.  Every record structure has an
   implicit pseudo-field, \cdx{more}, that keeps the extension as an
   explicit value.  Its type is declared as completely
   polymorphic:~\<^typ>\<open>'a\<close>.  When a fixed record value is expressed
   using just its standard fields, the value of \<open>more\<close> is
   implicitly set to \<open>()\<close>, the empty tuple, which has type
   \<^typ>\<open>unit\<close>.  Within the record brackets, you can refer to the
   \<open>more\<close> field by writing ``\<open>\<dots>\<close>'' (three dots):
 \<close>
 
 lemma "Xcoord \<lparr>Xcoord = a, Ycoord = b, \<dots> = p\<rparr> = a"
   by simp
 
 text \<open>
   This lemma applies to any record whose first two fields are \<open>Xcoord\<close> and~\<^const>\<open>Ycoord\<close>.  Note that \<open>\<lparr>Xcoord = a, Ycoord
   = b, \<dots> = ()\<rparr>\<close> is exactly the same as \<open>\<lparr>Xcoord = a, Ycoord
   = b\<rparr>\<close>.  Selectors and updates are always polymorphic wrt.\ the
   \<open>more\<close> part of a record scheme, its value is just ignored (for
   select) or copied (for update).
 
   The \<open>more\<close> pseudo-field may be manipulated directly as well,
   but the identifier needs to be qualified:
 \<close>
 
 lemma "point.more cpt1 = \<lparr>col = Green\<rparr>"
   by (simp add: cpt1_def)
 
 text \<open>\noindent
   We see that the colour part attached to this \<^typ>\<open>point\<close> is a
   rudimentary record in its own right, namely \<open>\<lparr>col =
   Green\<rparr>\<close>.  In order to select or update \<open>col\<close>, this fragment
   needs to be put back into the context of the parent type scheme, say
   as \<open>more\<close> part of another \<^typ>\<open>point\<close>.
 
   To define generic operations, we need to know a bit more about
   records.  Our definition of \<^typ>\<open>point\<close> above has generated two
   type abbreviations:
 
   \medskip
   \begin{tabular}{l}
   \<^typ>\<open>point\<close>~\<open>=\<close>~\<open>\<lparr>Xcoord :: int, Ycoord :: int\<rparr>\<close> \\
   \<^typ>\<open>'a point_scheme\<close>~\<open>=\<close>~\<open>\<lparr>Xcoord :: int, Ycoord :: int, \<dots> :: 'a\<rparr>\<close> \\
   \end{tabular}
   \medskip
   
 \noindent
   Type \<^typ>\<open>point\<close> is for fixed records having exactly the two fields
   \<^const>\<open>Xcoord\<close> and~\<open>Ycoord\<close>, while the polymorphic type \<^typ>\<open>'a point_scheme\<close> comprises all possible extensions to those two
   fields.  Note that \<^typ>\<open>unit point_scheme\<close> coincides with \<^typ>\<open>point\<close>, and \<^typ>\<open>\<lparr>col :: colour\<rparr> point_scheme\<close> with \<^typ>\<open>cpoint\<close>.
 
   In the following example we define two operations --- methods, if we
   regard records as objects --- to get and set any point's \<open>Xcoord\<close> field.
 \<close>
 
 definition getX :: "'a point_scheme \<Rightarrow> int" where
 "getX r \<equiv> Xcoord r"
 definition setX :: "'a point_scheme \<Rightarrow> int \<Rightarrow> 'a point_scheme" where
 "setX r a \<equiv> r\<lparr>Xcoord := a\<rparr>"
 
 text \<open>
   Here is a generic method that modifies a point, incrementing its
   \<^const>\<open>Xcoord\<close> field.  The \<open>Ycoord\<close> and \<open>more\<close> fields
   are copied across.  It works for any record type scheme derived from
   \<^typ>\<open>point\<close> (including \<^typ>\<open>cpoint\<close> etc.):
 \<close>
 
 definition incX :: "'a point_scheme \<Rightarrow> 'a point_scheme" where
 "incX r \<equiv>
   \<lparr>Xcoord = Xcoord r + 1, Ycoord = Ycoord r, \<dots> = point.more r\<rparr>"
 
 text \<open>
   Generic theorems can be proved about generic methods.  This trivial
   lemma relates \<^const>\<open>incX\<close> to \<open>getX\<close> and \<open>setX\<close>:
 \<close>
 
 lemma "incX r = setX r (getX r + 1)"
   by (simp add: getX_def setX_def incX_def)
 
 text \<open>
   \begin{warn}
   If you use the symbolic record brackets \<open>\<lparr>\<close> and \<open>\<rparr>\<close>,
   then you must also use the symbolic ellipsis, ``\<open>\<dots>\<close>'', rather
   than three consecutive periods, ``\<open>...\<close>''.  Mixing the ASCII
   and symbolic versions causes a syntax error.  (The two versions are
   more distinct on screen than they are on paper.)
   \end{warn}%
   \index{records!extensible|)}
 \<close>
 
 
 subsection \<open>Record Equality\<close>
 
 text \<open>
   Two records are equal\index{equality!of records} if all pairs of
   corresponding fields are equal.  Concrete record equalities are
   simplified automatically:
 \<close>
 
 lemma "(\<lparr>Xcoord = a, Ycoord = b\<rparr> = \<lparr>Xcoord = a', Ycoord = b'\<rparr>) =
     (a = a' \<and> b = b')"
   by simp
 
 text \<open>
   The following equality is similar, but generic, in that \<open>r\<close>
   can be any instance of \<^typ>\<open>'a point_scheme\<close>:
 \<close>
 
 lemma "r\<lparr>Xcoord := a, Ycoord := b\<rparr> = r\<lparr>Ycoord := b, Xcoord := a\<rparr>"
   by simp
 
 text \<open>\noindent
   We see above the syntax for iterated updates.  We could equivalently
   have written the left-hand side as \<open>r\<lparr>Xcoord := a\<rparr>\<lparr>Ycoord :=
   b\<rparr>\<close>.
 
   Record equality is \emph{extensional}:
   \index{extensionality!for records} a record is determined entirely
   by the values of its fields.
 \<close>
 
 lemma "r = \<lparr>Xcoord = Xcoord r, Ycoord = Ycoord r\<rparr>"
   by simp
 
 text \<open>\noindent
   The generic version of this equality includes the pseudo-field
   \<open>more\<close>:
 \<close>
 
 lemma "r = \<lparr>Xcoord = Xcoord r, Ycoord = Ycoord r, \<dots> = point.more r\<rparr>"
   by simp
 
 text \<open>
   The simplifier can prove many record equalities
   automatically, but general equality reasoning can be tricky.
   Consider proving this obvious fact:
 \<close>
 
 lemma "r\<lparr>Xcoord := a\<rparr> = r\<lparr>Xcoord := a'\<rparr> \<Longrightarrow> a = a'"
   apply simp?
   oops
 
 text \<open>\noindent
   Here the simplifier can do nothing, since general record equality is
   not eliminated automatically.  One way to proceed is by an explicit
   forward step that applies the selector \<^const>\<open>Xcoord\<close> to both sides
   of the assumed record equality:
 \<close>
 
 lemma "r\<lparr>Xcoord := a\<rparr> = r\<lparr>Xcoord := a'\<rparr> \<Longrightarrow> a = a'"
   apply (drule_tac f = Xcoord in arg_cong)
   txt \<open>@{subgoals [display, indent = 0, margin = 65]}
     Now, \<open>simp\<close> will reduce the assumption to the desired
     conclusion.\<close>
   apply simp
   done
 
 text \<open>
   The \<open>cases\<close> method is preferable to such a forward proof.  We
   state the desired lemma again:
 \<close>
 
 lemma "r\<lparr>Xcoord := a\<rparr> = r\<lparr>Xcoord := a'\<rparr> \<Longrightarrow> a = a'"
 
   txt \<open>The \methdx{cases} method adds an equality to replace the
   named record term by an explicit record expression, listing all
   fields.  It even includes the pseudo-field \<open>more\<close>, since the
   record equality stated here is generic for all extensions.\<close>
 
   apply (cases r)
 
   txt \<open>@{subgoals [display, indent = 0, margin = 65]} Again, \<open>simp\<close> finishes the proof.  Because \<open>r\<close> is now represented as
   an explicit record construction, the updates can be applied and the
   record equality can be replaced by equality of the corresponding
   fields (due to injectivity).\<close>
 
   apply simp
   done
 
 text \<open>
   The generic cases method does not admit references to locally bound
   parameters of a goal.  In longer proof scripts one might have to
   fall back on the primitive \<open>rule_tac\<close> used together with the
   internal field representation rules of records.  The above use of
   \<open>(cases r)\<close> would become \<open>(rule_tac r = r in
   point.cases_scheme)\<close>.
 \<close>
 
 
 subsection \<open>Extending and Truncating Records\<close>
 
 text \<open>
   Each record declaration introduces a number of derived operations to
   refer collectively to a record's fields and to convert between fixed
   record types.  They can, for instance, convert between types \<^typ>\<open>point\<close> and \<^typ>\<open>cpoint\<close>.  We can add a colour to a point or convert
   a \<^typ>\<open>cpoint\<close> to a \<^typ>\<open>point\<close> by forgetting its colour.
 
   \begin{itemize}
 
   \item Function \cdx{make} takes as arguments all of the record's
   fields (including those inherited from ancestors).  It returns the
   corresponding record.
 
   \item Function \cdx{fields} takes the record's very own fields and
   returns a record fragment consisting of just those fields.  This may
   be filled into the \<open>more\<close> part of the parent record scheme.
 
   \item Function \cdx{extend} takes two arguments: a record to be
   extended and a record containing the new fields.
 
   \item Function \cdx{truncate} takes a record (possibly an extension
   of the original record type) and returns a fixed record, removing
   any additional fields.
 
   \end{itemize}
   These functions provide useful abbreviations for standard
   record expressions involving constructors and selectors.  The
   definitions, which are \emph{not} unfolded by default, are made
   available by the collective name of \<open>defs\<close> (\<open>point.defs\<close>, \<open>cpoint.defs\<close>, etc.).
   For example, here are the versions of those functions generated for
   record \<^typ>\<open>point\<close>.  We omit \<open>point.fields\<close>, which happens to
   be the same as \<open>point.make\<close>.
 
   @{thm [display, indent = 0, margin = 65] point.make_def [no_vars]
   point.extend_def [no_vars] point.truncate_def [no_vars]}
   Contrast those with the corresponding functions for record \<^typ>\<open>cpoint\<close>.  Observe \<open>cpoint.fields\<close> in particular.
   @{thm [display, indent = 0, margin = 65] cpoint.make_def [no_vars]
   cpoint.fields_def [no_vars] cpoint.extend_def [no_vars]
   cpoint.truncate_def [no_vars]}
 
   To demonstrate these functions, we declare a new coloured point by
   extending an ordinary point.  Function \<open>point.extend\<close> augments
   \<open>pt1\<close> with a colour value, which is converted into an
   appropriate record fragment by \<open>cpoint.fields\<close>.
 \<close>
 
 definition cpt2 :: cpoint where
 "cpt2 \<equiv> point.extend pt1 (cpoint.fields Green)"
 
 text \<open>
   The coloured points \<^const>\<open>cpt1\<close> and \<open>cpt2\<close> are equal.  The
   proof is trivial, by unfolding all the definitions.  We deliberately
   omit the definition of~\<open>pt1\<close> in order to reveal the underlying
   comparison on type \<^typ>\<open>point\<close>.
 \<close>
 
 lemma "cpt1 = cpt2"
   apply (simp add: cpt1_def cpt2_def point.defs cpoint.defs)
   txt \<open>@{subgoals [display, indent = 0, margin = 65]}\<close>
   apply (simp add: pt1_def)
   done
 
 text \<open>
   In the example below, a coloured point is truncated to leave a
   point.  We use the \<open>truncate\<close> function of the target record.
 \<close>
 
 lemma "point.truncate cpt2 = pt1"
   by (simp add: pt1_def cpt2_def point.defs)
 
 text \<open>
   \begin{exercise}
   Extend record \<^typ>\<open>cpoint\<close> to have a further field, \<open>intensity\<close>, of type~\<^typ>\<open>nat\<close>.  Experiment with generic operations
   (using polymorphic selectors and updates) and explicit coercions
   (using \<open>extend\<close>, \<open>truncate\<close> etc.) among the three record
   types.
   \end{exercise}
 
   \begin{exercise}
   (For Java programmers.)
   Model a small class hierarchy using records.
   \end{exercise}
   \index{records|)}
 \<close>
 
 (*<*)
 end
 (*>*)
diff --git a/src/Doc/Tutorial/Types/Typedefs.thy b/src/Doc/Tutorial/Types/Typedefs.thy
--- a/src/Doc/Tutorial/Types/Typedefs.thy
+++ b/src/Doc/Tutorial/Types/Typedefs.thy
@@ -1,234 +1,234 @@
 (*<*)theory Typedefs imports Main begin(*>*)
 
 section\<open>Introducing New Types\<close>
 
 text\<open>\label{sec:adv-typedef}
 For most applications, a combination of predefined types like \<^typ>\<open>bool\<close> and
 \<open>\<Rightarrow>\<close> with recursive datatypes and records is quite sufficient. Very
 occasionally you may feel the need for a more advanced type.  If you
 are certain that your type is not definable by any of the
 standard means, then read on.
 \begin{warn}
   Types in HOL must be non-empty; otherwise the quantifier rules would be
   unsound, because $\exists x.\ x=x$ is a theorem.
 \end{warn}
 \<close>
 
 subsection\<open>Declaring New Types\<close>
 
 text\<open>\label{sec:typedecl}
 \index{types!declaring|(}%
 \index{typedecl@\isacommand {typedecl} (command)}%
 The most trivial way of introducing a new type is by a \textbf{type
 declaration}:\<close>
 
 typedecl my_new_type
 
 text\<open>\noindent
 This does not define \<^typ>\<open>my_new_type\<close> at all but merely introduces its
 name. Thus we know nothing about this type, except that it is
 non-empty. Such declarations without definitions are
 useful if that type can be viewed as a parameter of the theory.
 A typical example is given in \S\ref{sec:VMC}, where we define a transition
 relation over an arbitrary type of states.
 
 In principle we can always get rid of such type declarations by making those
 types parameters of every other type, thus keeping the theory generic. In
 practice, however, the resulting clutter can make types hard to read.
 
 If you are looking for a quick and dirty way of introducing a new type
 together with its properties: declare the type and state its properties as
 axioms. Example:
 \<close>
 
 axiomatization where
 just_one: "\<exists>x::my_new_type. \<forall>y. x = y"
 
 text\<open>\noindent
 However, we strongly discourage this approach, except at explorative stages
 of your development. It is extremely easy to write down contradictory sets of
 axioms, in which case you will be able to prove everything but it will mean
 nothing.  In the example above, the axiomatic approach is
 unnecessary: a one-element type called \<^typ>\<open>unit\<close> is already defined in HOL.
 \index{types!declaring|)}
 \<close>
 
 subsection\<open>Defining New Types\<close>
 
 text\<open>\label{sec:typedef}
 \index{types!defining|(}%
 \index{typedecl@\isacommand {typedef} (command)|(}%
 Now we come to the most general means of safely introducing a new type, the
 \textbf{type definition}. All other means, for example
 \isacommand{datatype}, are based on it. The principle is extremely simple:
 any non-empty subset of an existing type can be turned into a new type.
 More precisely, the new type is specified to be isomorphic to some
 non-empty subset of an existing type.
 
 Let us work a simple example, the definition of a three-element type.
 It is easily represented by the first three natural numbers:
 \<close>
 
 typedef three = "{0::nat, 1, 2}"
 
 txt\<open>\noindent
 In order to enforce that the representing set on the right-hand side is
 non-empty, this definition actually starts a proof to that effect:
 @{subgoals[display,indent=0]}
 Fortunately, this is easy enough to show, even \isa{auto} could do it.
 In general, one has to provide a witness, in our case 0:
 \<close>
 
 apply(rule_tac x = 0 in exI)
 by simp
 
 text\<open>
 This type definition introduces the new type \<^typ>\<open>three\<close> and asserts
 that it is a copy of the set \<^term>\<open>{0::nat,1,2}\<close>. This assertion
 is expressed via a bijection between the \emph{type} \<^typ>\<open>three\<close> and the
 \emph{set} \<^term>\<open>{0::nat,1,2}\<close>. To this end, the command declares the following
 constants behind the scenes:
 \begin{center}
 \begin{tabular}{rcl}
 \<^term>\<open>Rep_three\<close> &::& \<^typ>\<open>three \<Rightarrow> nat\<close>\\
 \<^term>\<open>Abs_three\<close> &::& \<^typ>\<open>nat \<Rightarrow> three\<close>
 \end{tabular}
 \end{center}
 The situation is best summarized with the help of the following diagram,
 where squares denote types and the irregular region denotes a set:
 \begin{center}
 \includegraphics[scale=.8]{typedef}
 \end{center}
 Finally, \isacommand{typedef} asserts that \<^term>\<open>Rep_three\<close> is
 surjective on the subset and \<^term>\<open>Abs_three\<close> and \<^term>\<open>Rep_three\<close> are inverses of each other:
 \begin{center}
 \begin{tabular}{@ {}r@ {\qquad\qquad}l@ {}}
 @{thm Rep_three[no_vars]} & (@{thm[source]Rep_three}) \\
 @{thm Rep_three_inverse[no_vars]} & (@{thm[source]Rep_three_inverse}) \\
 @{thm Abs_three_inverse[no_vars]} & (@{thm[source]Abs_three_inverse})
 \end{tabular}
 \end{center}
 %
 From this example it should be clear what \isacommand{typedef} does
 in general given a name (here \<open>three\<close>) and a set
 (here \<^term>\<open>{0::nat,1,2}\<close>).
 
 Our next step is to define the basic functions expected on the new type.
 Although this depends on the type at hand, the following strategy works well:
 \begin{itemize}
 \item define a small kernel of basic functions that can express all other
 functions you anticipate.
 \item define the kernel in terms of corresponding functions on the
 representing type using \<^term>\<open>Abs\<close> and \<^term>\<open>Rep\<close> to convert between the
 two levels.
 \end{itemize}
 In our example it suffices to give the three elements of type \<^typ>\<open>three\<close>
 names:
 \<close>
 
 definition A :: three where "A \<equiv> Abs_three 0"
 definition B :: three where "B \<equiv> Abs_three 1"
 definition C :: three where "C \<equiv> Abs_three 2"
 
 text\<open>
 So far, everything was easy. But it is clear that reasoning about \<^typ>\<open>three\<close> will be hell if we have to go back to \<^typ>\<open>nat\<close> every time. Thus our
 aim must be to raise our level of abstraction by deriving enough theorems
 about type \<^typ>\<open>three\<close> to characterize it completely. And those theorems
 should be phrased in terms of \<^term>\<open>A\<close>, \<^term>\<open>B\<close> and \<^term>\<open>C\<close>, not \<^term>\<open>Abs_three\<close> and \<^term>\<open>Rep_three\<close>. Because of the simplicity of the example,
 we merely need to prove that \<^term>\<open>A\<close>, \<^term>\<open>B\<close> and \<^term>\<open>C\<close> are distinct
 and that they exhaust the type.
 
 In processing our \isacommand{typedef} declaration, 
 Isabelle proves several helpful lemmas. The first two
 express injectivity of \<^term>\<open>Rep_three\<close> and \<^term>\<open>Abs_three\<close>:
 \begin{center}
 \begin{tabular}{@ {}r@ {\qquad}l@ {}}
 @{thm Rep_three_inject[no_vars]} & (@{thm[source]Rep_three_inject}) \\
 \begin{tabular}{@ {}l@ {}}
 \<open>\<lbrakk>x \<in> {0, 1, 2}; y \<in> {0, 1, 2} \<rbrakk>\<close> \\
 \<open>\<Longrightarrow> (Abs_three x = Abs_three y) = (x = y)\<close>
 \end{tabular} & (@{thm[source]Abs_three_inject}) \\
 \end{tabular}
 \end{center}
 The following ones allow to replace some \<open>x::three\<close> by
 \<open>Abs_three(y::nat)\<close>, and conversely \<^term>\<open>y\<close> by \<^term>\<open>Rep_three x\<close>:
 \begin{center}
 \begin{tabular}{@ {}r@ {\qquad}l@ {}}
 @{thm Rep_three_cases[no_vars]} & (@{thm[source]Rep_three_cases}) \\
 @{thm Abs_three_cases[no_vars]} & (@{thm[source]Abs_three_cases}) \\
 @{thm Rep_three_induct[no_vars]} & (@{thm[source]Rep_three_induct}) \\
 @{thm Abs_three_induct[no_vars]} & (@{thm[source]Abs_three_induct}) \\
 \end{tabular}
 \end{center}
 These theorems are proved for any type definition, with \<open>three\<close>
 replaced by the name of the type in question.
 
 Distinctness of \<^term>\<open>A\<close>, \<^term>\<open>B\<close> and \<^term>\<open>C\<close> follows immediately
 if we expand their definitions and rewrite with the injectivity
 of \<^term>\<open>Abs_three\<close>:
 \<close>
 
 lemma "A \<noteq> B \<and> B \<noteq> A \<and> A \<noteq> C \<and> C \<noteq> A \<and> B \<noteq> C \<and> C \<noteq> B"
 by(simp add: Abs_three_inject A_def B_def C_def)
 
 text\<open>\noindent
 Of course we rely on the simplifier to solve goals like \<^prop>\<open>(0::nat) \<noteq> 1\<close>.
 
 The fact that \<^term>\<open>A\<close>, \<^term>\<open>B\<close> and \<^term>\<open>C\<close> exhaust type \<^typ>\<open>three\<close> is
 best phrased as a case distinction theorem: if you want to prove \<^prop>\<open>P x\<close>
 (where \<^term>\<open>x\<close> is of type \<^typ>\<open>three\<close>) it suffices to prove \<^prop>\<open>P A\<close>,
 \<^prop>\<open>P B\<close> and \<^prop>\<open>P C\<close>:\<close>
 
 lemma three_cases: "\<lbrakk> P A; P B; P C \<rbrakk> \<Longrightarrow> P x"
 
 txt\<open>\noindent Again this follows easily using the induction principle stemming from the type definition:\<close>
 
 apply(induct_tac x)
 
 txt\<open>
 @{subgoals[display,indent=0]}
 Simplification leads to the disjunction \<^prop>\<open>y
 = 0 \<or> y = 1 \<or> y = (2::nat)\<close> which \isa{auto} separates into three
 subgoals, each of which is easily solved by simplification:\<close>
 
 apply(auto simp add: A_def B_def C_def)
 done
 
 text\<open>\noindent
 This concludes the derivation of the characteristic theorems for
 type \<^typ>\<open>three\<close>.
 
 The attentive reader has realized long ago that the
 above lengthy definition can be collapsed into one line:
 \<close>
 
 datatype better_three = A | B | C
 
 text\<open>\noindent
 In fact, the \isacommand{datatype} command performs internally more or less
 the same derivations as we did, which gives you some idea what life would be
 like without \isacommand{datatype}.
 
 Although \<^typ>\<open>three\<close> could be defined in one line, we have chosen this
 example to demonstrate \isacommand{typedef} because its simplicity makes the
 key concepts particularly easy to grasp. If you would like to see a
 non-trivial example that cannot be defined more directly, we recommend the
-definition of \emph{finite multisets} in the Library~@{cite "HOL-Library"}.
+definition of \emph{finite multisets} in the Library~\<^cite>\<open>"HOL-Library"\<close>.
 
 Let us conclude by summarizing the above procedure for defining a new type.
 Given some abstract axiomatic description $P$ of a type $ty$ in terms of a
 set of functions $F$, this involves three steps:
 \begin{enumerate}
 \item Find an appropriate type $\tau$ and subset $A$ which has the desired
   properties $P$, and make a type definition based on this representation.
 \item Define the required functions $F$ on $ty$ by lifting
 analogous functions on the representation via $Abs_ty$ and $Rep_ty$.
 \item Prove that $P$ holds for $ty$ by lifting $P$ from the representation.
 \end{enumerate}
 You can now forget about the representation and work solely in terms of the
 abstract functions $F$ and properties $P$.%
 \index{typedecl@\isacommand {typedef} (command)|)}%
 \index{types!defining|)}
 \<close>
 
 (*<*)end(*>*)
diff --git a/src/Doc/Typeclass_Hierarchy/Typeclass_Hierarchy.thy b/src/Doc/Typeclass_Hierarchy/Typeclass_Hierarchy.thy
--- a/src/Doc/Typeclass_Hierarchy/Typeclass_Hierarchy.thy
+++ b/src/Doc/Typeclass_Hierarchy/Typeclass_Hierarchy.thy
@@ -1,368 +1,368 @@
 theory Typeclass_Hierarchy
 imports Setup
 begin
 
 section \<open>Introduction\<close>
 
 text \<open>
   The {Isabelle/HOL} type-class hierarchy entered the stage
   in a quite ancient era -- first related \<^emph>\<open>NEWS\<close> entries date
   back to release {Isabelle99-1}.  Since then, there have been
   ongoing modifications and additions, leading to ({Isabelle2016})
   more than 180 type-classes.  This sheer complexity makes access
   and understanding of that type-class hierarchy difficult and
   involved, let alone maintenance.
 
   The purpose of this primer is to shed some light on this,
   not only on the mere ingredients, but also on the design
   principles which have evolved and proven useful over time.
 \<close>
 
 section \<open>Foundations\<close>
 
 subsection \<open>Locales and type classes\<close>
 
 text \<open>
   Some familiarity with the Isabelle module system is assumed:
   defining locales and type-classes, interpreting locales and
   instantiating type-classes, adding relationships between
   locales (@{command sublocale}) and type-classes
   (@{command subclass}).  Handy introductions are the
-  respective tutorials @{cite "isabelle-locale"}
-  @{cite "isabelle-classes"}.
+  respective tutorials \<^cite>\<open>"isabelle-locale"\<close>
+  \<^cite>\<open>"isabelle-classes"\<close>.
 \<close>
 
 subsection \<open>Strengths and restrictions of type classes\<close>
 
 text \<open>
   The primary motivation for using type classes in {Isabelle/HOL}
   always have been numerical types, which form an inclusion chain:
   
   \begin{center}
     \<^typ>\<open>nat\<close> \<open>\<sqsubset>\<close> \<^typ>\<open>int\<close> \<open>\<sqsubset>\<close> \<^typ>\<open>rat\<close>
       \<open>\<sqsubset>\<close> \<^typ>\<open>real\<close> \<open>\<sqsubset>\<close> \<^typ>\<open>complex\<close>
   \end{center}
 
   \noindent The inclusion \<open>\<sqsubset>\<close> means that any value of the numerical
   type to the left hand side mathematically can be transferred
   to the numerical type on the right hand side.
 
   How to accomplish this given the quite restrictive type system
-  of {Isabelle/HOL}?  Paulson @{cite "paulson-numerical"} explains
+  of {Isabelle/HOL}?  Paulson \<^cite>\<open>"paulson-numerical"\<close> explains
   that each numerical type has some characteristic properties
   which define an characteristic algebraic structure;  \<open>\<sqsubset>\<close>
   then corresponds to specialization of the corresponding
   characteristic algebraic structures.  These algebraic structures
   are expressed using algebraic type classes and embeddings
   of numerical types into them:
 
   \begin{center}\begin{tabular}{lccc}
     \<^term>\<open>of_nat\<close> \<open>::\<close>  & \<^typ>\<open>nat\<close>  & \<open>\<Rightarrow>\<close> & @{typ [source] "'a::semiring_1"} \\
                                  & \<open>\<sqinter>\<close>   &            & \<open>\<up>\<close> \\
     \<^term>\<open>of_int\<close> \<open>::\<close>  & \<^typ>\<open>int\<close>  & \<open>\<Rightarrow>\<close> & @{typ [source] "'a::ring_1"} \\
                                  & \<open>\<sqinter>\<close>   &            & \<open>\<up>\<close> \\
     \<^term>\<open>of_rat\<close> \<open>::\<close>  & \<^typ>\<open>rat\<close>  & \<open>\<Rightarrow>\<close> & @{typ [source] "'a::field_char_0"} \\
                                  & \<open>\<sqinter>\<close>   &            & \<open>\<up>\<close> \\
     \<^term>\<open>of_real\<close> \<open>::\<close> & \<^typ>\<open>real\<close> & \<open>\<Rightarrow>\<close> & @{typ [source] "'a::real_algebra_1"} \\
                                  & \<open>\<sqinter>\<close> \\
                                  & \<^typ>\<open>complex\<close>
   \end{tabular}\end{center}
 
   \noindent \<open>d \<leftarrow> c\<close> means that \<open>c\<close> is subclass of \<open>d\<close>.
   Hence each characteristic embedding \<open>of_num\<close> can transform
   any value of type \<open>num\<close> to any numerical type further
   up in the inclusion chain.
 
   This canonical example exhibits key strengths of type classes:
 
     \<^item> Sharing of operations and facts among different
       types, hence also sharing of notation and names: there
       is only one plus operation using infix syntax \<open>+\<close>,
       only one zero written \<open>0\<close>, and neutrality
       (@{thm (frugal_sorts) add_0_left [all, no_vars]} and
       @{thm (frugal_sorts) add_0_right [all, no_vars]})
       is referred to
       uniformly by names @{fact add_0_left} and @{fact add_0_right}.
 
     \<^item> Proof tool setups are shared implicitly:
       @{fact add_0} and @{fact add_0_right} are simplification
       rules by default.
 
     \<^item> Hence existing proofs about particular numerical
       types are often easy to generalize to algebraic structures,
       given that they do not depend on specific properties of
       those numerical types.
 
   Considerable restrictions include:
 
     \<^item> Type class operations are restricted to one
       type parameter; this is insufficient e.g. for expressing
       a unified power operation adequately (see \secref{sec:power}).
 
     \<^item> Parameters are fixed over the whole type class
       hierarchy and cannot be refined in specific situations:
       think of integral domains with a predicate \<^term>\<open>is_unit\<close>;
       for natural numbers, this degenerates to the much simpler
       @{term [source] "HOL.equal (1::nat)"} but facts
       refer to \<^term>\<open>is_unit\<close> nonetheless.
 
     \<^item> Type classes are not apt for meta-theory.  There
       is no practically usable way to express that the units
       of an integral domain form a multiplicative group using
       type classes.  But see session \<open>HOL-Algebra\<close>
       which provides locales with an explicit carrier.
 \<close>
 
 
 subsection \<open>Navigating the hierarchy\<close>
 
 text \<open>
   An indispensable tool to inspect the class hierarchy is
   @{command class_deps} which displays the graph of classes,
   optionally showing the logical content for each class also.
   Optional parameters restrict the graph to a particular segment
   which is useful to get a graspable view.  See
-  the Isar reference manual @{cite "isabelle-isar-ref"} for details.
+  the Isar reference manual \<^cite>\<open>"isabelle-isar-ref"\<close> for details.
 \<close>
 
 
 section \<open>The hierarchy\<close>
 
 subsection \<open>Syntactic type classes \label{sec:syntactic-type-class}\<close>
 
 text \<open>
   At the top of the hierarchy there are a couple of syntactic type
   classes, ie. classes with operations but with no axioms,
   most notably:
 
     \<^item> @{command class} \<^class>\<open>plus\<close> with @{term [source] "(a::'a::plus) + b"}
 
     \<^item> @{command class} \<^class>\<open>zero\<close> with @{term [source] "0::'a::zero"}
 
     \<^item> @{command class} \<^class>\<open>times\<close> with @{term [source] "(a::'a::times) * b"}
 
     \<^item> @{command class} \<^class>\<open>one\<close> with @{term [source] "1::'a::one"}
 
   \noindent Before the introduction of the @{command class} statement in
-  Isabelle @{cite "Haftmann-Wenzel:2006:classes"} it was impossible
+  Isabelle \<^cite>\<open>"Haftmann-Wenzel:2006:classes"\<close> it was impossible
   to define operations with associated axioms in the same class,
   hence there were always pairs of syntactic and logical type
   classes.  This restriction is lifted nowadays, but there are
   still reasons to maintain syntactic type classes:
 
     \<^item> Syntactic type classes allow generic notation to be used
       regardless of a particular logical interpretation; e.g.
       although multiplication \<open>*\<close> is usually associative,
       there are examples where it is not (e.g. octonions), and
       leaving \<open>*\<close> without axioms allows to re-use this
       syntax by means of type class instantiation also for such
       exotic examples.
 
     \<^item> Type classes might share operations but not necessarily
       axioms on them, e.g. \<^term>\<open>gcd\<close> (see \secref{sec:gcd}).
       Hence their common base is a syntactic type class.
 
   \noindent However syntactic type classes should only be used with striking
   cause.  Otherwise there is risk for confusion if the notation
   suggests properties which do not hold without particular
   constraints.  This can be illustrated using numerals
   (see \secref{sec:numerals}):  @{lemma "2 + 2 = 4" by simp} is
   provable without further ado, and this also meets the typical
   expectation towards a numeral notation;  in more ancient releases
   numerals were purely syntactic and \<^prop>\<open>2 + 2 = 4\<close> was
   not provable without particular type constraints.
 \<close>
 
 
 subsection \<open>Additive and multiplicative semigroups and monoids\<close>
 
 text \<open>
   In common literature, notation for semigroups and monoids
   is either multiplicative \<open>(*, 1)\<close> or additive
   \<open>(+, 0)\<close> with underlying properties isomorphic.
   In {Isabelle/HOL}, this is accomplished using the following
   abstract setup:
 
     \<^item> A \<^locale>\<open>semigroup\<close> introduces an abstract binary
       associative operation.
 
     \<^item> A \<^locale>\<open>monoid\<close> is an extension of \<^locale>\<open>semigroup\<close>
       with a neutral element.
 
     \<^item> Both \<^locale>\<open>semigroup\<close> and \<^locale>\<open>monoid\<close> provide
       dedicated syntax for their operations \<open>(\<^bold>*, \<^bold>1)\<close>.
       This syntax is not visible on the global theory level
       but only for abstract reasoning inside the respective
       locale.
 
     \<^item> Concrete global syntax is added building on existing
       syntactic type classes \secref{sec:syntactic-type-class}
       using the following classes:
 
         \<^item> @{command class} \<^class>\<open>semigroup_mult\<close> = \<^class>\<open>times\<close>
 
         \<^item> @{command class} \<^class>\<open>monoid_mult\<close> = \<^class>\<open>one\<close> + \<^class>\<open>semigroup_mult\<close>
 
         \<^item> @{command class} \<^class>\<open>semigroup_add\<close> = \<^class>\<open>plus\<close>
 
         \<^item> @{command class} \<^class>\<open>monoid_add\<close> = \<^class>\<open>zero\<close> + \<^class>\<open>semigroup_add\<close>
 
       Locales \<^locale>\<open>semigroup\<close> and \<^locale>\<open>monoid\<close> are
       interpreted (using @{command sublocale}) into their
       corresponding type classes, with prefixes \<open>add\<close>
       and \<open>mult\<close>; hence facts derived in \<^locale>\<open>semigroup\<close>
       and \<^locale>\<open>monoid\<close> are propagated simultaneously to
       \<^emph>\<open>both\<close> using a consistent naming policy, ie.
 
         \<^item> @{fact semigroup.assoc}: @{thm (frugal_sorts) semigroup.assoc [all, no_vars]}
 
         \<^item> @{fact mult.assoc}: @{thm (frugal_sorts) mult.assoc [all, no_vars]}
 
         \<^item> @{fact add.assoc}: @{thm (frugal_sorts) add.assoc [all, no_vars]}
 
         \<^item> @{fact monoid.right_neutral}: @{thm (frugal_sorts) monoid.right_neutral [all, no_vars]}
 
         \<^item> @{fact mult.right_neutral}: @{thm (frugal_sorts) mult.right_neutral [all, no_vars]}
 
         \<^item> @{fact add.right_neutral}: @{thm (frugal_sorts) add.right_neutral [all, no_vars]}
 
     \<^item> Note that the syntax in \<^locale>\<open>semigroup\<close> and \<^locale>\<open>monoid\<close>
       is bold; this avoids clashes when writing properties
       inside one of these locales in presence of that global
       concrete type class syntax.
 
   \noindent That hierarchy extends in a straightforward manner
   to abelian semigroups and commutative monoids\footnote{The
   designation \<^emph>\<open>abelian\<close> is quite standard concerning
   (semi)groups, but not for monoids}:
 
     \<^item> Locales \<^locale>\<open>abel_semigroup\<close> and \<^locale>\<open>comm_monoid\<close>
       add commutativity as property.
 
     \<^item> Concrete syntax emerges through
 
         \<^item> @{command class} \<^class>\<open>ab_semigroup_add\<close> = \<^class>\<open>semigroup_add\<close>
 
         \<^item> @{command class} \<^class>\<open>ab_semigroup_mult\<close> = \<^class>\<open>semigroup_mult\<close>
 
         \<^item> @{command class} \<^class>\<open>comm_monoid_add\<close> = \<^class>\<open>zero\<close> + \<^class>\<open>ab_semigroup_add\<close>
 
         \<^item> @{command class} \<^class>\<open>comm_monoid_mult\<close> = \<^class>\<open>one\<close> + \<^class>\<open>ab_semigroup_mult\<close>
   
       and corresponding interpretation of the locales above, yielding
 
         \<^item> @{fact abel_semigroup.commute}: @{thm (frugal_sorts) abel_semigroup.commute [all, no_vars]}
 
         \<^item> @{fact mult.commute}: @{thm (frugal_sorts) mult.commute [all, no_vars]}
 
         \<^item> @{fact add.commute}: @{thm (frugal_sorts) add.commute [all, no_vars]}
 \<close>
 
 paragraph \<open>Named collection of theorems\<close>
 
 text \<open>
   Locale interpretation interacts smoothly with named collections of
   theorems as introduced by command @{command named_theorems}.  In our
   example, rules concerning associativity and commutativity are no
   simplification rules by default since they desired orientation may
   vary depending on the situation.  However, there is a collection
   @{fact ac_simps} where facts @{fact abel_semigroup.assoc},
   @{fact abel_semigroup.commute} and @{fact abel_semigroup.left_commute}
   are declared as members.  Due to interpretation, also
   @{fact mult.assoc}, @{fact mult.commute} and @{fact mult.left_commute}
   are also members of @{fact ac_simps}, as any corresponding facts
   stemming from interpretation of \<^locale>\<open>abel_semigroup\<close>.
   Hence adding @{fact ac_simps} to the simplification rules for
   a single method call uses all associativity and commutativity
   rules known by means of interpretation.
 \<close>
 
 
 subsection \<open>Additive and multiplicative groups\<close>
 
 text \<open>
   The hierarchy for inverse group operations takes into account
   that there are weaker algebraic structures with only a partially
   inverse operation.  E. g. the natural numbers have bounded
   subtraction \<^term>\<open>m - (n::nat)\<close> which is only an inverse
   operation if \<^term>\<open>m \<ge> (n::nat)\<close>;  unary minus \<open>-\<close>
   is pointless on the natural numbers.
 
   Hence for both additive and multiplicative notation there
   are syntactic classes for inverse operations, both unary
   and binary:
 
     \<^item> @{command class} \<^class>\<open>minus\<close> with @{term [source] "(a::'a::minus) - b"}
 
     \<^item> @{command class} \<^class>\<open>uminus\<close> with @{term [source] "- a::'a::uminus"}
 
     \<^item> @{command class} \<^class>\<open>divide\<close> with @{term [source] "(a::'a::divide) div b"}
 
     \<^item> @{command class} \<^class>\<open>inverse\<close> = \<^class>\<open>divide\<close> with @{term [source] "inverse a::'a::inverse"}
         \\ and @{term [source] "(a::'a::inverse) / b"}
 
   \noindent Here \<^class>\<open>inverse\<close> specializes the ``partial'' syntax
   @{term [source] "a div b"} to the more specific
   @{term [source] "a / b"}. 
 
   Semantic properties are added by
 
     \<^item> @{command class} \<^class>\<open>cancel_ab_semigroup_add\<close> = \<^class>\<open>ab_semigroup_add\<close> + \<^class>\<open>minus\<close>
 
     \<^item> @{command class} \<^class>\<open>cancel_comm_monoid_add\<close> = \<^class>\<open>cancel_ab_semigroup_add\<close> + \<^class>\<open>comm_monoid_add\<close>
 
   \noindent which specify a minimal binary partially inverse operation as
 
     \<^item> @{fact add_diff_cancel_left'}: @{thm (frugal_sorts) add_diff_cancel_left' [all, no_vars]}
 
     \<^item> @{fact diff_diff_add}: @{thm (frugal_sorts) diff_diff_add [all, no_vars]}
 
   \noindent which in turn allow to derive facts like
 
     \<^item> @{fact add_left_imp_eq}: @{thm (frugal_sorts) add_left_imp_eq [all, no_vars]}
 
   \noindent The total inverse operation is established as follows:
 
     \<^item> Locale \<^locale>\<open>group\<close> extends the abstract hierarchy with
       the inverse operation.
 
     \<^item> The concrete additive inverse operation emerges through
 
       \<^item> @{command class} \<^class>\<open>group_add\<close> = \<^class>\<open>minus\<close> + \<^class>\<open>uminus\<close> + \<^class>\<open>monoid_add\<close> (in \<^theory>\<open>HOL.Groups\<close>) \\
 
       \<^item> @{command class} \<^class>\<open>ab_group_add\<close> = \<^class>\<open>minus\<close> + \<^class>\<open>uminus\<close> + \<^class>\<open>comm_monoid_add\<close> (in \<^theory>\<open>HOL.Groups\<close>)
 
       and corresponding interpretation of locale \<^locale>\<open>group\<close>, yielding e.g.
 
       \<^item> @{fact group.left_inverse}: @{thm (frugal_sorts) group.left_inverse [all, no_vars]}
 
       \<^item> @{fact add.left_inverse}: @{thm (frugal_sorts) add.left_inverse [all, no_vars]}
 
   \noindent There is no multiplicative counterpart.  Why?  In rings,
   the multiplicative group excludes the zero element, hence
   the inverse operation is not total.  See further \secref{sec:rings}.
 \<close>
 
 paragraph \<open>Mitigating against redundancy by default simplification rules\<close>
 
 text \<open>
   Inverse operations imposes some redundancy on the type class
   hierarchy: in a group with a total inverse operation, the
   unary operation is simpler and more primitive than the binary
   one; but we cannot eliminate the binary one in favour of
   a mere syntactic abbreviation since the binary one is vital
   to express a partial inverse operation.
 
   This is mitigated by providing suitable default simplification
   rules: expression involving the unary inverse operation are
   simplified to binary inverse operation whenever appropriate.
   The rationale is that simplification is a central device in
   explorative proving, where proof obligation remaining after certain
   default proof steps including simplification are inspected
   to get an idea what is missing to finish a proof.  When
   preferable normal forms are encoded into
   default simplification rules, proof obligations after simplification
   are normalized and hence more proof-friendly.
 \<close>
 
 end
diff --git a/src/HOL/Algebra/Group.thy b/src/HOL/Algebra/Group.thy
--- a/src/HOL/Algebra/Group.thy
+++ b/src/HOL/Algebra/Group.thy
@@ -1,1746 +1,1746 @@
 (*  Title:      HOL/Algebra/Group.thy
     Author:     Clemens Ballarin, started 4 February 2003
 
 Based on work by Florian Kammueller, L C Paulson and Markus Wenzel.
 With additional contributions from Martin Baillon and Paulo Emílio de Vilhena.
 *)
 
 theory Group
 imports Complete_Lattice "HOL-Library.FuncSet"
 begin
 
 section \<open>Monoids and Groups\<close>
 
 subsection \<open>Definitions\<close>
 
 text \<open>
-  Definitions follow @{cite "Jacobson:1985"}.
+  Definitions follow \<^cite>\<open>"Jacobson:1985"\<close>.
 \<close>
 
 record 'a monoid =  "'a partial_object" +
   mult    :: "['a, 'a] \<Rightarrow> 'a" (infixl "\<otimes>\<index>" 70)
   one     :: 'a ("\<one>\<index>")
 
 definition
   m_inv :: "('a, 'b) monoid_scheme => 'a => 'a" ("inv\<index> _" [81] 80)
   where "inv\<^bsub>G\<^esub> x = (THE y. y \<in> carrier G \<and> x \<otimes>\<^bsub>G\<^esub> y = \<one>\<^bsub>G\<^esub> \<and> y \<otimes>\<^bsub>G\<^esub> x = \<one>\<^bsub>G\<^esub>)"
 
 definition
   Units :: "_ => 'a set"
   \<comment> \<open>The set of invertible elements\<close>
   where "Units G = {y. y \<in> carrier G \<and> (\<exists>x \<in> carrier G. x \<otimes>\<^bsub>G\<^esub> y = \<one>\<^bsub>G\<^esub> \<and> y \<otimes>\<^bsub>G\<^esub> x = \<one>\<^bsub>G\<^esub>)}"
 
 locale monoid =
   fixes G (structure)
   assumes m_closed [intro, simp]:
          "\<lbrakk>x \<in> carrier G; y \<in> carrier G\<rbrakk> \<Longrightarrow> x \<otimes> y \<in> carrier G"
       and m_assoc:
          "\<lbrakk>x \<in> carrier G; y \<in> carrier G; z \<in> carrier G\<rbrakk>
           \<Longrightarrow> (x \<otimes> y) \<otimes> z = x \<otimes> (y \<otimes> z)"
       and one_closed [intro, simp]: "\<one> \<in> carrier G"
       and l_one [simp]: "x \<in> carrier G \<Longrightarrow> \<one> \<otimes> x = x"
       and r_one [simp]: "x \<in> carrier G \<Longrightarrow> x \<otimes> \<one> = x"
 
 lemma monoidI:
   fixes G (structure)
   assumes m_closed:
       "!!x y. [| x \<in> carrier G; y \<in> carrier G |] ==> x \<otimes> y \<in> carrier G"
     and one_closed: "\<one> \<in> carrier G"
     and m_assoc:
       "!!x y z. [| x \<in> carrier G; y \<in> carrier G; z \<in> carrier G |] ==>
       (x \<otimes> y) \<otimes> z = x \<otimes> (y \<otimes> z)"
     and l_one: "!!x. x \<in> carrier G ==> \<one> \<otimes> x = x"
     and r_one: "!!x. x \<in> carrier G ==> x \<otimes> \<one> = x"
   shows "monoid G"
   by (fast intro!: monoid.intro intro: assms)
 
 lemma (in monoid) Units_closed [dest]:
   "x \<in> Units G ==> x \<in> carrier G"
   by (unfold Units_def) fast
 
 lemma (in monoid) one_unique:
   assumes "u \<in> carrier G"
     and "\<And>x. x \<in> carrier G \<Longrightarrow> u \<otimes> x = x"
   shows "u = \<one>"
   using assms(2)[OF one_closed] r_one[OF assms(1)] by simp
 
 lemma (in monoid) inv_unique:
   assumes eq: "y \<otimes> x = \<one>"  "x \<otimes> y' = \<one>"
     and G: "x \<in> carrier G"  "y \<in> carrier G"  "y' \<in> carrier G"
   shows "y = y'"
 proof -
   from G eq have "y = y \<otimes> (x \<otimes> y')" by simp
   also from G have "... = (y \<otimes> x) \<otimes> y'" by (simp add: m_assoc)
   also from G eq have "... = y'" by simp
   finally show ?thesis .
 qed
 
 lemma (in monoid) Units_m_closed [simp, intro]:
   assumes x: "x \<in> Units G" and y: "y \<in> Units G"
   shows "x \<otimes> y \<in> Units G"
 proof -
   from x obtain x' where x: "x \<in> carrier G" "x' \<in> carrier G" and xinv: "x \<otimes> x' = \<one>" "x' \<otimes> x = \<one>"
     unfolding Units_def by fast
   from y obtain y' where y: "y \<in> carrier G" "y' \<in> carrier G" and yinv: "y \<otimes> y' = \<one>" "y' \<otimes> y = \<one>"
     unfolding Units_def by fast
   from x y xinv yinv have "y' \<otimes> (x' \<otimes> x) \<otimes> y = \<one>" by simp
   moreover from x y xinv yinv have "x \<otimes> (y \<otimes> y') \<otimes> x' = \<one>" by simp
   moreover note x y
   ultimately show ?thesis unfolding Units_def
     by simp (metis m_assoc m_closed)
 qed
 
 lemma (in monoid) Units_one_closed [intro, simp]:
   "\<one> \<in> Units G"
   by (unfold Units_def) auto
 
 lemma (in monoid) Units_inv_closed [intro, simp]:
   "x \<in> Units G ==> inv x \<in> carrier G"
   apply (simp add: Units_def m_inv_def)
   by (metis (mono_tags, lifting) inv_unique the_equality)
 
 lemma (in monoid) Units_l_inv_ex:
   "x \<in> Units G ==> \<exists>y \<in> carrier G. y \<otimes> x = \<one>"
   by (unfold Units_def) auto
 
 lemma (in monoid) Units_r_inv_ex:
   "x \<in> Units G ==> \<exists>y \<in> carrier G. x \<otimes> y = \<one>"
   by (unfold Units_def) auto
 
 lemma (in monoid) Units_l_inv [simp]:
   "x \<in> Units G ==> inv x \<otimes> x = \<one>"
   apply (unfold Units_def m_inv_def, simp)
   by (metis (mono_tags, lifting) inv_unique the_equality)
 
 lemma (in monoid) Units_r_inv [simp]:
   "x \<in> Units G ==> x \<otimes> inv x = \<one>"
   by (metis (full_types) Units_closed Units_inv_closed Units_l_inv Units_r_inv_ex inv_unique)
 
 lemma (in monoid) inv_one [simp]:
   "inv \<one> = \<one>"
   by (metis Units_one_closed Units_r_inv l_one monoid.Units_inv_closed monoid_axioms)
 
 lemma (in monoid) Units_inv_Units [intro, simp]:
   "x \<in> Units G ==> inv x \<in> Units G"
 proof -
   assume x: "x \<in> Units G"
   show "inv x \<in> Units G"
     by (auto simp add: Units_def
       intro: Units_l_inv Units_r_inv x Units_closed [OF x])
 qed
 
 lemma (in monoid) Units_l_cancel [simp]:
   "[| x \<in> Units G; y \<in> carrier G; z \<in> carrier G |] ==>
    (x \<otimes> y = x \<otimes> z) = (y = z)"
 proof
   assume eq: "x \<otimes> y = x \<otimes> z"
     and G: "x \<in> Units G"  "y \<in> carrier G"  "z \<in> carrier G"
   then have "(inv x \<otimes> x) \<otimes> y = (inv x \<otimes> x) \<otimes> z"
     by (simp add: m_assoc Units_closed del: Units_l_inv)
   with G show "y = z" by simp
 next
   assume eq: "y = z"
     and G: "x \<in> Units G"  "y \<in> carrier G"  "z \<in> carrier G"
   then show "x \<otimes> y = x \<otimes> z" by simp
 qed
 
 lemma (in monoid) Units_inv_inv [simp]:
   "x \<in> Units G ==> inv (inv x) = x"
 proof -
   assume x: "x \<in> Units G"
   then have "inv x \<otimes> inv (inv x) = inv x \<otimes> x" by simp
   with x show ?thesis by (simp add: Units_closed del: Units_l_inv Units_r_inv)
 qed
 
 lemma (in monoid) inv_inj_on_Units:
   "inj_on (m_inv G) (Units G)"
 proof (rule inj_onI)
   fix x y
   assume G: "x \<in> Units G"  "y \<in> Units G" and eq: "inv x = inv y"
   then have "inv (inv x) = inv (inv y)" by simp
   with G show "x = y" by simp
 qed
 
 lemma (in monoid) Units_inv_comm:
   assumes inv: "x \<otimes> y = \<one>"
     and G: "x \<in> Units G"  "y \<in> Units G"
   shows "y \<otimes> x = \<one>"
 proof -
   from G have "x \<otimes> y \<otimes> x = x \<otimes> \<one>" by (auto simp add: inv Units_closed)
   with G show ?thesis by (simp del: r_one add: m_assoc Units_closed)
 qed
 
 lemma (in monoid) carrier_not_empty: "carrier G \<noteq> {}"
 by auto
 
 (* Jacobson defines submonoid here. *)
 (* Jacobson defines the order of a monoid here. *)
 
 
 subsection \<open>Groups\<close>
 
 text \<open>
   A group is a monoid all of whose elements are invertible.
 \<close>
 
 locale group = monoid +
   assumes Units: "carrier G <= Units G"
 
 lemma (in group) is_group [iff]: "group G" by (rule group_axioms)
 
 lemma (in group) is_monoid [iff]: "monoid G"
   by (rule monoid_axioms)
 
 theorem groupI:
   fixes G (structure)
   assumes m_closed [simp]:
       "!!x y. [| x \<in> carrier G; y \<in> carrier G |] ==> x \<otimes> y \<in> carrier G"
     and one_closed [simp]: "\<one> \<in> carrier G"
     and m_assoc:
       "!!x y z. [| x \<in> carrier G; y \<in> carrier G; z \<in> carrier G |] ==>
       (x \<otimes> y) \<otimes> z = x \<otimes> (y \<otimes> z)"
     and l_one [simp]: "!!x. x \<in> carrier G ==> \<one> \<otimes> x = x"
     and l_inv_ex: "!!x. x \<in> carrier G ==> \<exists>y \<in> carrier G. y \<otimes> x = \<one>"
   shows "group G"
 proof -
   have l_cancel [simp]:
     "!!x y z. [| x \<in> carrier G; y \<in> carrier G; z \<in> carrier G |] ==>
     (x \<otimes> y = x \<otimes> z) = (y = z)"
   proof
     fix x y z
     assume eq: "x \<otimes> y = x \<otimes> z"
       and G: "x \<in> carrier G"  "y \<in> carrier G"  "z \<in> carrier G"
     with l_inv_ex obtain x_inv where xG: "x_inv \<in> carrier G"
       and l_inv: "x_inv \<otimes> x = \<one>" by fast
     from G eq xG have "(x_inv \<otimes> x) \<otimes> y = (x_inv \<otimes> x) \<otimes> z"
       by (simp add: m_assoc)
     with G show "y = z" by (simp add: l_inv)
   next
     fix x y z
     assume eq: "y = z"
       and G: "x \<in> carrier G"  "y \<in> carrier G"  "z \<in> carrier G"
     then show "x \<otimes> y = x \<otimes> z" by simp
   qed
   have r_one:
     "!!x. x \<in> carrier G ==> x \<otimes> \<one> = x"
   proof -
     fix x
     assume x: "x \<in> carrier G"
     with l_inv_ex obtain x_inv where xG: "x_inv \<in> carrier G"
       and l_inv: "x_inv \<otimes> x = \<one>" by fast
     from x xG have "x_inv \<otimes> (x \<otimes> \<one>) = x_inv \<otimes> x"
       by (simp add: m_assoc [symmetric] l_inv)
     with x xG show "x \<otimes> \<one> = x" by simp
   qed
   have inv_ex:
     "\<And>x. x \<in> carrier G \<Longrightarrow> \<exists>y \<in> carrier G. y \<otimes> x = \<one> \<and> x \<otimes> y = \<one>"
   proof -
     fix x
     assume x: "x \<in> carrier G"
     with l_inv_ex obtain y where y: "y \<in> carrier G"
       and l_inv: "y \<otimes> x = \<one>" by fast
     from x y have "y \<otimes> (x \<otimes> y) = y \<otimes> \<one>"
       by (simp add: m_assoc [symmetric] l_inv r_one)
     with x y have r_inv: "x \<otimes> y = \<one>"
       by simp
     from x y show "\<exists>y \<in> carrier G. y \<otimes> x = \<one> \<and> x \<otimes> y = \<one>"
       by (fast intro: l_inv r_inv)
   qed
   then have carrier_subset_Units: "carrier G \<subseteq> Units G"
     by (unfold Units_def) fast
   show ?thesis
     by standard (auto simp: r_one m_assoc carrier_subset_Units)
 qed
 
 lemma (in monoid) group_l_invI:
   assumes l_inv_ex:
     "!!x. x \<in> carrier G ==> \<exists>y \<in> carrier G. y \<otimes> x = \<one>"
   shows "group G"
   by (rule groupI) (auto intro: m_assoc l_inv_ex)
 
 lemma (in group) Units_eq [simp]:
   "Units G = carrier G"
 proof
   show "Units G \<subseteq> carrier G" by fast
 next
   show "carrier G \<subseteq> Units G" by (rule Units)
 qed
 
 lemma (in group) inv_closed [intro, simp]:
   "x \<in> carrier G ==> inv x \<in> carrier G"
   using Units_inv_closed by simp
 
 lemma (in group) l_inv_ex [simp]:
   "x \<in> carrier G ==> \<exists>y \<in> carrier G. y \<otimes> x = \<one>"
   using Units_l_inv_ex by simp
 
 lemma (in group) r_inv_ex [simp]:
   "x \<in> carrier G ==> \<exists>y \<in> carrier G. x \<otimes> y = \<one>"
   using Units_r_inv_ex by simp
 
 lemma (in group) l_inv [simp]:
   "x \<in> carrier G ==> inv x \<otimes> x = \<one>"
   by simp
 
 
 subsection \<open>Cancellation Laws and Basic Properties\<close>
 
 lemma (in group) inv_eq_1_iff [simp]:
   assumes "x \<in> carrier G" shows "inv\<^bsub>G\<^esub> x = \<one>\<^bsub>G\<^esub> \<longleftrightarrow> x = \<one>\<^bsub>G\<^esub>"
 proof -
   have "x = \<one>" if "inv x = \<one>"
   proof -
     have "inv x \<otimes> x = \<one>"
       using assms l_inv by blast
     then show "x = \<one>"
       using that assms by simp
   qed
   then show ?thesis
     by auto
 qed
 
 lemma (in group) r_inv [simp]:
   "x \<in> carrier G ==> x \<otimes> inv x = \<one>"
   by simp
 
 lemma (in group) right_cancel [simp]:
   "[| x \<in> carrier G; y \<in> carrier G; z \<in> carrier G |] ==>
    (y \<otimes> x = z \<otimes> x) = (y = z)"
   by (metis inv_closed m_assoc r_inv r_one)
 
 lemma (in group) inv_inv [simp]:
   "x \<in> carrier G ==> inv (inv x) = x"
   using Units_inv_inv by simp
 
 lemma (in group) inv_inj:
   "inj_on (m_inv G) (carrier G)"
   using inv_inj_on_Units by simp
 
 lemma (in group) inv_mult_group:
   "[| x \<in> carrier G; y \<in> carrier G |] ==> inv (x \<otimes> y) = inv y \<otimes> inv x"
 proof -
   assume G: "x \<in> carrier G"  "y \<in> carrier G"
   then have "inv (x \<otimes> y) \<otimes> (x \<otimes> y) = (inv y \<otimes> inv x) \<otimes> (x \<otimes> y)"
     by (simp add: m_assoc) (simp add: m_assoc [symmetric])
   with G show ?thesis by (simp del: l_inv Units_l_inv)
 qed
 
 lemma (in group) inv_comm:
   "[| x \<otimes> y = \<one>; x \<in> carrier G; y \<in> carrier G |] ==> y \<otimes> x = \<one>"
   by (rule Units_inv_comm) auto
 
 lemma (in group) inv_equality:
      "[|y \<otimes> x = \<one>; x \<in> carrier G; y \<in> carrier G|] ==> inv x = y"
   using inv_unique r_inv by blast
 
 lemma (in group) inv_solve_left:
   "\<lbrakk> a \<in> carrier G; b \<in> carrier G; c \<in> carrier G \<rbrakk> \<Longrightarrow> a = inv b \<otimes> c \<longleftrightarrow> c = b \<otimes> a"
   by (metis inv_equality l_inv_ex l_one m_assoc r_inv)
 
 lemma (in group) inv_solve_left':
   "\<lbrakk> a \<in> carrier G; b \<in> carrier G; c \<in> carrier G \<rbrakk> \<Longrightarrow> inv b \<otimes> c = a \<longleftrightarrow> c = b \<otimes> a"
   by (metis inv_equality l_inv_ex l_one m_assoc r_inv)
 
 lemma (in group) inv_solve_right:
   "\<lbrakk> a \<in> carrier G; b \<in> carrier G; c \<in> carrier G \<rbrakk> \<Longrightarrow> a = b \<otimes> inv c \<longleftrightarrow> b = a \<otimes> c"
   by (metis inv_equality l_inv_ex l_one m_assoc r_inv)
 
 lemma (in group) inv_solve_right':
   "\<lbrakk>a \<in> carrier G; b \<in> carrier G; c \<in> carrier G\<rbrakk> \<Longrightarrow> b \<otimes> inv c = a \<longleftrightarrow> b = a \<otimes> c"
   by (auto simp: m_assoc)
   
 
 subsection \<open>Power\<close>
 
 consts
   pow :: "[('a, 'm) monoid_scheme, 'a, 'b::semiring_1] => 'a"  (infixr "[^]\<index>" 75)
 
 overloading nat_pow == "pow :: [_, 'a, nat] => 'a"
 begin
   definition "nat_pow G a n = rec_nat \<one>\<^bsub>G\<^esub> (%u b. b \<otimes>\<^bsub>G\<^esub> a) n"
 end
 
 lemma (in monoid) nat_pow_closed [intro, simp]:
   "x \<in> carrier G ==> x [^] (n::nat) \<in> carrier G"
   by (induct n) (simp_all add: nat_pow_def)
 
 lemma (in monoid) nat_pow_0 [simp]:
   "x [^] (0::nat) = \<one>"
   by (simp add: nat_pow_def)
 
 lemma (in monoid) nat_pow_Suc [simp]:
   "x [^] (Suc n) = x [^] n \<otimes> x"
   by (simp add: nat_pow_def)
 
 lemma (in monoid) nat_pow_one [simp]:
   "\<one> [^] (n::nat) = \<one>"
   by (induct n) simp_all
 
 lemma (in monoid) nat_pow_mult:
   "x \<in> carrier G ==> x [^] (n::nat) \<otimes> x [^] m = x [^] (n + m)"
   by (induct m) (simp_all add: m_assoc [THEN sym])
 
 lemma (in monoid) nat_pow_comm:
   "x \<in> carrier G \<Longrightarrow> (x [^] (n::nat)) \<otimes> (x [^] (m :: nat)) = (x [^] m) \<otimes> (x [^] n)"
   using nat_pow_mult[of x n m] nat_pow_mult[of x m n] by (simp add: add.commute)
 
 lemma (in monoid) nat_pow_Suc2:
   "x \<in> carrier G \<Longrightarrow> x [^] (Suc n) = x \<otimes> (x [^] n)"
   using nat_pow_mult[of x 1 n] Suc_eq_plus1[of n]
   by (metis One_nat_def Suc_eq_plus1_left l_one nat.rec(1) nat_pow_Suc nat_pow_def)
 
 lemma (in monoid) nat_pow_pow:
   "x \<in> carrier G ==> (x [^] n) [^] m = x [^] (n * m::nat)"
   by (induct m) (simp, simp add: nat_pow_mult add.commute)
 
 lemma (in monoid) nat_pow_consistent:
   "x [^] (n :: nat) = x [^]\<^bsub>(G \<lparr> carrier := H \<rparr>)\<^esub> n"
   unfolding nat_pow_def by simp
 
 lemma nat_pow_0 [simp]: "x [^]\<^bsub>G\<^esub> (0::nat) = \<one>\<^bsub>G\<^esub>"
   by (simp add: nat_pow_def)
 
 lemma nat_pow_Suc [simp]: "x [^]\<^bsub>G\<^esub> (Suc n) = (x [^]\<^bsub>G\<^esub> n)\<otimes>\<^bsub>G\<^esub> x"
   by (simp add: nat_pow_def)
 
 lemma (in group) nat_pow_inv:
   assumes "x \<in> carrier G" shows "(inv x) [^] (i :: nat) = inv (x [^] i)"
 proof (induction i)
   case 0 thus ?case by simp
 next
   case (Suc i)
   have "(inv x) [^] Suc i = ((inv x) [^] i) \<otimes> inv x"
     by simp
   also have " ... = (inv (x [^] i)) \<otimes> inv x"
     by (simp add: Suc.IH Suc.prems)
   also have " ... = inv (x \<otimes> (x [^] i))"
     by (simp add: assms inv_mult_group)
   also have " ... = inv (x [^] (Suc i))"
     using assms nat_pow_Suc2 by auto
   finally show ?case .
 qed
 
 overloading int_pow == "pow :: [_, 'a, int] => 'a"
 begin
   definition "int_pow G a z =
    (let p = rec_nat \<one>\<^bsub>G\<^esub> (%u b. b \<otimes>\<^bsub>G\<^esub> a)
     in if z < 0 then inv\<^bsub>G\<^esub> (p (nat (-z))) else p (nat z))"
 end
 
 lemma int_pow_int: "x [^]\<^bsub>G\<^esub> (int n) = x [^]\<^bsub>G\<^esub> n"
   by(simp add: int_pow_def nat_pow_def)
 
 lemma pow_nat:
   assumes "i\<ge>0"
   shows "x [^]\<^bsub>G\<^esub> nat i = x [^]\<^bsub>G\<^esub> i"
 proof (cases i rule: int_cases)
   case (nonneg n)
   then show ?thesis
     by (simp add: int_pow_int)
 next
   case (neg n)
   then show ?thesis
     using assms by linarith
 qed
 
 lemma int_pow_0 [simp]: "x [^]\<^bsub>G\<^esub> (0::int) = \<one>\<^bsub>G\<^esub>"
   by (simp add: int_pow_def)
 
 lemma int_pow_def2: "a [^]\<^bsub>G\<^esub> z =
    (if z < 0 then inv\<^bsub>G\<^esub> (a [^]\<^bsub>G\<^esub> (nat (-z))) else a [^]\<^bsub>G\<^esub> (nat z))"
   by (simp add: int_pow_def nat_pow_def)
 
 lemma (in group) int_pow_one [simp]:
   "\<one> [^] (z::int) = \<one>"
   by (simp add: int_pow_def2)
 
 lemma (in group) int_pow_closed [intro, simp]:
   "x \<in> carrier G ==> x [^] (i::int) \<in> carrier G"
   by (simp add: int_pow_def2)
 
 lemma (in group) int_pow_1 [simp]:
   "x \<in> carrier G \<Longrightarrow> x [^] (1::int) = x"
   by (simp add: int_pow_def2)
 
 lemma (in group) int_pow_neg:
   "x \<in> carrier G \<Longrightarrow> x [^] (-i::int) = inv (x [^] i)"
   by (simp add: int_pow_def2)
 
 lemma (in group) int_pow_neg_int: "x \<in> carrier G \<Longrightarrow> x [^] -(int n) = inv (x [^] n)"
   by (simp add: int_pow_neg int_pow_int)
 
 lemma (in group) int_pow_mult:
   assumes "x \<in> carrier G" shows "x [^] (i + j::int) = x [^] i \<otimes> x [^] j"
 proof -
   have [simp]: "-i - j = -j - i" by simp
   show ?thesis
     by (auto simp: assms int_pow_def2 inv_solve_left inv_solve_right nat_add_distrib [symmetric] nat_pow_mult)
 qed
 
 lemma (in group) int_pow_inv:
   "x \<in> carrier G \<Longrightarrow> (inv x) [^] (i :: int) = inv (x [^] i)"
   by (metis int_pow_def2 nat_pow_inv)
 
 lemma (in group) int_pow_pow:
   assumes "x \<in> carrier G"
   shows "(x [^] (n :: int)) [^] (m :: int) = x [^] (n * m :: int)"
 proof (cases)
   assume n_ge: "n \<ge> 0" thus ?thesis
   proof (cases)
     assume m_ge: "m \<ge> 0" thus ?thesis
       using n_ge nat_pow_pow[OF assms, of "nat n" "nat m"] int_pow_def2 [where G=G]
       by (simp add: mult_less_0_iff nat_mult_distrib)
   next
     assume m_lt: "\<not> m \<ge> 0" 
     with n_ge show ?thesis
       apply (simp add: int_pow_def2 mult_less_0_iff)
       by (metis assms mult_minus_right n_ge nat_mult_distrib nat_pow_pow)
   qed
 next
   assume n_lt: "\<not> n \<ge> 0" thus ?thesis
   proof (cases)
     assume m_ge: "m \<ge> 0" 
     have "inv x [^] (nat m * nat (- n)) = inv x [^] nat (- (m * n))"
       by (metis (full_types) m_ge mult_minus_right nat_mult_distrib)
     with m_ge n_lt show ?thesis
       by (simp add: int_pow_def2 mult_less_0_iff assms mult.commute nat_pow_inv nat_pow_pow)
   next
     assume m_lt: "\<not> m \<ge> 0" thus ?thesis
       using n_lt by (auto simp: int_pow_def2 mult_less_0_iff assms nat_mult_distrib_neg nat_pow_inv nat_pow_pow)
   qed
 qed
 
 lemma (in group) int_pow_diff:
   "x \<in> carrier G \<Longrightarrow> x [^] (n - m :: int) = x [^] n \<otimes> inv (x [^] m)"
   by(simp only: diff_conv_add_uminus int_pow_mult int_pow_neg)
 
 lemma (in group) inj_on_multc: "c \<in> carrier G \<Longrightarrow> inj_on (\<lambda>x. x \<otimes> c) (carrier G)"
   by(simp add: inj_on_def)
 
 lemma (in group) inj_on_cmult: "c \<in> carrier G \<Longrightarrow> inj_on (\<lambda>x. c \<otimes> x) (carrier G)"
   by(simp add: inj_on_def)
 
 
 lemma (in monoid) group_commutes_pow:
   fixes n::nat
   shows "\<lbrakk>x \<otimes> y = y \<otimes> x; x \<in> carrier G; y \<in> carrier G\<rbrakk> \<Longrightarrow> x [^] n \<otimes> y = y \<otimes> x [^] n"
   apply (induction n, auto)
   by (metis m_assoc nat_pow_closed)
 
 lemma (in monoid) pow_mult_distrib:
   assumes eq: "x \<otimes> y = y \<otimes> x" and xy: "x \<in> carrier G" "y \<in> carrier G"
   shows "(x \<otimes> y) [^] (n::nat) = x [^] n \<otimes> y [^] n"
 proof (induct n)
   case (Suc n)
   have "x \<otimes> (y [^] n \<otimes> y) = y [^] n \<otimes> x \<otimes> y"
     by (simp add: eq group_commutes_pow m_assoc xy)
   then show ?case
     using assms Suc.hyps m_assoc by auto
 qed auto
 
 lemma (in group) int_pow_mult_distrib:
   assumes eq: "x \<otimes> y = y \<otimes> x" and xy: "x \<in> carrier G" "y \<in> carrier G"
   shows "(x \<otimes> y) [^] (i::int) = x [^] i \<otimes> y [^] i"
 proof (cases i rule: int_cases)
   case (nonneg n)
   then show ?thesis
     by (metis eq int_pow_int pow_mult_distrib xy)
 next
   case (neg n)
   then show ?thesis
     unfolding neg
     apply (simp add: xy int_pow_neg_int del: of_nat_Suc)
     by (metis eq inv_mult_group local.nat_pow_Suc nat_pow_closed pow_mult_distrib xy)
 qed
 
 lemma (in group) pow_eq_div2:
   fixes m n :: nat
   assumes x_car: "x \<in> carrier G"
   assumes pow_eq: "x [^] m = x [^] n"
   shows "x [^] (m - n) = \<one>"
 proof (cases "m < n")
   case False
   have "\<one> \<otimes> x [^] m = x [^] m" by (simp add: x_car)
   also have "\<dots> = x [^] (m - n) \<otimes> x [^] n"
     using False by (simp add: nat_pow_mult x_car)
   also have "\<dots> = x [^] (m - n) \<otimes> x [^] m"
     by (simp add: pow_eq)
   finally show ?thesis
     by (metis nat_pow_closed one_closed right_cancel x_car)
 qed simp
 
 subsection \<open>Submonoids\<close>
 
 locale submonoid = \<^marker>\<open>contributor \<open>Martin Baillon\<close>\<close>
   fixes H and G (structure)
   assumes subset: "H \<subseteq> carrier G"
     and m_closed [intro, simp]: "\<lbrakk>x \<in> H; y \<in> H\<rbrakk> \<Longrightarrow> x \<otimes> y \<in> H"
     and one_closed [simp]: "\<one> \<in> H"
 
 lemma (in submonoid) is_submonoid: \<^marker>\<open>contributor \<open>Martin Baillon\<close>\<close>
   "submonoid H G" by (rule submonoid_axioms)
 
 lemma (in submonoid) mem_carrier [simp]: \<^marker>\<open>contributor \<open>Martin Baillon\<close>\<close>
   "x \<in> H \<Longrightarrow> x \<in> carrier G"
   using subset by blast
 
 lemma (in submonoid) submonoid_is_monoid [intro]: \<^marker>\<open>contributor \<open>Martin Baillon\<close>\<close>
   assumes "monoid G"
   shows "monoid (G\<lparr>carrier := H\<rparr>)"
 proof -
   interpret monoid G by fact
   show ?thesis
     by (simp add: monoid_def m_assoc)
 qed
 
 lemma submonoid_nonempty: \<^marker>\<open>contributor \<open>Martin Baillon\<close>\<close>
   "~ submonoid {} G"
   by (blast dest: submonoid.one_closed)
 
 lemma (in submonoid) finite_monoid_imp_card_positive: \<^marker>\<open>contributor \<open>Martin Baillon\<close>\<close>
   "finite (carrier G) ==> 0 < card H"
 proof (rule classical)
   assume "finite (carrier G)" and a: "~ 0 < card H"
   then have "finite H" by (blast intro: finite_subset [OF subset])
   with is_submonoid a have "submonoid {} G" by simp
   with submonoid_nonempty show ?thesis by contradiction
 qed
 
 
 lemma (in monoid) monoid_incl_imp_submonoid : \<^marker>\<open>contributor \<open>Martin Baillon\<close>\<close>
   assumes "H \<subseteq> carrier G"
 and "monoid (G\<lparr>carrier := H\<rparr>)"
 shows "submonoid H G"
 proof (intro submonoid.intro[OF assms(1)])
   have ab_eq : "\<And> a b. a \<in> H \<Longrightarrow> b \<in> H \<Longrightarrow> a \<otimes>\<^bsub>G\<lparr>carrier := H\<rparr>\<^esub> b = a \<otimes> b" using assms by simp
   have "\<And>a b. a \<in> H \<Longrightarrow> b \<in> H \<Longrightarrow> a \<otimes> b \<in> carrier (G\<lparr>carrier := H\<rparr>) "
     using assms ab_eq unfolding group_def using monoid.m_closed by fastforce
   thus "\<And>a b. a \<in> H \<Longrightarrow> b \<in> H \<Longrightarrow> a \<otimes> b \<in> H" by simp
   show "\<one> \<in> H " using monoid.one_closed[OF assms(2)] assms by simp
 qed
 
 lemma (in monoid) inv_unique': \<^marker>\<open>contributor \<open>Martin Baillon\<close>\<close>
   assumes "x \<in> carrier G" "y \<in> carrier G"
   shows "\<lbrakk> x \<otimes> y = \<one>; y \<otimes> x = \<one> \<rbrakk> \<Longrightarrow> y = inv x"
 proof -
   assume "x \<otimes> y = \<one>" and l_inv: "y \<otimes> x = \<one>"
   hence unit: "x \<in> Units G"
     using assms unfolding Units_def by auto
   show "y = inv x"
     using inv_unique[OF l_inv Units_r_inv[OF unit] assms Units_inv_closed[OF unit]] .
 qed
 
 lemma (in monoid) m_inv_monoid_consistent: \<^marker>\<open>contributor \<open>Paulo Emílio de Vilhena\<close>\<close>
   assumes "x \<in> Units (G \<lparr> carrier := H \<rparr>)" and "submonoid H G"
   shows "inv\<^bsub>(G \<lparr> carrier := H \<rparr>)\<^esub> x = inv x"
 proof -
   have monoid: "monoid (G \<lparr> carrier := H \<rparr>)"
     using submonoid.submonoid_is_monoid[OF assms(2) monoid_axioms] .
   obtain y where y: "y \<in> H" "x \<otimes> y = \<one>" "y \<otimes> x = \<one>"
     using assms(1) unfolding Units_def by auto
   have x: "x \<in> H" and in_carrier: "x \<in> carrier G" "y \<in> carrier G"
     using y(1) submonoid.subset[OF assms(2)] assms(1) unfolding Units_def by auto
   show ?thesis
     using monoid.inv_unique'[OF monoid, of x y] x y
     using inv_unique'[OF in_carrier y(2-3)] by auto
 qed
 
 subsection \<open>Subgroups\<close>
 
 locale subgroup =
   fixes H and G (structure)
   assumes subset: "H \<subseteq> carrier G"
     and m_closed [intro, simp]: "\<lbrakk>x \<in> H; y \<in> H\<rbrakk> \<Longrightarrow> x \<otimes> y \<in> H"
     and one_closed [simp]: "\<one> \<in> H"
     and m_inv_closed [intro,simp]: "x \<in> H \<Longrightarrow> inv x \<in> H"
 
 lemma (in subgroup) is_subgroup:
   "subgroup H G" by (rule subgroup_axioms)
 
 declare (in subgroup) group.intro [intro]
 
 lemma (in subgroup) mem_carrier [simp]:
   "x \<in> H \<Longrightarrow> x \<in> carrier G"
   using subset by blast
 
 lemma (in subgroup) subgroup_is_group [intro]:
   assumes "group G"
   shows "group (G\<lparr>carrier := H\<rparr>)"
 proof -
   interpret group G by fact
   have "Group.monoid (G\<lparr>carrier := H\<rparr>)"
     by (simp add: monoid_axioms submonoid.intro submonoid.submonoid_is_monoid subset)
   then show ?thesis
     by (rule monoid.group_l_invI) (auto intro: l_inv mem_carrier)
 qed
 
 lemma subgroup_is_submonoid:
   assumes "subgroup H G" shows "submonoid H G"
   using assms by (auto intro: submonoid.intro simp add: subgroup_def)
 
 lemma (in group) subgroup_Units:
   assumes "subgroup H G" shows "H \<subseteq> Units (G \<lparr> carrier := H \<rparr>)"
   using group.Units[OF subgroup.subgroup_is_group[OF assms group_axioms]] by simp
 
 lemma (in group) m_inv_consistent [simp]:
   assumes "subgroup H G" "x \<in> H"
   shows "inv\<^bsub>(G \<lparr> carrier := H \<rparr>)\<^esub> x = inv x"
   using assms m_inv_monoid_consistent[OF _ subgroup_is_submonoid] subgroup_Units[of H] by auto
 
 lemma (in group) int_pow_consistent: \<^marker>\<open>contributor \<open>Paulo Emílio de Vilhena\<close>\<close>
   assumes "subgroup H G" "x \<in> H"
   shows "x [^] (n :: int) = x [^]\<^bsub>(G \<lparr> carrier := H \<rparr>)\<^esub> n"
 proof (cases)
   assume ge: "n \<ge> 0"
   hence "x [^] n = x [^] (nat n)"
     using int_pow_def2 [of G] by auto
   also have " ... = x [^]\<^bsub>(G \<lparr> carrier := H \<rparr>)\<^esub> (nat n)"
     using nat_pow_consistent by simp
   also have " ... = x [^]\<^bsub>(G \<lparr> carrier := H \<rparr>)\<^esub> n"
     by (metis ge int_nat_eq int_pow_int)
   finally show ?thesis .
 next
   assume "\<not> n \<ge> 0" hence lt: "n < 0" by simp
   hence "x [^] n = inv (x [^] (nat (- n)))"
     using int_pow_def2 [of G] by auto
   also have " ... = (inv x) [^] (nat (- n))"
     by (metis assms nat_pow_inv subgroup.mem_carrier)
   also have " ... = (inv\<^bsub>(G \<lparr> carrier := H \<rparr>)\<^esub> x) [^]\<^bsub>(G \<lparr> carrier := H \<rparr>)\<^esub> (nat (- n))"
     using m_inv_consistent[OF assms] nat_pow_consistent by auto
   also have " ... = inv\<^bsub>(G \<lparr> carrier := H \<rparr>)\<^esub> (x [^]\<^bsub>(G \<lparr> carrier := H \<rparr>)\<^esub> (nat (- n)))"
     using group.nat_pow_inv[OF subgroup.subgroup_is_group[OF assms(1) is_group]] assms(2) by auto
   also have " ... = x [^]\<^bsub>(G \<lparr> carrier := H \<rparr>)\<^esub> n"
     by (simp add: int_pow_def2 lt)
   finally show ?thesis .
 qed
 
 text \<open>
   Since \<^term>\<open>H\<close> is nonempty, it contains some element \<^term>\<open>x\<close>.  Since
   it is closed under inverse, it contains \<open>inv x\<close>.  Since
   it is closed under product, it contains \<open>x \<otimes> inv x = \<one>\<close>.
 \<close>
 
 lemma (in group) one_in_subset:
   "[| H \<subseteq> carrier G; H \<noteq> {}; \<forall>a \<in> H. inv a \<in> H; \<forall>a\<in>H. \<forall>b\<in>H. a \<otimes> b \<in> H |]
    ==> \<one> \<in> H"
 by force
 
 text \<open>A characterization of subgroups: closed, non-empty subset.\<close>
 
 lemma (in group) subgroupI:
   assumes subset: "H \<subseteq> carrier G" and non_empty: "H \<noteq> {}"
     and inv: "!!a. a \<in> H \<Longrightarrow> inv a \<in> H"
     and mult: "!!a b. \<lbrakk>a \<in> H; b \<in> H\<rbrakk> \<Longrightarrow> a \<otimes> b \<in> H"
   shows "subgroup H G"
 proof (simp add: subgroup_def assms)
   show "\<one> \<in> H" by (rule one_in_subset) (auto simp only: assms)
 qed
 
 lemma (in group) subgroupE:
   assumes "subgroup H G"
   shows "H \<subseteq> carrier G"
     and "H \<noteq> {}"
     and "\<And>a. a \<in> H \<Longrightarrow> inv a \<in> H"
     and "\<And>a b. \<lbrakk> a \<in> H; b \<in> H \<rbrakk> \<Longrightarrow> a \<otimes> b \<in> H"
   using assms unfolding subgroup_def[of H G] by auto
 
 declare monoid.one_closed [iff] group.inv_closed [simp]
   monoid.l_one [simp] monoid.r_one [simp] group.inv_inv [simp]
 
 lemma subgroup_nonempty:
   "\<not> subgroup {} G"
   by (blast dest: subgroup.one_closed)
 
 lemma (in subgroup) finite_imp_card_positive: "finite (carrier G) \<Longrightarrow> 0 < card H"
   using subset one_closed card_gt_0_iff finite_subset by blast
 
 lemma (in subgroup) subgroup_is_submonoid : \<^marker>\<open>contributor \<open>Martin Baillon\<close>\<close>
   "submonoid H G"
   by (simp add: submonoid.intro subset)
 
 lemma (in group) submonoid_subgroupI : \<^marker>\<open>contributor \<open>Martin Baillon\<close>\<close>
   assumes "submonoid H G"
     and "\<And>a. a \<in> H \<Longrightarrow> inv a \<in> H"
   shows "subgroup H G"
   by (metis assms subgroup_def submonoid_def)
 
 lemma (in group) group_incl_imp_subgroup: \<^marker>\<open>contributor \<open>Martin Baillon\<close>\<close>
   assumes "H \<subseteq> carrier G"
     and "group (G\<lparr>carrier := H\<rparr>)"
   shows "subgroup H G"
 proof (intro submonoid_subgroupI[OF monoid_incl_imp_submonoid[OF assms(1)]])
   show "monoid (G\<lparr>carrier := H\<rparr>)" using group_def assms by blast
   have ab_eq : "\<And> a b. a \<in> H \<Longrightarrow> b \<in> H \<Longrightarrow> a \<otimes>\<^bsub>G\<lparr>carrier := H\<rparr>\<^esub> b = a \<otimes> b" using assms by simp
   fix a  assume aH : "a \<in> H"
   have " inv\<^bsub>G\<lparr>carrier := H\<rparr>\<^esub> a \<in> carrier G"
     using assms aH group.inv_closed[OF assms(2)] by auto
   moreover have "\<one>\<^bsub>G\<lparr>carrier := H\<rparr>\<^esub> = \<one>" using assms monoid.one_closed ab_eq one_def by simp
   hence "a \<otimes>\<^bsub>G\<lparr>carrier := H\<rparr>\<^esub> inv\<^bsub>G\<lparr>carrier := H\<rparr>\<^esub> a= \<one>"
     using assms ab_eq aH  group.r_inv[OF assms(2)] by simp
   hence "a \<otimes> inv\<^bsub>G\<lparr>carrier := H\<rparr>\<^esub> a= \<one>"
     using aH assms group.inv_closed[OF assms(2)] ab_eq by simp
   ultimately have "inv\<^bsub>G\<lparr>carrier := H\<rparr>\<^esub> a = inv a"
     by (metis aH assms(1) contra_subsetD group.inv_inv is_group local.inv_equality)
   moreover have "inv\<^bsub>G\<lparr>carrier := H\<rparr>\<^esub> a \<in> H" 
     using aH group.inv_closed[OF assms(2)] by auto
   ultimately show "inv a \<in> H" by auto
 qed
 
 
 subsection \<open>Direct Products\<close>
 
 definition
   DirProd :: "_ \<Rightarrow> _ \<Rightarrow> ('a \<times> 'b) monoid" (infixr "\<times>\<times>" 80) where
   "G \<times>\<times> H =
     \<lparr>carrier = carrier G \<times> carrier H,
      mult = (\<lambda>(g, h) (g', h'). (g \<otimes>\<^bsub>G\<^esub> g', h \<otimes>\<^bsub>H\<^esub> h')),
      one = (\<one>\<^bsub>G\<^esub>, \<one>\<^bsub>H\<^esub>)\<rparr>"
 
 lemma DirProd_monoid:
   assumes "monoid G" and "monoid H"
   shows "monoid (G \<times>\<times> H)"
 proof -
   interpret G: monoid G by fact
   interpret H: monoid H by fact
   from assms
   show ?thesis by (unfold monoid_def DirProd_def, auto)
 qed
 
 
 text\<open>Does not use the previous result because it's easier just to use auto.\<close>
 lemma DirProd_group:
   assumes "group G" and "group H"
   shows "group (G \<times>\<times> H)"
 proof -
   interpret G: group G by fact
   interpret H: group H by fact
   show ?thesis by (rule groupI)
      (auto intro: G.m_assoc H.m_assoc G.l_inv H.l_inv
            simp add: DirProd_def)
 qed
 
 lemma carrier_DirProd [simp]: "carrier (G \<times>\<times> H) = carrier G \<times> carrier H"
   by (simp add: DirProd_def)
 
 lemma one_DirProd [simp]: "\<one>\<^bsub>G \<times>\<times> H\<^esub> = (\<one>\<^bsub>G\<^esub>, \<one>\<^bsub>H\<^esub>)"
   by (simp add: DirProd_def)
 
 lemma mult_DirProd [simp]: "(g, h) \<otimes>\<^bsub>(G \<times>\<times> H)\<^esub> (g', h') = (g \<otimes>\<^bsub>G\<^esub> g', h \<otimes>\<^bsub>H\<^esub> h')"
   by (simp add: DirProd_def)
 
 lemma mult_DirProd': "x \<otimes>\<^bsub>(G \<times>\<times> H)\<^esub> y = (fst x \<otimes>\<^bsub>G\<^esub> fst y, snd x \<otimes>\<^bsub>H\<^esub> snd y)"
   by (subst mult_DirProd [symmetric]) simp
 
 lemma DirProd_assoc: "(G \<times>\<times> H \<times>\<times> I) = (G \<times>\<times> (H \<times>\<times> I))"
   by auto
 
 lemma inv_DirProd [simp]:
   assumes "group G" and "group H"
   assumes g: "g \<in> carrier G"
       and h: "h \<in> carrier H"
   shows "m_inv (G \<times>\<times> H) (g, h) = (inv\<^bsub>G\<^esub> g, inv\<^bsub>H\<^esub> h)"
 proof -
   interpret G: group G by fact
   interpret H: group H by fact
   interpret Prod: group "G \<times>\<times> H"
     by (auto intro: DirProd_group group.intro group.axioms assms)
   show ?thesis by (simp add: Prod.inv_equality g h)
 qed
 
 lemma DirProd_subgroups :
   assumes "group G"
     and "subgroup H G"
     and "group K"
     and "subgroup I K"
   shows "subgroup (H \<times> I) (G \<times>\<times> K)"
 proof (intro group.group_incl_imp_subgroup[OF DirProd_group[OF assms(1)assms(3)]])
   have "H \<subseteq> carrier G" "I \<subseteq> carrier K" using subgroup.subset assms by blast+
   thus "(H \<times> I) \<subseteq> carrier (G \<times>\<times> K)" unfolding DirProd_def by auto
   have "Group.group ((G\<lparr>carrier := H\<rparr>) \<times>\<times> (K\<lparr>carrier := I\<rparr>))"
     using DirProd_group[OF subgroup.subgroup_is_group[OF assms(2)assms(1)]
         subgroup.subgroup_is_group[OF assms(4)assms(3)]].
   moreover have "((G\<lparr>carrier := H\<rparr>) \<times>\<times> (K\<lparr>carrier := I\<rparr>)) = ((G \<times>\<times> K)\<lparr>carrier := H \<times> I\<rparr>)"
     unfolding DirProd_def using assms by simp
   ultimately show "Group.group ((G \<times>\<times> K)\<lparr>carrier := H \<times> I\<rparr>)" by simp
 qed
 
 subsection \<open>Homomorphisms (mono and epi) and Isomorphisms\<close>
 
 definition
   hom :: "_ => _ => ('a => 'b) set" where
   "hom G H =
     {h. h \<in> carrier G \<rightarrow> carrier H \<and>
       (\<forall>x \<in> carrier G. \<forall>y \<in> carrier G. h (x \<otimes>\<^bsub>G\<^esub> y) = h x \<otimes>\<^bsub>H\<^esub> h y)}"
 
 lemma homI:
   "\<lbrakk>\<And>x. x \<in> carrier G \<Longrightarrow> h x \<in> carrier H;
     \<And>x y. \<lbrakk>x \<in> carrier G; y \<in> carrier G\<rbrakk> \<Longrightarrow> h (x \<otimes>\<^bsub>G\<^esub> y) = h x \<otimes>\<^bsub>H\<^esub> h y\<rbrakk> \<Longrightarrow> h \<in> hom G H"
   by (auto simp: hom_def)
 
 lemma hom_carrier: "h \<in> hom G H \<Longrightarrow> h ` carrier G \<subseteq> carrier H"
   by (auto simp: hom_def)
 
 lemma hom_in_carrier: "\<lbrakk>h \<in> hom G H; x \<in> carrier G\<rbrakk> \<Longrightarrow> h x \<in> carrier H"
   by (auto simp: hom_def)
 
 lemma hom_compose:
   "\<lbrakk> f \<in> hom G H; g \<in> hom H I \<rbrakk> \<Longrightarrow> g \<circ> f \<in> hom G I"
   unfolding hom_def by (auto simp add: Pi_iff)
 
 lemma (in group) hom_restrict:
   assumes "h \<in> hom G H" and "\<And>g. g \<in> carrier G \<Longrightarrow> h g = t g" shows "t \<in> hom G H"
   using assms unfolding hom_def by (auto simp add: Pi_iff)
 
 lemma (in group) hom_compose:
   "[|h \<in> hom G H; i \<in> hom H I|] ==> compose (carrier G) i h \<in> hom G I"
 by (fastforce simp add: hom_def compose_def)
 
 lemma (in group) restrict_hom_iff [simp]:
   "(\<lambda>x. if x \<in> carrier G then f x else g x) \<in> hom G H \<longleftrightarrow> f \<in> hom G H"
   by (simp add: hom_def Pi_iff)
 
 definition iso :: "_ => _ => ('a => 'b) set"
   where "iso G H = {h. h \<in> hom G H \<and> bij_betw h (carrier G) (carrier H)}"
 
 definition is_iso :: "_ \<Rightarrow> _ \<Rightarrow> bool" (infixr "\<cong>" 60)
   where "G \<cong> H = (iso G H  \<noteq> {})"
 
 definition mon where "mon G H = {f \<in> hom G H. inj_on f (carrier G)}"
 
 definition epi where "epi G H = {f \<in> hom G H. f ` (carrier G) = carrier H}"
 
 lemma isoI:
   "\<lbrakk>h \<in> hom G H; bij_betw h (carrier G) (carrier H)\<rbrakk> \<Longrightarrow> h \<in> iso G H"
   by (auto simp: iso_def)
 
 lemma is_isoI: "h \<in> iso G H \<Longrightarrow> G \<cong> H"
   using is_iso_def by auto
 
 lemma epi_iff_subset:
    "f \<in> epi G G' \<longleftrightarrow> f \<in> hom G G' \<and> carrier G' \<subseteq> f ` carrier G"
   by (auto simp: epi_def hom_def)
 
 lemma iso_iff_mon_epi: "f \<in> iso G H \<longleftrightarrow> f \<in> mon G H \<and> f \<in> epi G H"
   by (auto simp: iso_def mon_def epi_def bij_betw_def)
 
 lemma iso_set_refl: "(\<lambda>x. x) \<in> iso G G"
   by (simp add: iso_def hom_def inj_on_def bij_betw_def Pi_def)
 
 lemma id_iso: "id \<in> iso G G"
   by (simp add: iso_def hom_def inj_on_def bij_betw_def Pi_def)
 
 corollary iso_refl [simp]: "G \<cong> G"
   using iso_set_refl unfolding is_iso_def by auto
 
 lemma iso_iff:
    "h \<in> iso G H \<longleftrightarrow> h \<in> hom G H \<and> h ` (carrier G) = carrier H \<and> inj_on h (carrier G)"
   by (auto simp: iso_def hom_def bij_betw_def)
 
 lemma iso_imp_homomorphism:
    "h \<in> iso G H \<Longrightarrow> h \<in> hom G H"
   by (simp add: iso_iff)
 
 lemma trivial_hom:
    "group H \<Longrightarrow> (\<lambda>x. one H) \<in> hom G H"
   by (auto simp: hom_def Group.group_def)
 
 lemma (in group) hom_eq:
   assumes "f \<in> hom G H" "\<And>x. x \<in> carrier G \<Longrightarrow> f' x = f x"
   shows "f' \<in> hom G H"
   using assms by (auto simp: hom_def)
 
 lemma (in group) iso_eq:
   assumes "f \<in> iso G H" "\<And>x. x \<in> carrier G \<Longrightarrow> f' x = f x"
   shows "f' \<in> iso G H"
   using assms  by (fastforce simp: iso_def inj_on_def bij_betw_def hom_eq image_iff)
 
 lemma (in group) iso_set_sym:
   assumes "h \<in> iso G H"
   shows "inv_into (carrier G) h \<in> iso H G"
 proof -
   have h: "h \<in> hom G H" "bij_betw h (carrier G) (carrier H)"
     using assms by (auto simp add: iso_def bij_betw_inv_into)
   then have HG: "bij_betw (inv_into (carrier G) h) (carrier H) (carrier G)"
     by (simp add: bij_betw_inv_into)
   have "inv_into (carrier G) h \<in> hom H G"
     unfolding hom_def
   proof safe
     show *: "\<And>x. x \<in> carrier H \<Longrightarrow> inv_into (carrier G) h x \<in> carrier G"
       by (meson HG bij_betwE)
     show "inv_into (carrier G) h (x \<otimes>\<^bsub>H\<^esub> y) = inv_into (carrier G) h x \<otimes> inv_into (carrier G) h y"
       if "x \<in> carrier H" "y \<in> carrier H" for x y
     proof (rule inv_into_f_eq)
       show "inj_on h (carrier G)"
         using bij_betw_def h(2) by blast
       show "inv_into (carrier G) h x \<otimes> inv_into (carrier G) h y \<in> carrier G"
         by (simp add: * that)
       show "h (inv_into (carrier G) h x \<otimes> inv_into (carrier G) h y) = x \<otimes>\<^bsub>H\<^esub> y"
         using h bij_betw_inv_into_right [of h] unfolding hom_def by (simp add: "*" that)
     qed
   qed
   then show ?thesis
     by (simp add: Group.iso_def bij_betw_inv_into h)
 qed
 
 corollary (in group) iso_sym: "G \<cong> H \<Longrightarrow> H \<cong> G"
   using iso_set_sym unfolding is_iso_def by auto
 
 lemma iso_set_trans:
   "\<lbrakk>h \<in> Group.iso G H; i \<in> Group.iso H I\<rbrakk> \<Longrightarrow> i \<circ> h \<in> Group.iso G I"
   by (force simp: iso_def hom_compose intro: bij_betw_trans)
 
 corollary iso_trans [trans]: "\<lbrakk>G \<cong> H ; H \<cong> I\<rbrakk> \<Longrightarrow> G \<cong> I"
   using iso_set_trans unfolding is_iso_def by blast
 
 lemma iso_same_card: "G \<cong> H \<Longrightarrow> card (carrier G) = card (carrier H)"
   using bij_betw_same_card  unfolding is_iso_def iso_def by auto
 
 lemma iso_finite: "G \<cong> H \<Longrightarrow> finite(carrier G) \<longleftrightarrow> finite(carrier H)"
   by (auto simp: is_iso_def iso_def bij_betw_finite)
 
 lemma mon_compose:
    "\<lbrakk>f \<in> mon G H; g \<in> mon H K\<rbrakk> \<Longrightarrow> (g \<circ> f) \<in> mon G K"
   by (auto simp: mon_def intro: hom_compose comp_inj_on inj_on_subset [OF _ hom_carrier])
 
 lemma mon_compose_rev:
    "\<lbrakk>f \<in> hom G H; g \<in> hom H K; (g \<circ> f) \<in> mon G K\<rbrakk> \<Longrightarrow> f \<in> mon G H"
   using inj_on_imageI2 by (auto simp: mon_def)
 
 lemma epi_compose:
    "\<lbrakk>f \<in> epi G H; g \<in> epi H K\<rbrakk> \<Longrightarrow> (g \<circ> f) \<in> epi G K"
   using hom_compose by (force simp: epi_def hom_compose simp flip: image_image)
 
 lemma epi_compose_rev:
    "\<lbrakk>f \<in> hom G H; g \<in> hom H K; (g \<circ> f) \<in> epi G K\<rbrakk> \<Longrightarrow> g \<in> epi H K"
   by (fastforce simp: epi_def hom_def Pi_iff image_def set_eq_iff)
 
 lemma iso_compose_rev:
    "\<lbrakk>f \<in> hom G H; g \<in> hom H K; (g \<circ> f) \<in> iso G K\<rbrakk> \<Longrightarrow> f \<in> mon G H \<and> g \<in> epi H K"
   unfolding iso_iff_mon_epi using mon_compose_rev epi_compose_rev by blast
 
 lemma epi_iso_compose_rev:
   assumes "f \<in> epi G H" "g \<in> hom H K" "(g \<circ> f) \<in> iso G K"
   shows "f \<in> iso G H \<and> g \<in> iso H K"
 proof
   show "f \<in> iso G H"
     by (metis (no_types, lifting) assms epi_def iso_compose_rev iso_iff_mon_epi mem_Collect_eq)
   then have "f \<in> hom G H \<and> bij_betw f (carrier G) (carrier H)"
     using Group.iso_def \<open>f \<in> Group.iso G H\<close> by blast
   then have "bij_betw g (carrier H) (carrier K)"
     using Group.iso_def assms(3) bij_betw_comp_iff by blast
   then show "g \<in> iso H K"
     using Group.iso_def assms(2) by blast
 qed
 
 lemma mon_left_invertible:
    "\<lbrakk>f \<in> hom G H; \<And>x. x \<in> carrier G \<Longrightarrow> g(f x) = x\<rbrakk> \<Longrightarrow> f \<in> mon G H"
   by (simp add: mon_def inj_on_def) metis
 
 lemma epi_right_invertible:
    "\<lbrakk>g \<in> hom H G; f \<in> carrier G \<rightarrow> carrier H; \<And>x. x \<in> carrier G \<Longrightarrow> g(f x) = x\<rbrakk> \<Longrightarrow> g \<in> epi H G"
   by (force simp: Pi_iff epi_iff_subset image_subset_iff_funcset subset_iff)
 
 lemma (in monoid) hom_imp_img_monoid: \<^marker>\<open>contributor \<open>Paulo Emílio de Vilhena\<close>\<close>
   assumes "h \<in> hom G H"
   shows "monoid (H \<lparr> carrier := h ` (carrier G), one := h \<one>\<^bsub>G\<^esub> \<rparr>)" (is "monoid ?h_img")
 proof (rule monoidI)
   show "\<one>\<^bsub>?h_img\<^esub> \<in> carrier ?h_img"
     by auto
 next
   fix x y z assume "x \<in> carrier ?h_img" "y \<in> carrier ?h_img" "z \<in> carrier ?h_img"
   then obtain g1 g2 g3
     where g1: "g1 \<in> carrier G" "x = h g1"
       and g2: "g2 \<in> carrier G" "y = h g2"
       and g3: "g3 \<in> carrier G" "z = h g3"
     using image_iff[where ?f = h and ?A = "carrier G"] by auto
   have aux_lemma:
     "\<And>a b. \<lbrakk> a \<in> carrier G; b \<in> carrier G \<rbrakk> \<Longrightarrow> h a \<otimes>\<^bsub>(?h_img)\<^esub> h b = h (a \<otimes> b)"
     using assms unfolding hom_def by auto
 
   show "x \<otimes>\<^bsub>(?h_img)\<^esub> \<one>\<^bsub>(?h_img)\<^esub> = x"
     using aux_lemma[OF g1(1) one_closed] g1(2) r_one[OF g1(1)] by simp
 
   show "\<one>\<^bsub>(?h_img)\<^esub> \<otimes>\<^bsub>(?h_img)\<^esub> x = x"
     using aux_lemma[OF one_closed g1(1)] g1(2) l_one[OF g1(1)] by simp
 
   have "x \<otimes>\<^bsub>(?h_img)\<^esub> y = h (g1 \<otimes> g2)"
     using aux_lemma g1 g2 by auto
   thus "x \<otimes>\<^bsub>(?h_img)\<^esub> y \<in> carrier ?h_img"
     using g1(1) g2(1) by simp
 
   have "(x \<otimes>\<^bsub>(?h_img)\<^esub> y) \<otimes>\<^bsub>(?h_img)\<^esub> z = h ((g1 \<otimes> g2) \<otimes> g3)"
     using aux_lemma g1 g2 g3 by auto
   also have " ... = h (g1 \<otimes> (g2 \<otimes> g3))"
     using m_assoc[OF g1(1) g2(1) g3(1)] by simp
   also have " ... = x \<otimes>\<^bsub>(?h_img)\<^esub> (y \<otimes>\<^bsub>(?h_img)\<^esub> z)"
     using aux_lemma g1 g2 g3 by auto
   finally show "(x \<otimes>\<^bsub>(?h_img)\<^esub> y) \<otimes>\<^bsub>(?h_img)\<^esub> z = x \<otimes>\<^bsub>(?h_img)\<^esub> (y \<otimes>\<^bsub>(?h_img)\<^esub> z)" .
 qed
 
 lemma (in group) hom_imp_img_group: \<^marker>\<open>contributor \<open>Paulo Emílio de Vilhena\<close>\<close>
   assumes "h \<in> hom G H"
   shows "group (H \<lparr> carrier := h ` (carrier G), one := h \<one>\<^bsub>G\<^esub> \<rparr>)" (is "group ?h_img")
 proof -
   interpret monoid ?h_img
     using hom_imp_img_monoid[OF assms] .
 
   show ?thesis
   proof (unfold_locales)
     show "carrier ?h_img \<subseteq> Units ?h_img"
     proof (auto simp add: Units_def)
       have aux_lemma:
         "\<And>g1 g2. \<lbrakk> g1 \<in> carrier G; g2 \<in> carrier G \<rbrakk> \<Longrightarrow> h g1 \<otimes>\<^bsub>H\<^esub> h g2 = h (g1 \<otimes> g2)"
         using assms unfolding hom_def by auto
 
       fix g1 assume g1: "g1 \<in> carrier G"
       thus "\<exists>g2 \<in> carrier G. (h g2) \<otimes>\<^bsub>H\<^esub> (h g1) = h \<one> \<and> (h g1) \<otimes>\<^bsub>H\<^esub> (h g2) = h \<one>"
         using aux_lemma[OF g1 inv_closed[OF g1]]
               aux_lemma[OF inv_closed[OF g1] g1]
               inv_closed by auto
     qed
   qed
 qed
 
 lemma (in group) iso_imp_group: \<^marker>\<open>contributor \<open>Paulo Emílio de Vilhena\<close>\<close>
   assumes "G \<cong> H" and "monoid H"
   shows "group H"
 proof -
   obtain \<phi> where phi: "\<phi> \<in> iso G H" "inv_into (carrier G) \<phi> \<in> iso H G"
     using iso_set_sym assms unfolding is_iso_def by blast
   define \<psi> where psi_def: "\<psi> = inv_into (carrier G) \<phi>"
 
   have surj: "\<phi> ` (carrier G) = (carrier H)" "\<psi> ` (carrier H) = (carrier G)"
    and inj: "inj_on \<phi> (carrier G)" "inj_on \<psi> (carrier H)"
    and phi_hom: "\<And>g1 g2. \<lbrakk> g1 \<in> carrier G; g2 \<in> carrier G \<rbrakk> \<Longrightarrow> \<phi> (g1 \<otimes> g2) = (\<phi> g1) \<otimes>\<^bsub>H\<^esub> (\<phi> g2)"
    and psi_hom: "\<And>h1 h2. \<lbrakk> h1 \<in> carrier H; h2 \<in> carrier H \<rbrakk> \<Longrightarrow> \<psi> (h1 \<otimes>\<^bsub>H\<^esub> h2) = (\<psi> h1) \<otimes> (\<psi> h2)"
    using phi psi_def unfolding iso_def bij_betw_def hom_def by auto
 
   have phi_one: "\<phi> \<one> = \<one>\<^bsub>H\<^esub>"
   proof -
     have "(\<phi> \<one>) \<otimes>\<^bsub>H\<^esub> \<one>\<^bsub>H\<^esub> = (\<phi> \<one>) \<otimes>\<^bsub>H\<^esub> (\<phi> \<one>)"
       by (metis assms(2) image_eqI monoid.r_one one_closed phi_hom r_one surj(1))
     thus ?thesis
       by (metis (no_types, opaque_lifting) Units_eq Units_one_closed assms(2) f_inv_into_f imageI
           monoid.l_one monoid.one_closed phi_hom psi_def r_one surj)
   qed
 
   have "carrier H \<subseteq> Units H"
   proof
     fix h assume h: "h \<in> carrier H"
     let ?inv_h = "\<phi> (inv (\<psi> h))"
     have "h \<otimes>\<^bsub>H\<^esub> ?inv_h = \<phi> (\<psi> h) \<otimes>\<^bsub>H\<^esub> ?inv_h"
       by (simp add: f_inv_into_f h psi_def surj(1))
     also have " ... = \<phi> ((\<psi> h) \<otimes> inv (\<psi> h))"
       by (metis h imageI inv_closed phi_hom surj(2))
     also have " ... = \<phi> \<one>"
       by (simp add: h inv_into_into psi_def surj(1))
     finally have 1: "h \<otimes>\<^bsub>H\<^esub> ?inv_h = \<one>\<^bsub>H\<^esub>"
       using phi_one by simp
 
     have "?inv_h \<otimes>\<^bsub>H\<^esub> h = ?inv_h \<otimes>\<^bsub>H\<^esub> \<phi> (\<psi> h)"
       by (simp add: f_inv_into_f h psi_def surj(1))
     also have " ... = \<phi> (inv (\<psi> h) \<otimes> (\<psi> h))"
       by (metis h imageI inv_closed phi_hom surj(2))
     also have " ... = \<phi> \<one>"
       by (simp add: h inv_into_into psi_def surj(1))
     finally have 2: "?inv_h \<otimes>\<^bsub>H\<^esub> h = \<one>\<^bsub>H\<^esub>"
       using phi_one by simp
 
     thus "h \<in> Units H" unfolding Units_def using 1 2 h surj by fastforce
   qed
   thus ?thesis unfolding group_def group_axioms_def using assms(2) by simp
 qed
 
 corollary (in group) iso_imp_img_group: \<^marker>\<open>contributor \<open>Paulo Emílio de Vilhena\<close>\<close>
   assumes "h \<in> iso G H"
   shows "group (H \<lparr> one := h \<one> \<rparr>)"
 proof -
   let ?h_img = "H \<lparr> carrier := h ` (carrier G), one := h \<one> \<rparr>"
   have "h \<in> iso G ?h_img"
     using assms unfolding iso_def hom_def bij_betw_def by auto
   hence "G \<cong> ?h_img"
     unfolding is_iso_def by auto
   hence "group ?h_img"
     using iso_imp_group[of ?h_img] hom_imp_img_monoid[of h H] assms unfolding iso_def by simp
   moreover have "carrier H = carrier ?h_img"
     using assms unfolding iso_def bij_betw_def by simp
   hence "H \<lparr> one := h \<one> \<rparr> = ?h_img"
     by simp
   ultimately show ?thesis by simp
 qed
 
 subsubsection \<open>HOL Light's concept of an isomorphism pair\<close>
 
 definition group_isomorphisms
   where
  "group_isomorphisms G H f g \<equiv>
         f \<in> hom G H \<and> g \<in> hom H G \<and>
         (\<forall>x \<in> carrier G. g(f x) = x) \<and>
         (\<forall>y \<in> carrier H. f(g y) = y)"
 
 lemma group_isomorphisms_sym: "group_isomorphisms G H f g \<Longrightarrow> group_isomorphisms H G g f"
   by (auto simp: group_isomorphisms_def)
 
 lemma group_isomorphisms_imp_iso: "group_isomorphisms G H f g \<Longrightarrow> f \<in> iso G H"
 by (auto simp: iso_def inj_on_def image_def group_isomorphisms_def hom_def bij_betw_def Pi_iff, metis+)
 
 lemma (in group) iso_iff_group_isomorphisms:
   "f \<in> iso G H \<longleftrightarrow> (\<exists>g. group_isomorphisms G H f g)"
 proof safe
   show "\<exists>g. group_isomorphisms G H f g" if "f \<in> Group.iso G H"
     unfolding group_isomorphisms_def
   proof (intro exI conjI)
     let ?g = "inv_into (carrier G) f"
     show "\<forall>x\<in>carrier G. ?g (f x) = x"
       by (metis (no_types, lifting) Group.iso_def bij_betw_inv_into_left mem_Collect_eq that)
     show "\<forall>y\<in>carrier H. f (?g y) = y"
       by (metis (no_types, lifting) Group.iso_def bij_betw_inv_into_right mem_Collect_eq that)
   qed (use Group.iso_def iso_set_sym that in \<open>blast+\<close>)
 next
   fix g
   assume "group_isomorphisms G H f g"
   then show "f \<in> Group.iso G H"
     by (auto simp: iso_def group_isomorphisms_def hom_in_carrier intro: bij_betw_byWitness)
 qed
 
 
 subsubsection \<open>Involving direct products\<close>
 
 lemma DirProd_commute_iso_set:
   shows "(\<lambda>(x,y). (y,x)) \<in> iso (G \<times>\<times> H) (H \<times>\<times> G)"
   by (auto simp add: iso_def hom_def inj_on_def bij_betw_def)
 
 corollary DirProd_commute_iso :
 "(G \<times>\<times> H) \<cong> (H \<times>\<times> G)"
   using DirProd_commute_iso_set unfolding is_iso_def by blast
 
 lemma DirProd_assoc_iso_set:
   shows "(\<lambda>(x,y,z). (x,(y,z))) \<in> iso (G \<times>\<times> H \<times>\<times> I) (G \<times>\<times> (H \<times>\<times> I))"
 by (auto simp add: iso_def hom_def inj_on_def bij_betw_def)
 
 lemma (in group) DirProd_iso_set_trans:
   assumes "g \<in> iso G G2"
     and "h \<in> iso H I"
   shows "(\<lambda>(x,y). (g x, h y)) \<in> iso (G \<times>\<times> H) (G2 \<times>\<times> I)"
 proof-
   have "(\<lambda>(x,y). (g x, h y)) \<in> hom (G \<times>\<times> H) (G2 \<times>\<times> I)"
     using assms unfolding iso_def hom_def by auto
   moreover have " inj_on (\<lambda>(x,y). (g x, h y)) (carrier (G \<times>\<times> H))"
     using assms unfolding iso_def DirProd_def bij_betw_def inj_on_def by auto
   moreover have "(\<lambda>(x, y). (g x, h y)) ` carrier (G \<times>\<times> H) = carrier (G2 \<times>\<times> I)"
     using assms unfolding iso_def bij_betw_def image_def DirProd_def by fastforce
   ultimately show "(\<lambda>(x,y). (g x, h y)) \<in> iso (G \<times>\<times> H) (G2 \<times>\<times> I)"
     unfolding iso_def bij_betw_def by auto
 qed
 
 corollary (in group) DirProd_iso_trans :
   assumes "G \<cong> G2" and "H \<cong> I"
   shows "G \<times>\<times> H \<cong> G2 \<times>\<times> I"
   using DirProd_iso_set_trans assms unfolding is_iso_def by blast
 
 lemma hom_pairwise: "f \<in> hom G (DirProd H K) \<longleftrightarrow> (fst \<circ> f) \<in> hom G H \<and> (snd \<circ> f) \<in> hom G K"
   apply (auto simp: hom_def mult_DirProd' dest: Pi_mem)
    apply (metis Product_Type.mem_Times_iff comp_eq_dest_lhs funcset_mem)
   by (metis mult_DirProd prod.collapse)
 
 lemma hom_paired:
    "(\<lambda>x. (f x,g x)) \<in> hom G (DirProd H K) \<longleftrightarrow> f \<in> hom G H \<and> g \<in> hom G K"
   by (simp add: hom_pairwise o_def)
 
 lemma hom_paired2:
   assumes "group G" "group H"
   shows "(\<lambda>(x,y). (f x,g y)) \<in> hom (DirProd G H) (DirProd G' H') \<longleftrightarrow> f \<in> hom G G' \<and> g \<in> hom H H'"
   using assms
   by (fastforce simp: hom_def Pi_def dest!: group.is_monoid)
 
 lemma iso_paired2:
   assumes "group G" "group H"
   shows "(\<lambda>(x,y). (f x,g y)) \<in> iso (DirProd G H) (DirProd G' H') \<longleftrightarrow> f \<in> iso G G' \<and> g \<in> iso H H'"
   using assms
   by (fastforce simp add: iso_def inj_on_def bij_betw_def hom_paired2 image_paired_Times
       times_eq_iff group_def monoid.carrier_not_empty)
 
 lemma hom_of_fst:
   assumes "group H"
   shows "(f \<circ> fst) \<in> hom (DirProd G H) K \<longleftrightarrow> f \<in> hom G K"
 proof -
   interpret group H
     by (rule assms)
   show ?thesis
     using one_closed by (auto simp: hom_def Pi_def)
 qed
 
 lemma hom_of_snd:
   assumes "group G"
   shows "(f \<circ> snd) \<in> hom (DirProd G H) K \<longleftrightarrow> f \<in> hom H K"
 proof -
   interpret group G
     by (rule assms)
   show ?thesis
     using one_closed by (auto simp: hom_def Pi_def)
 qed
 
 
 subsection\<open>The locale for a homomorphism between two groups\<close>
 
 text\<open>Basis for homomorphism proofs: we assume two groups \<^term>\<open>G\<close> and
   \<^term>\<open>H\<close>, with a homomorphism \<^term>\<open>h\<close> between them\<close>
 locale group_hom = G?: group G + H?: group H for G (structure) and H (structure) +
   fixes h
   assumes homh [simp]: "h \<in> hom G H"
 
 declare group_hom.homh [simp]
 
 lemma (in group_hom) hom_mult [simp]:
   "[| x \<in> carrier G; y \<in> carrier G |] ==> h (x \<otimes>\<^bsub>G\<^esub> y) = h x \<otimes>\<^bsub>H\<^esub> h y"
 proof -
   assume "x \<in> carrier G" "y \<in> carrier G"
   with homh [unfolded hom_def] show ?thesis by simp
 qed
 
 lemma (in group_hom) hom_closed [simp]:
   "x \<in> carrier G ==> h x \<in> carrier H"
 proof -
   assume "x \<in> carrier G"
   with homh [unfolded hom_def] show ?thesis by auto
 qed
 
 lemma (in group_hom) one_closed: "h \<one> \<in> carrier H"
   by simp
 
 lemma (in group_hom) hom_one [simp]: "h \<one> = \<one>\<^bsub>H\<^esub>"
 proof -
   have "h \<one> \<otimes>\<^bsub>H\<^esub> \<one>\<^bsub>H\<^esub> = h \<one> \<otimes>\<^bsub>H\<^esub> h \<one>"
     by (simp add: hom_mult [symmetric] del: hom_mult)
   then show ?thesis
     by (metis H.Units_eq H.Units_l_cancel H.one_closed local.one_closed)
 qed
 
 lemma hom_one:
   assumes "h \<in> hom G H" "group G" "group H"
   shows "h (one G) = one H"
   apply (rule group_hom.hom_one)
   by (simp add: assms group_hom_axioms_def group_hom_def)
 
 lemma hom_mult:
   "\<lbrakk>h \<in> hom G H; x \<in> carrier G; y \<in> carrier G\<rbrakk> \<Longrightarrow> h (x \<otimes>\<^bsub>G\<^esub> y) = h x \<otimes>\<^bsub>H\<^esub> h y"
   by (auto simp: hom_def)
 
 lemma (in group_hom) inv_closed [simp]:
   "x \<in> carrier G ==> h (inv x) \<in> carrier H"
   by simp
 
 lemma (in group_hom) hom_inv [simp]:
   assumes "x \<in> carrier G" shows "h (inv x) = inv\<^bsub>H\<^esub> (h x)"
 proof -
   have "h x \<otimes>\<^bsub>H\<^esub> h (inv x) = h x \<otimes>\<^bsub>H\<^esub> inv\<^bsub>H\<^esub> (h x)" 
     using assms by (simp flip: hom_mult)
   with assms show ?thesis by (simp del: H.r_inv H.Units_r_inv)
 qed
 
 lemma (in group) int_pow_is_hom: \<^marker>\<open>contributor \<open>Joachim Breitner\<close>\<close>
   "x \<in> carrier G \<Longrightarrow> (([^]) x) \<in> hom \<lparr> carrier = UNIV, mult = (+), one = 0::int \<rparr> G "
   unfolding hom_def by (simp add: int_pow_mult)
 
 lemma (in group_hom) img_is_subgroup: "subgroup (h ` (carrier G)) H" \<^marker>\<open>contributor \<open>Paulo Emílio de Vilhena\<close>\<close>
   apply (rule subgroupI)
   apply (auto simp add: image_subsetI)
   apply (metis G.inv_closed hom_inv image_iff)
   by (metis G.monoid_axioms hom_mult image_eqI monoid.m_closed)
 
 lemma (in group_hom) subgroup_img_is_subgroup: \<^marker>\<open>contributor \<open>Paulo Emílio de Vilhena\<close>\<close>
   assumes "subgroup I G"
   shows "subgroup (h ` I) H"
 proof -
   have "h \<in> hom (G \<lparr> carrier := I \<rparr>) H"
     using G.subgroupE[OF assms] subgroup.mem_carrier[OF assms] homh
     unfolding hom_def by auto
   hence "group_hom (G \<lparr> carrier := I \<rparr>) H h"
     using subgroup.subgroup_is_group[OF assms G.is_group] is_group
     unfolding group_hom_def group_hom_axioms_def by simp
   thus ?thesis
     using group_hom.img_is_subgroup[of "G \<lparr> carrier := I \<rparr>" H h] by simp
 qed
 
 lemma (in group_hom) induced_group_hom: \<^marker>\<open>contributor \<open>Paulo Emílio de Vilhena\<close>\<close>
   assumes "subgroup I G"
   shows "group_hom (G \<lparr> carrier := I \<rparr>) (H \<lparr> carrier := h ` I \<rparr>) h"
 proof -
   have "h \<in> hom (G \<lparr> carrier := I \<rparr>) (H \<lparr> carrier := h ` I \<rparr>)"
     using homh subgroup.mem_carrier[OF assms] unfolding hom_def by auto
   thus ?thesis
     unfolding group_hom_def group_hom_axioms_def
     using subgroup.subgroup_is_group[OF assms G.is_group]
           subgroup.subgroup_is_group[OF subgroup_img_is_subgroup[OF assms] is_group] by simp
 qed
 
 lemma (in group) canonical_inj_is_hom: \<^marker>\<open>contributor \<open>Paulo Emílio de Vilhena\<close>\<close>
   assumes "subgroup H G"
   shows "group_hom (G \<lparr> carrier := H \<rparr>) G id"
   unfolding group_hom_def group_hom_axioms_def hom_def
   using subgroup.subgroup_is_group[OF assms is_group]
         is_group subgroup.subset[OF assms] by auto
 
 lemma (in group_hom) hom_nat_pow: \<^marker>\<open>contributor \<open>Paulo Emílio de Vilhena\<close>\<close>
   "x \<in> carrier G \<Longrightarrow> h (x [^] (n :: nat)) = (h x) [^]\<^bsub>H\<^esub> n"
   by (induction n) auto
 
 lemma (in group_hom) hom_int_pow: \<^marker>\<open>contributor \<open>Paulo Emílio de Vilhena\<close>\<close>
   "x \<in> carrier G \<Longrightarrow> h (x [^] (n :: int)) = (h x) [^]\<^bsub>H\<^esub> n"
   using hom_nat_pow by (simp add: int_pow_def2)
 
 lemma hom_nat_pow:
   "\<lbrakk>h \<in> hom G H; x \<in> carrier G; group G; group H\<rbrakk> \<Longrightarrow> h (x [^]\<^bsub>G\<^esub> (n :: nat)) = (h x) [^]\<^bsub>H\<^esub> n"
   by (simp add: group_hom.hom_nat_pow group_hom_axioms_def group_hom_def)
 
 lemma hom_int_pow:
   "\<lbrakk>h \<in> hom G H; x \<in> carrier G; group G; group H\<rbrakk> \<Longrightarrow> h (x [^]\<^bsub>G\<^esub> (n :: int)) = (h x) [^]\<^bsub>H\<^esub> n"
   by (simp add: group_hom.hom_int_pow group_hom_axioms.intro group_hom_def)
 
 subsection \<open>Commutative Structures\<close>
 
 text \<open>
   Naming convention: multiplicative structures that are commutative
   are called \emph{commutative}, additive structures are called
   \emph{Abelian}.
 \<close>
 
 locale comm_monoid = monoid +
   assumes m_comm: "\<lbrakk>x \<in> carrier G; y \<in> carrier G\<rbrakk> \<Longrightarrow> x \<otimes> y = y \<otimes> x"
 
 lemma (in comm_monoid) m_lcomm:
   "\<lbrakk>x \<in> carrier G; y \<in> carrier G; z \<in> carrier G\<rbrakk> \<Longrightarrow>
    x \<otimes> (y \<otimes> z) = y \<otimes> (x \<otimes> z)"
 proof -
   assume xyz: "x \<in> carrier G"  "y \<in> carrier G"  "z \<in> carrier G"
   from xyz have "x \<otimes> (y \<otimes> z) = (x \<otimes> y) \<otimes> z" by (simp add: m_assoc)
   also from xyz have "... = (y \<otimes> x) \<otimes> z" by (simp add: m_comm)
   also from xyz have "... = y \<otimes> (x \<otimes> z)" by (simp add: m_assoc)
   finally show ?thesis .
 qed
 
 lemmas (in comm_monoid) m_ac = m_assoc m_comm m_lcomm
 
 lemma comm_monoidI:
   fixes G (structure)
   assumes m_closed:
       "!!x y. [| x \<in> carrier G; y \<in> carrier G |] ==> x \<otimes> y \<in> carrier G"
     and one_closed: "\<one> \<in> carrier G"
     and m_assoc:
       "!!x y z. [| x \<in> carrier G; y \<in> carrier G; z \<in> carrier G |] ==>
       (x \<otimes> y) \<otimes> z = x \<otimes> (y \<otimes> z)"
     and l_one: "!!x. x \<in> carrier G ==> \<one> \<otimes> x = x"
     and m_comm:
       "!!x y. [| x \<in> carrier G; y \<in> carrier G |] ==> x \<otimes> y = y \<otimes> x"
   shows "comm_monoid G"
   using l_one
     by (auto intro!: comm_monoid.intro comm_monoid_axioms.intro monoid.intro
              intro: assms simp: m_closed one_closed m_comm)
 
 lemma (in monoid) monoid_comm_monoidI:
   assumes m_comm:
       "!!x y. [| x \<in> carrier G; y \<in> carrier G |] ==> x \<otimes> y = y \<otimes> x"
   shows "comm_monoid G"
   by (rule comm_monoidI) (auto intro: m_assoc m_comm)
 
 lemma (in comm_monoid) submonoid_is_comm_monoid :
   assumes "submonoid H G"
   shows "comm_monoid (G\<lparr>carrier := H\<rparr>)"
 proof (intro monoid.monoid_comm_monoidI)
   show "monoid (G\<lparr>carrier := H\<rparr>)"
     using submonoid.submonoid_is_monoid assms comm_monoid_axioms comm_monoid_def by blast
   show "\<And>x y. x \<in> carrier (G\<lparr>carrier := H\<rparr>) \<Longrightarrow> y \<in> carrier (G\<lparr>carrier := H\<rparr>)
         \<Longrightarrow> x \<otimes>\<^bsub>G\<lparr>carrier := H\<rparr>\<^esub> y = y \<otimes>\<^bsub>G\<lparr>carrier := H\<rparr>\<^esub> x" 
     by simp (meson assms m_comm submonoid.mem_carrier)
 qed
 
 locale comm_group = comm_monoid + group
 
 lemma (in group) group_comm_groupI:
   assumes m_comm: "!!x y. [| x \<in> carrier G; y \<in> carrier G |] ==> x \<otimes> y = y \<otimes> x"
   shows "comm_group G"
   by standard (simp_all add: m_comm)
 
 lemma comm_groupI:
   fixes G (structure)
   assumes m_closed:
       "!!x y. [| x \<in> carrier G; y \<in> carrier G |] ==> x \<otimes> y \<in> carrier G"
     and one_closed: "\<one> \<in> carrier G"
     and m_assoc:
       "!!x y z. [| x \<in> carrier G; y \<in> carrier G; z \<in> carrier G |] ==>
       (x \<otimes> y) \<otimes> z = x \<otimes> (y \<otimes> z)"
     and m_comm:
       "!!x y. [| x \<in> carrier G; y \<in> carrier G |] ==> x \<otimes> y = y \<otimes> x"
     and l_one: "!!x. x \<in> carrier G ==> \<one> \<otimes> x = x"
     and l_inv_ex: "!!x. x \<in> carrier G ==> \<exists>y \<in> carrier G. y \<otimes> x = \<one>"
   shows "comm_group G"
   by (fast intro: group.group_comm_groupI groupI assms)
 
 lemma comm_groupE:
   fixes G (structure)
   assumes "comm_group G"
   shows "\<And>x y. \<lbrakk> x \<in> carrier G; y \<in> carrier G \<rbrakk> \<Longrightarrow> x \<otimes> y \<in> carrier G"
     and "\<one> \<in> carrier G"
     and "\<And>x y z. \<lbrakk> x \<in> carrier G; y \<in> carrier G; z \<in> carrier G \<rbrakk> \<Longrightarrow> (x \<otimes> y) \<otimes> z = x \<otimes> (y \<otimes> z)"
     and "\<And>x y. \<lbrakk> x \<in> carrier G; y \<in> carrier G \<rbrakk> \<Longrightarrow> x \<otimes> y = y \<otimes> x"
     and "\<And>x. x \<in> carrier G \<Longrightarrow> \<one> \<otimes> x = x"
     and "\<And>x. x \<in> carrier G \<Longrightarrow> \<exists>y \<in> carrier G. y \<otimes> x = \<one>"
   apply (simp_all add: group.axioms assms comm_group.axioms comm_monoid.m_comm comm_monoid.m_ac(1))
   by (simp_all add: Group.group.axioms(1) assms comm_group.axioms(2) monoid.m_closed group.r_inv_ex)
 
 lemma (in comm_group) inv_mult:
   "[| x \<in> carrier G; y \<in> carrier G |] ==> inv (x \<otimes> y) = inv x \<otimes> inv y"
   by (simp add: m_ac inv_mult_group)
 
 lemma (in comm_monoid) nat_pow_distrib:
   fixes n::nat
   assumes "x \<in> carrier G" "y \<in> carrier G"
   shows "(x \<otimes> y) [^] n = x [^] n \<otimes> y [^] n"
   by (simp add: assms pow_mult_distrib m_comm)
 
 lemma (in comm_group) int_pow_distrib:
   assumes "x \<in> carrier G" "y \<in> carrier G"
   shows "(x \<otimes> y) [^] (i::int) = x [^] i \<otimes> y [^] i"
   by (simp add: assms int_pow_mult_distrib m_comm)
 
 lemma (in comm_monoid) hom_imp_img_comm_monoid: \<^marker>\<open>contributor \<open>Paulo Emílio de Vilhena\<close>\<close>
   assumes "h \<in> hom G H"
   shows "comm_monoid (H \<lparr> carrier := h ` (carrier G), one := h \<one>\<^bsub>G\<^esub> \<rparr>)" (is "comm_monoid ?h_img")
 proof (rule monoid.monoid_comm_monoidI)
   show "monoid ?h_img"
     using hom_imp_img_monoid[OF assms] .
 next
   fix x y assume "x \<in> carrier ?h_img" "y \<in> carrier ?h_img"
   then obtain g1 g2
     where g1: "g1 \<in> carrier G" "x = h g1"
       and g2: "g2 \<in> carrier G" "y = h g2"
     by auto
   have "x \<otimes>\<^bsub>(?h_img)\<^esub> y = h (g1 \<otimes> g2)"
     using g1 g2 assms unfolding hom_def by auto
   also have " ... = h (g2 \<otimes> g1)"
     using m_comm[OF g1(1) g2(1)] by simp
   also have " ... = y \<otimes>\<^bsub>(?h_img)\<^esub> x"
     using g1 g2 assms unfolding hom_def by auto
   finally show "x \<otimes>\<^bsub>(?h_img)\<^esub> y = y \<otimes>\<^bsub>(?h_img)\<^esub> x" .
 qed
 
 lemma (in comm_group) hom_group_mult:
   assumes "f \<in> hom H G" "g \<in> hom H G"
  shows "(\<lambda>x. f x \<otimes>\<^bsub>G\<^esub> g x) \<in> hom H G"
     using assms by (auto simp: hom_def Pi_def m_ac)
 
 lemma (in comm_group) hom_imp_img_comm_group: \<^marker>\<open>contributor \<open>Paulo Emílio de Vilhena\<close>\<close>
   assumes "h \<in> hom G H"
   shows "comm_group (H \<lparr> carrier := h ` (carrier G), one := h \<one>\<^bsub>G\<^esub> \<rparr>)"
   unfolding comm_group_def
   using hom_imp_img_group[OF assms] hom_imp_img_comm_monoid[OF assms] by simp
 
 lemma (in comm_group) iso_imp_img_comm_group: \<^marker>\<open>contributor \<open>Paulo Emílio de Vilhena\<close>\<close>
   assumes "h \<in> iso G H"
   shows "comm_group (H \<lparr> one := h \<one>\<^bsub>G\<^esub> \<rparr>)"
 proof -
   let ?h_img = "H \<lparr> carrier := h ` (carrier G), one := h \<one> \<rparr>"
   have "comm_group ?h_img"
     using hom_imp_img_comm_group[of h H] assms unfolding iso_def by auto
   moreover have "carrier H = carrier ?h_img"
     using assms unfolding iso_def bij_betw_def by simp
   hence "H \<lparr> one := h \<one> \<rparr> = ?h_img"
     by simp
   ultimately show ?thesis by simp
 qed
 
 lemma (in comm_group) iso_imp_comm_group: \<^marker>\<open>contributor \<open>Paulo Emílio de Vilhena\<close>\<close>
   assumes "G \<cong> H" "monoid H"
   shows "comm_group H"
 proof -
   obtain h where h: "h \<in> iso G H"
     using assms(1) unfolding is_iso_def by auto
   hence comm_gr: "comm_group (H \<lparr> one := h \<one> \<rparr>)"
     using iso_imp_img_comm_group[of h H] by simp
   hence "\<And>x. x \<in> carrier H \<Longrightarrow> h \<one> \<otimes>\<^bsub>H\<^esub> x = x"
     using monoid.l_one[of "H \<lparr> one := h \<one> \<rparr>"] unfolding comm_group_def comm_monoid_def by simp
   moreover have "h \<one> \<in> carrier H"
     using h one_closed unfolding iso_def hom_def by auto
   ultimately have "h \<one> = \<one>\<^bsub>H\<^esub>"
     using monoid.one_unique[OF assms(2), of "h \<one>"] by simp
   hence "H = H \<lparr> one := h \<one> \<rparr>"
     by simp
   thus ?thesis
     using comm_gr by simp
 qed
 
 (*A subgroup of a subgroup is a subgroup of the group*)
 lemma (in group) incl_subgroup:
   assumes "subgroup J G"
     and "subgroup I (G\<lparr>carrier:=J\<rparr>)"
   shows "subgroup I G" unfolding subgroup_def
 proof
   have H1: "I \<subseteq> carrier (G\<lparr>carrier:=J\<rparr>)" using assms(2) subgroup.subset by blast
   also have H2: "...\<subseteq>J" by simp
   also  have "...\<subseteq>(carrier G)"  by (simp add: assms(1) subgroup.subset)
   finally have H: "I \<subseteq> carrier G" by simp
   have "(\<And>x y. \<lbrakk>x \<in> I ; y \<in> I\<rbrakk> \<Longrightarrow> x \<otimes> y \<in> I)" using assms(2) by (auto simp add: subgroup_def)
   thus  "I \<subseteq> carrier G \<and> (\<forall>x y. x \<in> I \<longrightarrow> y \<in> I \<longrightarrow> x \<otimes> y \<in> I)"  using H by blast
   have K: "\<one> \<in> I" using assms(2) by (auto simp add: subgroup_def)
   have "(\<And>x. x \<in> I \<Longrightarrow> inv x \<in> I)" using assms  subgroup.m_inv_closed H
     by (metis H1 H2 m_inv_consistent subsetCE)
   thus "\<one> \<in> I \<and> (\<forall>x. x \<in> I \<longrightarrow> inv x \<in> I)" using K by blast
 qed
 
 (*A subgroup included in another subgroup is a subgroup of the subgroup*)
 lemma (in group) subgroup_incl:
   assumes "subgroup I G" and "subgroup J G" and "I \<subseteq> J"
   shows "subgroup I (G \<lparr> carrier := J \<rparr>)"
   using group.group_incl_imp_subgroup[of "G \<lparr> carrier := J \<rparr>" I]
         assms(1-2)[THEN subgroup.subgroup_is_group[OF _ group_axioms]] assms(3) by auto
 
 
 subsection \<open>The Lattice of Subgroups of a Group\<close>
 
 text_raw \<open>\label{sec:subgroup-lattice}\<close>
 
 theorem (in group) subgroups_partial_order:
   "partial_order \<lparr>carrier = {H. subgroup H G}, eq = (=), le = (\<subseteq>)\<rparr>"
   by standard simp_all
 
 lemma (in group) subgroup_self:
   "subgroup (carrier G) G"
   by (rule subgroupI) auto
 
 lemma (in group) subgroup_imp_group:
   "subgroup H G ==> group (G\<lparr>carrier := H\<rparr>)"
   by (erule subgroup.subgroup_is_group) (rule group_axioms)
 
 lemma (in group) subgroup_mult_equality:
   "\<lbrakk> subgroup H G; h1 \<in> H; h2 \<in> H \<rbrakk> \<Longrightarrow>  h1 \<otimes>\<^bsub>G \<lparr> carrier := H \<rparr>\<^esub> h2 = h1 \<otimes> h2"
   unfolding subgroup_def by simp
 
 theorem (in group) subgroups_Inter:
   assumes subgr: "(\<And>H. H \<in> A \<Longrightarrow> subgroup H G)"
     and not_empty: "A \<noteq> {}"
   shows "subgroup (\<Inter>A) G"
 proof (rule subgroupI)
   from subgr [THEN subgroup.subset] and not_empty
   show "\<Inter>A \<subseteq> carrier G" by blast
 next
   from subgr [THEN subgroup.one_closed]
   show "\<Inter>A \<noteq> {}" by blast
 next
   fix x assume "x \<in> \<Inter>A"
   with subgr [THEN subgroup.m_inv_closed]
   show "inv x \<in> \<Inter>A" by blast
 next
   fix x y assume "x \<in> \<Inter>A" "y \<in> \<Inter>A"
   with subgr [THEN subgroup.m_closed]
   show "x \<otimes> y \<in> \<Inter>A" by blast
 qed
 
 lemma (in group) subgroups_Inter_pair :
   assumes  "subgroup I G"
     and  "subgroup J G"
   shows "subgroup (I\<inter>J) G" using subgroups_Inter[ where ?A = "{I,J}"] assms by auto
 
 theorem (in group) subgroups_complete_lattice:
   "complete_lattice \<lparr>carrier = {H. subgroup H G}, eq = (=), le = (\<subseteq>)\<rparr>"
     (is "complete_lattice ?L")
 proof (rule partial_order.complete_lattice_criterion1)
   show "partial_order ?L" by (rule subgroups_partial_order)
 next
   have "greatest ?L (carrier G) (carrier ?L)"
     by (unfold greatest_def) (simp add: subgroup.subset subgroup_self)
   then show "\<exists>G. greatest ?L G (carrier ?L)" ..
 next
   fix A
   assume L: "A \<subseteq> carrier ?L" and non_empty: "A \<noteq> {}"
   then have Int_subgroup: "subgroup (\<Inter>A) G"
     by (fastforce intro: subgroups_Inter)
   have "greatest ?L (\<Inter>A) (Lower ?L A)" (is "greatest _ ?Int _")
   proof (rule greatest_LowerI)
     fix H
     assume H: "H \<in> A"
     with L have subgroupH: "subgroup H G" by auto
     from subgroupH have groupH: "group (G \<lparr>carrier := H\<rparr>)" (is "group ?H")
       by (rule subgroup_imp_group)
     from groupH have monoidH: "monoid ?H"
       by (rule group.is_monoid)
     from H have Int_subset: "?Int \<subseteq> H" by fastforce
     then show "le ?L ?Int H" by simp
   next
     fix H
     assume H: "H \<in> Lower ?L A"
     with L Int_subgroup show "le ?L H ?Int"
       by (fastforce simp: Lower_def intro: Inter_greatest)
   next
     show "A \<subseteq> carrier ?L" by (rule L)
   next
     show "?Int \<in> carrier ?L" by simp (rule Int_subgroup)
   qed
   then show "\<exists>I. greatest ?L I (Lower ?L A)" ..
 qed
 
 subsection\<open>The units in any monoid give rise to a group\<close>
 
 text \<open>Thanks to Jeremy Avigad. The file Residues.thy provides some infrastructure to use
   facts about the unit group within the ring locale.
 \<close>
 
 definition units_of :: "('a, 'b) monoid_scheme \<Rightarrow> 'a monoid"
   where "units_of G =
     \<lparr>carrier = Units G, Group.monoid.mult = Group.monoid.mult G, one  = one G\<rparr>"
 
 lemma (in monoid) units_group: "group (units_of G)"
 proof -
   have "\<And>x y z. \<lbrakk>x \<in> Units G; y \<in> Units G; z \<in> Units G\<rbrakk> \<Longrightarrow> x \<otimes> y \<otimes> z = x \<otimes> (y \<otimes> z)"
     by (simp add: Units_closed m_assoc)
   moreover have "\<And>x. x \<in> Units G \<Longrightarrow> \<exists>y\<in>Units G. y \<otimes> x = \<one>"
     using Units_l_inv by blast
   ultimately show ?thesis
     unfolding units_of_def
     by (force intro!: groupI)
 qed
 
 lemma (in comm_monoid) units_comm_group: "comm_group (units_of G)"
 proof -
   have "\<And>x y. \<lbrakk>x \<in> carrier (units_of G); y \<in> carrier (units_of G)\<rbrakk>
               \<Longrightarrow> x \<otimes>\<^bsub>units_of G\<^esub> y = y \<otimes>\<^bsub>units_of G\<^esub> x"
     by (simp add: Units_closed m_comm units_of_def)
   then show ?thesis
     by (rule group.group_comm_groupI [OF units_group]) auto
 qed
 
 lemma units_of_carrier: "carrier (units_of G) = Units G"
   by (auto simp: units_of_def)
 
 lemma units_of_mult: "mult (units_of G) = mult G"
   by (auto simp: units_of_def)
 
 lemma units_of_one: "one (units_of G) = one G"
   by (auto simp: units_of_def)
 
 lemma (in monoid) units_of_inv:
   assumes "x \<in> Units G"
   shows "m_inv (units_of G) x = m_inv G x"
   by (simp add: assms group.inv_equality units_group units_of_carrier units_of_mult units_of_one)
 
 lemma units_of_units [simp] : "Units (units_of G) = Units G"
   unfolding units_of_def Units_def by force
 
 lemma (in group) surj_const_mult: "a \<in> carrier G \<Longrightarrow> (\<lambda>x. a \<otimes> x) ` carrier G = carrier G"
   apply (auto simp add: image_def)
   by (metis inv_closed inv_solve_left m_closed)
 
 lemma (in group) l_cancel_one [simp]: "x \<in> carrier G \<Longrightarrow> a \<in> carrier G \<Longrightarrow> x \<otimes> a = x \<longleftrightarrow> a = one G"
   by (metis Units_eq Units_l_cancel monoid.r_one monoid_axioms one_closed)
 
 lemma (in group) r_cancel_one [simp]: "x \<in> carrier G \<Longrightarrow> a \<in> carrier G \<Longrightarrow> a \<otimes> x = x \<longleftrightarrow> a = one G"
   by (metis monoid.l_one monoid_axioms one_closed right_cancel)
 
 lemma (in group) l_cancel_one' [simp]: "x \<in> carrier G \<Longrightarrow> a \<in> carrier G \<Longrightarrow> x = x \<otimes> a \<longleftrightarrow> a = one G"
   using l_cancel_one by fastforce
 
 lemma (in group) r_cancel_one' [simp]: "x \<in> carrier G \<Longrightarrow> a \<in> carrier G \<Longrightarrow> x = a \<otimes> x \<longleftrightarrow> a = one G"
   using r_cancel_one by fastforce
 
 declare pow_nat [simp] (*causes looping if added above, especially with int_pow_def2*)
 
 end
diff --git a/src/HOL/Algebra/Multiplicative_Group.thy b/src/HOL/Algebra/Multiplicative_Group.thy
--- a/src/HOL/Algebra/Multiplicative_Group.thy
+++ b/src/HOL/Algebra/Multiplicative_Group.thy
@@ -1,1061 +1,1061 @@
 (*  Title:      HOL/Algebra/Multiplicative_Group.thy
     Author:     Simon Wimmer
     Author:     Lars Noschinski
 *)
 
 theory Multiplicative_Group
 imports
   Complex_Main
   Group
   Coset
   UnivPoly
   Generated_Groups
   Elementary_Groups
 begin
 
 section \<open>Simplification Rules for Polynomials\<close>
 text_raw \<open>\label{sec:simp-rules}\<close>
 
 lemma (in ring_hom_cring) hom_sub[simp]:
   assumes "x \<in> carrier R" "y \<in> carrier R"
   shows "h (x \<ominus> y) = h x \<ominus>\<^bsub>S\<^esub> h y"
   using assms by (simp add: R.minus_eq S.minus_eq)
 
 context UP_ring begin
 
 lemma deg_nzero_nzero:
   assumes deg_p_nzero: "deg R p \<noteq> 0"
   shows "p \<noteq> \<zero>\<^bsub>P\<^esub>"
   using deg_zero deg_p_nzero by auto
 
 lemma deg_add_eq:
   assumes c: "p \<in> carrier P" "q \<in> carrier P"
   assumes "deg R q \<noteq> deg R p"
   shows "deg R (p \<oplus>\<^bsub>P\<^esub> q) = max (deg R p) (deg R q)"
 proof -
   let ?m = "max (deg R p) (deg R q)"
   from assms have "coeff P p ?m = \<zero> \<longleftrightarrow> coeff P q ?m \<noteq> \<zero>"
     by (metis deg_belowI lcoeff_nonzero[OF deg_nzero_nzero] linear max.absorb_iff2 max.absorb1)
   then have "coeff P (p \<oplus>\<^bsub>P\<^esub> q) ?m \<noteq> \<zero>"
     using assms by auto
   then have "deg R (p \<oplus>\<^bsub>P\<^esub> q) \<ge> ?m"
     using assms by (blast intro: deg_belowI)
   with deg_add[OF c] show ?thesis by arith
 qed
 
 lemma deg_minus_eq:
   assumes "p \<in> carrier P" "q \<in> carrier P" "deg R q \<noteq> deg R p"
   shows "deg R (p \<ominus>\<^bsub>P\<^esub> q) = max (deg R p) (deg R q)"
   using assms by (simp add: deg_add_eq a_minus_def)
 
 end
 
 context UP_cring begin
 
 lemma evalRR_add:
   assumes "p \<in> carrier P" "q \<in> carrier P"
   assumes x: "x \<in> carrier R"
   shows "eval R R id x (p \<oplus>\<^bsub>P\<^esub> q) = eval R R id x p \<oplus> eval R R id x q"
 proof -
   interpret UP_pre_univ_prop R R id by unfold_locales simp
   interpret ring_hom_cring P R "eval R R id x" by unfold_locales (rule eval_ring_hom[OF x])
   show ?thesis using assms by simp
 qed
 
 lemma evalRR_sub:
   assumes "p \<in> carrier P" "q \<in> carrier P"
   assumes x: "x \<in> carrier R"
   shows "eval R R id x (p \<ominus>\<^bsub>P\<^esub> q) = eval R R id x p \<ominus> eval R R id x q"
 proof -
   interpret UP_pre_univ_prop R R id by unfold_locales simp
   interpret ring_hom_cring P R "eval R R id x" by unfold_locales (rule eval_ring_hom[OF x])
   show ?thesis using assms by simp
 qed
 
 lemma evalRR_mult:
   assumes "p \<in> carrier P" "q \<in> carrier P"
   assumes x: "x \<in> carrier R"
   shows "eval R R id x (p \<otimes>\<^bsub>P\<^esub> q) = eval R R id x p \<otimes> eval R R id x q"
 proof -
   interpret UP_pre_univ_prop R R id by unfold_locales simp
   interpret ring_hom_cring P R "eval R R id x" by unfold_locales (rule eval_ring_hom[OF x])
   show ?thesis using assms by simp
 qed
 
 lemma evalRR_monom:
   assumes a: "a \<in> carrier R" and x: "x \<in> carrier R"
   shows "eval R R id x (monom P a d) = a \<otimes> x [^] d"
 proof -
   interpret UP_pre_univ_prop R R id by unfold_locales simp
   show ?thesis using assms by (simp add: eval_monom)
 qed
 
 lemma evalRR_one:
   assumes x: "x \<in> carrier R"
   shows "eval R R id x \<one>\<^bsub>P\<^esub> = \<one>"
 proof -
   interpret UP_pre_univ_prop R R id by unfold_locales simp
   interpret ring_hom_cring P R "eval R R id x" by unfold_locales (rule eval_ring_hom[OF x])
   show ?thesis using assms by simp
 qed
 
 lemma carrier_evalRR:
   assumes x: "x \<in> carrier R" and "p \<in> carrier P"
   shows "eval R R id x p \<in> carrier R"
 proof -
   interpret UP_pre_univ_prop R R id by unfold_locales simp
   interpret ring_hom_cring P R "eval R R id x" by unfold_locales (rule eval_ring_hom[OF x])
   show ?thesis using assms by simp
 qed
 
 lemmas evalRR_simps = evalRR_add evalRR_sub evalRR_mult evalRR_monom evalRR_one carrier_evalRR
 
 end
 
 
 
 section \<open>Properties of the Euler \<open>\<phi>\<close>-function\<close>
 text_raw \<open>\label{sec:euler-phi}\<close>
 
 text\<open>
   In this section we prove that for every positive natural number the equation
   $\sum_{d | n}^n \varphi(d) = n$ holds.
 \<close>
 
 lemma dvd_div_ge_1:
   fixes a b :: nat
   assumes "a \<ge> 1" "b dvd a"
   shows "a div b \<ge> 1"
 proof -
   from \<open>b dvd a\<close> obtain c where "a = b * c" ..
   with \<open>a \<ge> 1\<close> show ?thesis by simp
 qed
 
 lemma dvd_nat_bounds:
  fixes n p :: nat
  assumes "p > 0" "n dvd p"
  shows "n > 0 \<and> n \<le> p"
  using assms by (simp add: dvd_pos_nat dvd_imp_le)
 
 (* TODO FIXME: This is the "totient" function from HOL-Number_Theory, but since part of
    HOL-Number_Theory depends on HOL-Algebra.Multiplicative_Group, there would be a cyclic
    dependency. *)
 definition phi' :: "nat => nat"
   where "phi' m = card {x. 1 \<le> x \<and> x \<le> m \<and> coprime x m}"
 
 notation (latex output)
   phi' ("\<phi> _")
 
 lemma phi'_nonzero:
   assumes "m > 0"
   shows "phi' m > 0"
 proof -
   have "1 \<in> {x. 1 \<le> x \<and> x \<le> m \<and> coprime x m}" using assms by simp
   hence "card {x. 1 \<le> x \<and> x \<le> m \<and> coprime x m} > 0" by (auto simp: card_gt_0_iff)
   thus ?thesis unfolding phi'_def by simp
 qed
 
 lemma dvd_div_eq_1:
   fixes a b c :: nat
   assumes "c dvd a" "c dvd b" "a div c = b div c"
   shows "a = b" using assms dvd_mult_div_cancel[OF \<open>c dvd a\<close>] dvd_mult_div_cancel[OF \<open>c dvd b\<close>]
                 by presburger
 
 lemma dvd_div_eq_2:
   fixes a b c :: nat
   assumes "c>0" "a dvd c" "b dvd c" "c div a = c div b"
   shows "a = b"
   proof -
   have "a > 0" "a \<le> c" using dvd_nat_bounds[OF assms(1-2)] by auto
   have "a*(c div a) = c" using assms dvd_mult_div_cancel by fastforce
   also have "\<dots> = b*(c div a)" using assms dvd_mult_div_cancel by fastforce
   finally show "a = b" using \<open>c>0\<close> dvd_div_ge_1[OF _ \<open>a dvd c\<close>] by fastforce
 qed
 
 lemma div_mult_mono:
   fixes a b c :: nat
   assumes "a > 0" "a\<le>d"
   shows "a * b div d \<le> b"
 proof -
   have "a*b div d \<le> b*a div a" using assms div_le_mono2 mult.commute[of a b] by presburger
   thus ?thesis using assms by force
 qed
 
 text\<open>
   We arrive at the main result of this section:
   For every positive natural number the equation $\sum_{d | n}^n \varphi(d) = n$ holds.
 
   The outline of the proof for this lemma is as follows:
   We count the $n$ fractions $1/n$, $\ldots$, $(n-1)/n$, $n/n$.
   We analyze the reduced form $a/d = m/n$ for any of those fractions.
   We want to know how many fractions $m/n$ have the reduced form denominator $d$.
   The condition $1 \leq m \leq n$ is equivalent to the condition $1 \leq a \leq d$.
   Therefore we want to know how many $a$ with $1 \leq a \leq d$ exist, s.t. \<^term>\<open>gcd a d = 1\<close>.
   This number is exactly \<^term>\<open>phi' d\<close>.
 
   Finally, by counting the fractions $m/n$ according to their reduced form denominator,
   we get: @{term [display] "(\<Sum>d | d dvd n . phi' d) = n"}.
   To formalize this proof in Isabelle, we analyze for an arbitrary divisor $d$ of $n$
   \begin{itemize}
     \item the set of reduced form numerators \<^term>\<open>{a. (1::nat) \<le> a \<and> a \<le> d \<and> coprime a d}\<close>
     \item the set of numerators $m$, for which $m/n$ has the reduced form denominator $d$,
       i.e. the set \<^term>\<open>{m \<in> {1::nat .. n}. n div gcd m n = d}\<close>
   \end{itemize}
   We show that \<^term>\<open>\<lambda>a. a*n div d\<close> with the inverse \<^term>\<open>\<lambda>a. a div gcd a n\<close> is
   a bijection between theses sets, thus yielding the equality
   @{term [display] "phi' d = card {m \<in> {1 .. n}. n div gcd m n = d}"}
   This gives us
   @{term [display] "(\<Sum>d | d dvd n . phi' d)
           = card (\<Union>d \<in> {d. d dvd n}. {m \<in> {1 .. n}. n div gcd m n = d})"}
   and by showing
   \<^term>\<open>(\<Union>d \<in> {d. d dvd n}. {m \<in> {1::nat .. n}. n div gcd m n = d}) \<supseteq> {1 .. n}\<close>
   (this is our counting argument) the thesis follows.
 \<close>
 lemma sum_phi'_factors:
  fixes n :: nat
  assumes "n > 0"
  shows "(\<Sum>d | d dvd n. phi' d) = n"
 proof -
   { fix d assume "d dvd n" then obtain q where q: "n = d * q" ..
     have "card {a. 1 \<le> a \<and> a \<le> d \<and> coprime a d} = card {m \<in> {1 .. n}.  n div gcd m n = d}"
          (is "card ?RF = card ?F")
     proof (rule card_bij_eq)
       { fix a b assume "a * n div d = b * n div d"
         hence "a * (n div d) = b * (n div d)"
           using dvd_div_mult[OF \<open>d dvd n\<close>] by (fastforce simp add: mult.commute)
         hence "a = b" using dvd_div_ge_1[OF _ \<open>d dvd n\<close>] \<open>n>0\<close>
           by (simp add: mult.commute nat_mult_eq_cancel1)
       } thus "inj_on (\<lambda>a. a*n div d) ?RF" unfolding inj_on_def by blast
       { fix a assume a: "a\<in>?RF"
         hence "a * (n div d) \<ge> 1" using \<open>n>0\<close> dvd_div_ge_1[OF _ \<open>d dvd n\<close>] by simp
         hence ge_1: "a * n div d \<ge> 1" by (simp add: \<open>d dvd n\<close> div_mult_swap)
         have le_n: "a * n div d \<le> n" using div_mult_mono a by simp
         have "gcd (a * n div d) n = n div d * gcd a d"
           by (simp add: gcd_mult_distrib_nat q ac_simps)
         hence "n div gcd (a * n div d) n = d*n div (d*(n div d))" using a by simp
         hence "a * n div d \<in> ?F"
           using ge_1 le_n by (fastforce simp add: \<open>d dvd n\<close>)
       } thus "(\<lambda>a. a*n div d) ` ?RF \<subseteq> ?F" by blast
       { fix m l assume A: "m \<in> ?F" "l \<in> ?F" "m div gcd m n = l div gcd l n"
         hence "gcd m n = gcd l n" using dvd_div_eq_2[OF assms] by fastforce
         hence "m = l" using dvd_div_eq_1[of "gcd m n" m l] A(3) by fastforce
       } thus "inj_on (\<lambda>a. a div gcd a n) ?F" unfolding inj_on_def by blast
       { fix m assume "m \<in> ?F"
         hence "m div gcd m n \<in> ?RF" using dvd_div_ge_1
           by (fastforce simp add: div_le_mono div_gcd_coprime)
       } thus "(\<lambda>a. a div gcd a n) ` ?F \<subseteq> ?RF" by blast
     qed force+
   } hence phi'_eq: "\<And>d. d dvd n \<Longrightarrow> phi' d = card {m \<in> {1 .. n}. n div gcd m n = d}"
       unfolding phi'_def by presburger
   have fin: "finite {d. d dvd n}" using dvd_nat_bounds[OF \<open>n>0\<close>] by force
   have "(\<Sum>d | d dvd n. phi' d)
                  = card (\<Union>d \<in> {d. d dvd n}. {m \<in> {1 .. n}. n div gcd m n = d})"
     using card_UN_disjoint[OF fin, of "(\<lambda>d. {m \<in> {1 .. n}. n div gcd m n = d})"] phi'_eq
     by fastforce
   also have "(\<Union>d \<in> {d. d dvd n}. {m \<in> {1 .. n}. n div gcd m n = d}) = {1 .. n}" (is "?L = ?R")
   proof
     show "?L \<supseteq> ?R"
     proof
       fix m assume m: "m \<in> ?R"
       thus "m \<in> ?L" using dvd_triv_right[of "n div gcd m n" "gcd m n"]
         by simp
     qed
   qed fastforce
   finally show ?thesis by force
 qed
 
 
 
 section \<open>Order of an Element of a Group\<close>
 text_raw \<open>\label{sec:order-elem}\<close>
 
 
 context group begin
 
 definition (in group) ord :: "'a \<Rightarrow> nat" where
   "ord x \<equiv> (@d. \<forall>n::nat. x [^] n = \<one> \<longleftrightarrow> d dvd n)"
 
 lemma (in group) pow_eq_id:
   assumes "x \<in> carrier G"
   shows "x [^] n = \<one> \<longleftrightarrow> (ord x) dvd n"
 proof (cases "\<forall>n::nat. pow G x n = one G \<longrightarrow> n = 0")
   case True
   show ?thesis
     unfolding ord_def
     by (rule someI2 [where a=0]) (auto simp: True)
 next
   case False
   define N where "N \<equiv> LEAST n::nat. x [^] n = \<one> \<and> n > 0"
   have N: "x [^] N = \<one> \<and> N > 0"
     using False
     apply (simp add: N_def)
     by (metis (mono_tags, lifting) LeastI)
   have eq0: "n = 0" if "x [^] n = \<one>" "n < N" for n
     using N_def not_less_Least that by fastforce
   show ?thesis
     unfolding ord_def
   proof (rule someI2 [where a = N], rule allI)
     fix n :: "nat"
     show "(x [^] n = \<one>) \<longleftrightarrow> (N dvd n)"
     proof (cases "n = 0")
       case False
       show ?thesis
         unfolding dvd_def
       proof safe
         assume 1: "x [^] n = \<one>"
         have "x [^] n = x [^] (n mod N + N * (n div N))"
           by simp
         also have "\<dots> = x [^] (n mod N) \<otimes> x [^] (N * (n div N))"
           by (simp add: assms nat_pow_mult)
         also have "\<dots> = x [^] (n mod N)"
           by (metis N assms l_cancel_one nat_pow_closed nat_pow_one nat_pow_pow)
         finally have "x [^] (n mod N) = \<one>"
           by (simp add: "1")
         then have "n mod N = 0"
           using N eq0 mod_less_divisor by blast
         then show "\<exists>k. n = N * k"
           by blast
       next
         fix k :: "nat"
         assume "n = N * k"
         with N show "x [^] (N * k) = \<one>"
           by (metis assms nat_pow_one nat_pow_pow)
       qed
     qed simp
   qed blast
 qed
 
 lemma (in group) pow_ord_eq_1 [simp]:
    "x \<in> carrier G \<Longrightarrow> x [^] ord x = \<one>"
   by (simp add: pow_eq_id)
 
 lemma (in group) int_pow_eq_id:
   assumes "x \<in> carrier G"
   shows "(pow G x i = one G \<longleftrightarrow> int (ord x) dvd i)"
 proof (cases i rule: int_cases2)
   case (nonneg n)
   then show ?thesis
     by (simp add: int_pow_int pow_eq_id assms)
 next
   case (nonpos n)
   then have "x [^] i = inv (x [^] n)"
     by (simp add: assms int_pow_int int_pow_neg)
   then show ?thesis
     by (simp add: assms pow_eq_id nonpos)
 qed
 
 lemma (in group) int_pow_eq:
    "x \<in> carrier G \<Longrightarrow> (x [^] m = x [^] n) \<longleftrightarrow> int (ord x) dvd (n - m)"
   apply (simp flip: int_pow_eq_id)
   by (metis int_pow_closed int_pow_diff inv_closed r_inv right_cancel)
 
 lemma (in group) ord_eq_0:
    "x \<in> carrier G \<Longrightarrow> (ord x = 0 \<longleftrightarrow> (\<forall>n::nat. n \<noteq> 0 \<longrightarrow> x [^] n \<noteq> \<one>))"
   by (auto simp: pow_eq_id)
 
 lemma (in group) ord_unique:
    "x \<in> carrier G \<Longrightarrow> ord x = d \<longleftrightarrow> (\<forall>n. pow G x n = one G \<longleftrightarrow> d dvd n)"
   by (meson dvd_antisym dvd_refl pow_eq_id)
 
 lemma (in group) ord_eq_1:
    "x \<in> carrier G \<Longrightarrow> (ord x = 1 \<longleftrightarrow> x = \<one>)"
   by (metis pow_eq_id nat_dvd_1_iff_1 nat_pow_eone)
 
 lemma (in group) ord_id [simp]:
    "ord (one G) = 1"
   using ord_eq_1 by blast
 
 lemma (in group) ord_inv [simp]:
    "x \<in> carrier G
         \<Longrightarrow> ord (m_inv G x) = ord x"
   by (simp add: ord_unique pow_eq_id nat_pow_inv)
 
 lemma (in group) ord_pow:
   assumes "x \<in> carrier G" "k dvd ord x" "k \<noteq> 0"
   shows "ord (pow G x k) = ord x div k"
 proof -
   have "(x [^] k) [^] (ord x div k) = \<one>"
     using assms by (simp add: nat_pow_pow)
   moreover have "ord x dvd k * ord (x [^] k)"
     by (metis assms(1) pow_ord_eq_1 pow_eq_id nat_pow_closed nat_pow_pow)
   ultimately show ?thesis
     by (metis assms div_dvd_div dvd_antisym dvd_triv_left pow_eq_id nat_pow_closed nonzero_mult_div_cancel_left)
 qed
 
 lemma (in group) ord_mul_divides:
   assumes eq: "x \<otimes> y = y \<otimes> x" and xy: "x \<in> carrier G" "y \<in> carrier G"
   shows "ord (x \<otimes> y) dvd (ord x * ord y)"
 apply (simp add: xy flip: pow_eq_id eq)
   by (metis dvd_triv_left dvd_triv_right eq pow_eq_id one_closed pow_mult_distrib r_one xy)
 
 lemma (in comm_group) abelian_ord_mul_divides:
    "\<lbrakk>x \<in> carrier G; y \<in> carrier G\<rbrakk>
         \<Longrightarrow> ord (x \<otimes> y) dvd (ord x * ord y)"
   by (simp add: ord_mul_divides m_comm)
 
 lemma ord_inj:
   assumes a: "a \<in> carrier G"
   shows "inj_on (\<lambda> x . a [^] x) {0 .. ord a - 1}"
 proof -
   let ?M = "Max (ord ` carrier G)"
   have "finite {d \<in> {..?M}. a [^] d = \<one>}" by auto
 
   have *: False if A: "x < y" "x \<in> {0 .. ord a - 1}" "y \<in> {0 .. ord a - 1}"
         "a [^] x = a [^] y" for x y
   proof -
     have "y - x < ord a" using that by auto
     moreover have "a [^] (y-x) = \<one>" using a A by (simp add: pow_eq_div2)
     ultimately have "min (y - x) (ord a) = ord a"
       using A(1) a pow_eq_id by auto
     with \<open>y - x < ord a\<close> show False by linarith
   qed
   show ?thesis
     unfolding inj_on_def by (metis nat_neq_iff *)
 qed
 
 lemma ord_inj':
   assumes a: "a \<in> carrier G"
   shows "inj_on (\<lambda> x . a [^] x) {1 .. ord a}"
 proof (rule inj_onI, rule ccontr)
   fix x y :: nat
   assume A: "x \<in> {1 .. ord a}" "y \<in> {1 .. ord a}" "a [^] x = a [^] y" "x\<noteq>y"
   { assume "x < ord a" "y < ord a"
     hence False using ord_inj[OF assms] A unfolding inj_on_def by fastforce
   }
   moreover
   { assume "x = ord a" "y < ord a"
     hence "a [^] y = a [^] (0::nat)" using pow_ord_eq_1 A by (simp add: a)
     hence "y=0" using ord_inj[OF assms] \<open>y < ord a\<close> unfolding inj_on_def by force
     hence False using A by fastforce
   }
   moreover
   { assume "y = ord a" "x < ord a"
     hence "a [^] x = a [^] (0::nat)" using pow_ord_eq_1 A by (simp add: a)
     hence "x=0" using ord_inj[OF assms] \<open>x < ord a\<close> unfolding inj_on_def by force
     hence False using A by fastforce
   }
   ultimately show False using A  by force
 qed
 
 lemma (in group) ord_ge_1: 
   assumes finite: "finite (carrier G)" and a: "a \<in> carrier G"
   shows "ord a \<ge> 1" 
 proof -
   have "((\<lambda>n::nat. a [^] n) ` {0<..}) \<subseteq> carrier G"
     using a by blast
   then have "finite ((\<lambda>n::nat. a [^] n) ` {0<..})"
     using finite_subset finite by auto
   then have "\<not> inj_on (\<lambda>n::nat. a [^] n) {0<..}"
     using finite_imageD infinite_Ioi by blast
   then obtain i j::nat where "i \<noteq> j" "a [^] i = a [^] j"
     by (auto simp: inj_on_def)
   then have "\<exists>n::nat. n>0 \<and> a [^] n = \<one>"
     by (metis a diffs0_imp_equal pow_eq_div2 neq0_conv)
   then have "ord a \<noteq> 0"
     by (simp add: ord_eq_0 [OF a])
   then show ?thesis
     by simp
 qed
 
 lemma ord_elems:
   assumes "finite (carrier G)" "a \<in> carrier G"
   shows "{a[^]x | x. x \<in> (UNIV :: nat set)} = {a[^]x | x. x \<in> {0 .. ord a - 1}}" (is "?L = ?R")
 proof
   show "?R \<subseteq> ?L" by blast
   { fix y assume "y \<in> ?L"
     then obtain x::nat where x: "y = a[^]x" by auto
     define r q where "r = x mod ord a" and "q = x div ord a"
     then have "x = q * ord a + r"
       by (simp add: div_mult_mod_eq)
     hence "y = (a[^]ord a)[^]q \<otimes> a[^]r"
       using x assms by (metis mult.commute nat_pow_mult nat_pow_pow)
     hence "y = a[^]r" using assms by (simp add: pow_ord_eq_1)
     have "r < ord a" using ord_ge_1[OF assms] by (simp add: r_def)
     hence "r \<in> {0 .. ord a - 1}" by (force simp: r_def)
     hence "y \<in> {a[^]x | x. x \<in> {0 .. ord a - 1}}" using \<open>y=a[^]r\<close> by blast
   }
   thus "?L \<subseteq> ?R" by auto
 qed
 
 lemma (in group)
   assumes "x \<in> carrier G"
   shows finite_cyclic_subgroup:
         "finite(carrier(subgroup_generated G {x})) \<longleftrightarrow> (\<exists>n::nat. n \<noteq> 0 \<and> x [^] n = \<one>)" (is "?fin \<longleftrightarrow> ?nat1")
     and infinite_cyclic_subgroup:
         "infinite(carrier(subgroup_generated G {x})) \<longleftrightarrow> (\<forall>m n::nat. x [^] m = x [^] n \<longrightarrow> m = n)" (is "\<not> ?fin \<longleftrightarrow> ?nateq")
     and finite_cyclic_subgroup_int:
         "finite(carrier(subgroup_generated G {x})) \<longleftrightarrow> (\<exists>i::int. i \<noteq> 0 \<and> x [^] i = \<one>)" (is "?fin \<longleftrightarrow> ?int1")
     and infinite_cyclic_subgroup_int:
         "infinite(carrier(subgroup_generated G {x})) \<longleftrightarrow> (\<forall>i j::int. x [^] i = x [^] j \<longrightarrow> i = j)" (is "\<not> ?fin \<longleftrightarrow> ?inteq")
 proof -
   have 1: "\<not> ?fin" if ?nateq
   proof -
     have "infinite (range (\<lambda>n::nat. x [^] n))"
       using that range_inj_infinite [of "(\<lambda>n::nat. x [^] n)"] by (auto simp: inj_on_def)
     moreover have "range (\<lambda>n::nat. x [^] n) \<subseteq> range (\<lambda>i::int. x [^] i)"
       apply clarify
       by (metis assms group.int_pow_neg int_pow_closed int_pow_neg_int is_group local.inv_equality nat_pow_closed r_inv rangeI)
     ultimately show ?thesis
       using carrier_subgroup_generated_by_singleton [OF assms] finite_subset by auto
   qed
   have 2: "m = n" if mn: "x [^] m = x [^] n" and eq [rule_format]: "?inteq" for m n::nat
     using eq [of "int m" "int n"]
     by (simp add: int_pow_int mn)
   have 3: ?nat1 if non: "\<not> ?inteq"
   proof -
     obtain i j::int where eq: "x [^] i = x [^] j" and "i \<noteq> j"
       using non by auto
     show ?thesis
     proof (cases i j rule: linorder_cases)
       case less
       then have [simp]: "x [^] (j - i) = \<one>"
         by (simp add: eq assms int_pow_diff)
       show ?thesis
         using less by (rule_tac x="nat (j-i)" in exI) auto
     next
       case greater
       then have [simp]: "x [^] (i - j) = \<one>"
         by (simp add: eq assms int_pow_diff)
       then show ?thesis
         using greater by (rule_tac x="nat (i-j)" in exI) auto
     qed (use \<open>i \<noteq> j\<close> in auto)
   qed
   have 4: "\<exists>i::int. (i \<noteq> 0) \<and> x [^] i = \<one>" if "n \<noteq> 0" "x [^] n = \<one>" for n::nat
     apply (rule_tac x="int n" in exI)
     by (simp add: int_pow_int that)
   have 5: "finite (carrier (subgroup_generated G {x}))" if "i \<noteq> 0" and 1: "x [^] i = \<one>" for i::int
   proof -
     obtain n::nat where n: "n > 0" "x [^] n = \<one>"
       using "1" "3" \<open>i \<noteq> 0\<close> by fastforce
     have "x [^] a \<in> ([^]) x ` {0..<n}" for a::int
     proof
       show "x [^] a = x [^] nat (a mod int n)"
         using n
         by simp (metis (no_types, lifting) assms dvd_minus_mod dvd_trans int_pow_eq int_pow_eq_id int_pow_int)
       show "nat (a mod int n) \<in> {0..<n}"
         using n  apply (simp add:  split: split_nat)
         using Euclidean_Division.pos_mod_bound by presburger
     qed
     then have "carrier (subgroup_generated G {x}) \<subseteq> ([^]) x ` {0..<n}"
       using carrier_subgroup_generated_by_singleton [OF assms] by auto
     then show ?thesis
       using finite_surj by blast
   qed
   show "?fin \<longleftrightarrow> ?nat1" "\<not> ?fin \<longleftrightarrow> ?nateq" "?fin \<longleftrightarrow> ?int1" "\<not> ?fin \<longleftrightarrow> ?inteq"
     using 1 2 3 4 5 by meson+
 qed
 
 lemma (in group) finite_cyclic_subgroup_order:
    "x \<in> carrier G \<Longrightarrow> finite(carrier(subgroup_generated G {x})) \<longleftrightarrow> ord x \<noteq> 0"
   by (simp add: finite_cyclic_subgroup ord_eq_0)
 
 lemma (in group) infinite_cyclic_subgroup_order:
    "x \<in> carrier G \<Longrightarrow> infinite (carrier(subgroup_generated G {x})) \<longleftrightarrow> ord x = 0"
   by (simp add: finite_cyclic_subgroup_order)
 
 lemma generate_pow_on_finite_carrier: \<^marker>\<open>contributor \<open>Paulo Emílio de Vilhena\<close>\<close>
   assumes "finite (carrier G)" and a: "a \<in> carrier G"
   shows "generate G { a } = { a [^] k | k. k \<in> (UNIV :: nat set) }"
 proof
   show "{ a [^] k | k. k \<in> (UNIV :: nat set) } \<subseteq> generate G { a }"
   proof
     fix b assume "b \<in> { a [^] k | k. k \<in> (UNIV :: nat set) }"
     then obtain k :: nat where "b = a [^] k" by blast
     hence "b = a [^] (int k)"
       by (simp add: int_pow_int)
     thus "b \<in> generate G { a }"
       unfolding generate_pow[OF a] by blast
   qed
 next
   show "generate G { a } \<subseteq> { a [^] k | k. k \<in> (UNIV :: nat set) }"
   proof
     fix b assume "b \<in> generate G { a }"
     then obtain k :: int where k: "b = a [^] k"
       unfolding generate_pow[OF a] by blast
     show "b \<in> { a [^] k | k. k \<in> (UNIV :: nat set) }"
     proof (cases "k < 0")
       assume "\<not> k < 0"
       hence "b = a [^] (nat k)"
         by (simp add: k)
       thus ?thesis by blast
     next
       assume "k < 0"
       hence b: "b = inv (a [^] (nat (- k)))"
         using k a by (auto simp: int_pow_neg)
       obtain m where m: "ord a * m \<ge> nat (- k)"
         by (metis assms mult.left_neutral mult_le_mono1 ord_ge_1)
       hence "a [^] (ord a * m) = \<one>"
         by (metis a nat_pow_one nat_pow_pow pow_ord_eq_1)
       then obtain k' :: nat where "(a [^] (nat (- k))) \<otimes> (a [^] k') = \<one>"
         using m a nat_le_iff_add nat_pow_mult by auto
       hence "b = a [^] k'"
         using b a by (metis inv_unique' nat_pow_closed nat_pow_comm)
       thus "b \<in> { a [^] k | k. k \<in> (UNIV :: nat set) }" by blast
     qed
   qed
 qed
 
 lemma ord_elems_inf_carrier:
  assumes "a \<in> carrier G" "ord a \<noteq> 0"
  shows "{a[^]x | x. x \<in> (UNIV :: nat set)} = {a[^]x | x. x \<in> {0 .. ord a - 1}}" (is "?L = ?R")
 proof
  show "?R \<subseteq> ?L" by blast
  { fix y assume "y \<in> ?L"
    then obtain x::nat where x: "y = a[^]x" by auto
    define r q where "r = x mod ord a" and "q = x div ord a"
    then have "x = q * ord a + r"
      by (simp add: div_mult_mod_eq)
    hence "y = (a[^]ord a)[^]q \<otimes> a[^]r"
      using x assms by (metis mult.commute nat_pow_mult nat_pow_pow)
    hence "y = a[^]r" using assms by simp
    have "r < ord a" using assms by (simp add: r_def)
    hence "r \<in> {0 .. ord a - 1}" by (force simp: r_def)
    hence "y \<in> {a[^]x | x. x \<in> {0 .. ord a - 1}}" using \<open>y=a[^]r\<close> by blast
  }
  thus "?L \<subseteq> ?R" by auto
 qed
 
 lemma generate_pow_nat:
  assumes a: "a \<in> carrier G" and "ord a \<noteq> 0"
  shows "generate G { a } = { a [^] k | k. k \<in> (UNIV :: nat set) }"
 proof
  show "{ a [^] k | k. k \<in> (UNIV :: nat set) } \<subseteq> generate G { a }"
  proof
    fix b assume "b \<in> { a [^] k | k. k \<in> (UNIV :: nat set) }"
    then obtain k :: nat where "b = a [^] k" by blast
    hence "b = a [^] (int k)"
      by (simp add: int_pow_int)
    thus "b \<in> generate G { a }"
      unfolding generate_pow[OF a] by blast
  qed
 next
  show "generate G { a } \<subseteq> { a [^] k | k. k \<in> (UNIV :: nat set) }"
  proof
    fix b assume "b \<in> generate G { a }"
    then obtain k :: int where k: "b = a [^] k"
      unfolding generate_pow[OF a] by blast
    show "b \<in> { a [^] k | k. k \<in> (UNIV :: nat set) }"
    proof (cases "k < 0")
      assume "\<not> k < 0"
      hence "b = a [^] (nat k)"
        by (simp add: k)
      thus ?thesis by blast
    next
      assume "k < 0"
      hence b: "b = inv (a [^] (nat (- k)))"
        using k a by (auto simp: int_pow_neg)
      obtain m where m: "ord a * m \<ge> nat (- k)"
        by (metis assms(2) dvd_imp_le dvd_triv_right le_zero_eq mult_eq_0_iff not_gr_zero)
      hence "a [^] (ord a * m) = \<one>"
        by (metis a nat_pow_one nat_pow_pow pow_ord_eq_1)
      then obtain k' :: nat where "(a [^] (nat (- k))) \<otimes> (a [^] k') = \<one>"
        using m a nat_le_iff_add nat_pow_mult by auto
      hence "b = a [^] k'"
        using b a by (metis inv_unique' nat_pow_closed nat_pow_comm)
      thus "b \<in> { a [^] k | k. k \<in> (UNIV :: nat set) }" by blast
    qed
  qed
 qed
 
 lemma generate_pow_card:
   assumes a: "a \<in> carrier G"
   shows "ord a = card (generate G { a })"
 proof (cases "ord a = 0")
   case True
   then have "infinite (carrier (subgroup_generated G {a}))"
     using infinite_cyclic_subgroup_order[OF a] by auto
   then have "infinite (generate G {a})"
     unfolding subgroup_generated_def
     using a by simp
   then show ?thesis
     using \<open>ord a = 0\<close> by auto
 next
   case False
   note finite_subgroup = this
   then have "generate G { a } = (([^]) a) ` {0..ord a - 1}"
     using generate_pow_nat ord_elems_inf_carrier a by auto
   hence "card (generate G {a}) = card {0..ord a - 1}"
     using ord_inj[OF a] card_image by metis
   also have "... = ord a" using finite_subgroup by auto
   finally show ?thesis.. 
 qed
 
 lemma (in group) cyclic_order_is_ord:
  assumes "g \<in> carrier G"
  shows "ord g = order (subgroup_generated G {g})"
  unfolding order_def subgroup_generated_def
  using assms generate_pow_card by simp
 
 lemma ord_dvd_group_order:
   assumes "a \<in> carrier G" shows "(ord a) dvd (order G)"
   using lagrange[OF generate_is_subgroup[of "{a}"]] assms
   unfolding generate_pow_card[OF assms]
   by (metis dvd_triv_right empty_subsetI insert_subset)
 
 lemma (in group) pow_order_eq_1:
   assumes "a \<in> carrier G" shows "a [^] order G = \<one>"
   using assms by (metis nat_pow_pow ord_dvd_group_order pow_ord_eq_1 dvdE nat_pow_one)
 
 lemma dvd_gcd:
   fixes a b :: nat
   obtains q where "a * (b div gcd a b) = b*q"
 proof
   have "a * (b div gcd a b) = (a div gcd a b) * b" by (simp add:  div_mult_swap dvd_div_mult)
   also have "\<dots> = b * (a div gcd a b)" by simp
   finally show "a * (b div gcd a b) = b * (a div gcd a b) " .
 qed
 
 lemma (in group) ord_le_group_order:
   assumes finite: "finite (carrier G)" and a: "a \<in> carrier G"
   shows "ord a \<le> order G"
   by (simp add: a dvd_imp_le local.finite ord_dvd_group_order order_gt_0_iff_finite)
 
 lemma (in group) ord_pow_gen:
   assumes "x \<in> carrier G"
   shows "ord (pow G x k) = (if k = 0 then 1 else ord x div gcd (ord x) k)"
 proof -
   have "ord (x [^] k) = ord x div gcd (ord x) k"
     if "0 < k"
   proof -
     have "(d dvd k * n) = (d div gcd (d) k dvd n)" for d n
       using that by (simp add: div_dvd_iff_mult gcd_mult_distrib_nat mult.commute)
     then show ?thesis
       using that by (auto simp add: assms ord_unique nat_pow_pow pow_eq_id)
   qed
   then show ?thesis by auto
 qed
 
 lemma (in group)
   assumes finite': "finite (carrier G)" "a \<in> carrier G"
   shows pow_ord_eq_ord_iff: "group.ord G (a [^] k) = ord a \<longleftrightarrow> coprime k (ord a)" (is "?L \<longleftrightarrow> ?R")
     using assms ord_ge_1 [OF assms]
     by (auto simp: div_eq_dividend_iff ord_pow_gen coprime_iff_gcd_eq_1 gcd.commute split: if_split_asm)
 
 lemma element_generates_subgroup:
   assumes finite[simp]: "finite (carrier G)"
   assumes a[simp]: "a \<in> carrier G"
   shows "subgroup {a [^] i | i. i \<in> {0 .. ord a - 1}} G"
   using generate_is_subgroup[of "{ a }"] assms(2)
         generate_pow_on_finite_carrier[OF assms]
   unfolding ord_elems[OF assms] by auto
 
 end
 
 
 section \<open>Number of Roots of a Polynomial\<close>
 text_raw \<open>\label{sec:number-roots}\<close>
 
 
 definition mult_of :: "('a, 'b) ring_scheme \<Rightarrow> 'a monoid" where
   "mult_of R \<equiv> \<lparr> carrier = carrier R - {\<zero>\<^bsub>R\<^esub>}, mult = mult R, one = \<one>\<^bsub>R\<^esub>\<rparr>"
 
 lemma carrier_mult_of [simp]: "carrier (mult_of R) = carrier R - {\<zero>\<^bsub>R\<^esub>}"
   by (simp add: mult_of_def)
 
 lemma mult_mult_of [simp]: "mult (mult_of R) = mult R"
  by (simp add: mult_of_def)
 
 lemma nat_pow_mult_of: "([^]\<^bsub>mult_of R\<^esub>) = (([^]\<^bsub>R\<^esub>) :: _ \<Rightarrow> nat \<Rightarrow> _)"
   by (simp add: mult_of_def fun_eq_iff nat_pow_def)
 
 lemma one_mult_of [simp]: "\<one>\<^bsub>mult_of R\<^esub> = \<one>\<^bsub>R\<^esub>"
   by (simp add: mult_of_def)
 
 lemmas mult_of_simps = carrier_mult_of mult_mult_of nat_pow_mult_of one_mult_of
 
 context field
 begin
 
 lemma mult_of_is_Units: "mult_of R = units_of R"
   unfolding mult_of_def units_of_def using field_Units by auto
 
 lemma m_inv_mult_of:
 "\<And>x. x \<in> carrier (mult_of R) \<Longrightarrow> m_inv (mult_of R) x = m_inv R x"
   using mult_of_is_Units units_of_inv unfolding units_of_def
   by simp
 
 lemma (in field) field_mult_group: "group (mult_of R)"
   proof (rule groupI)
   show "\<exists>y\<in>carrier (mult_of R). y \<otimes>\<^bsub>mult_of R\<^esub> x = \<one>\<^bsub>mult_of R\<^esub>"
     if "x \<in> carrier (mult_of R)" for x
     using group.l_inv_ex mult_of_is_Units that units_group by fastforce
 qed (auto simp: m_assoc dest: integral)
 
 lemma finite_mult_of: "finite (carrier R) \<Longrightarrow> finite (carrier (mult_of R))"
   by simp
 
 lemma order_mult_of: "finite (carrier R) \<Longrightarrow> order (mult_of R) = order R - 1"
   unfolding order_def carrier_mult_of by (simp add: card.remove)
 
 end
 
 
 
 lemma (in monoid) Units_pow_closed :
   fixes d :: nat
   assumes "x \<in> Units G"
   shows "x [^] d \<in> Units G"
     by (metis assms group.is_monoid monoid.nat_pow_closed units_group units_of_carrier units_of_pow)
 
 lemma (in ring) r_right_minus_eq[simp]:
   assumes "a \<in> carrier R" "b \<in> carrier R"
   shows "a \<ominus> b = \<zero> \<longleftrightarrow> a = b"
   using assms by (metis a_minus_def add.inv_closed minus_equality r_neg)
 
 context UP_cring begin
 
 lemma is_UP_cring: "UP_cring R" by (unfold_locales)
 lemma is_UP_ring:
   shows "UP_ring R" by (unfold_locales)
 
 end
 
 context UP_domain begin
 
 
 lemma roots_bound:
   assumes f [simp]: "f \<in> carrier P"
   assumes f_not_zero: "f \<noteq> \<zero>\<^bsub>P\<^esub>"
   assumes finite: "finite (carrier R)"
   shows "finite {a \<in> carrier R . eval R R id a f = \<zero>} \<and>
          card {a \<in> carrier R . eval R R id a f = \<zero>} \<le> deg R f" using f f_not_zero
 proof (induction "deg R f" arbitrary: f)
   case 0
   have "\<And>x. eval R R id x f \<noteq> \<zero>"
   proof -
     fix x
     have "(\<Oplus>i\<in>{..deg R f}. id (coeff P f i) \<otimes> x [^] i) \<noteq> \<zero>"
       using 0 lcoeff_nonzero_nonzero[where p = f] by simp
     thus "eval R R id x f \<noteq> \<zero>" using 0 unfolding eval_def P_def by simp
   qed
   then have *: "{a \<in> carrier R. eval R R (\<lambda>a. a) a f = \<zero>} = {}"
     by (auto simp: id_def)
   show ?case by (simp add: *)
 next
   case (Suc x)
   show ?case
   proof (cases "\<exists> a \<in> carrier R . eval R R id a f = \<zero>")
     case True
     then obtain a where a_carrier[simp]: "a \<in> carrier R" and a_root: "eval R R id a f = \<zero>" by blast
     have R_not_triv: "carrier R \<noteq> {\<zero>}"
       by (metis R.one_zeroI R.zero_not_one)
     obtain q  where q: "(q \<in> carrier P)" and
       f: "f = (monom P \<one>\<^bsub>R\<^esub> 1 \<ominus>\<^bsub> P\<^esub> monom P a 0) \<otimes>\<^bsub>P\<^esub> q \<oplus>\<^bsub>P\<^esub> monom P (eval R R id a f) 0"
      using remainder_theorem[OF Suc.prems(1) a_carrier R_not_triv] by auto
     hence lin_fac: "f = (monom P \<one>\<^bsub>R\<^esub> 1 \<ominus>\<^bsub> P\<^esub> monom P a 0) \<otimes>\<^bsub>P\<^esub> q" using q by (simp add: a_root)
     have deg: "deg R (monom P \<one>\<^bsub>R\<^esub> 1 \<ominus>\<^bsub> P\<^esub> monom P a 0) = 1"
       using a_carrier by (simp add: deg_minus_eq)
     hence mon_not_zero: "(monom P \<one>\<^bsub>R\<^esub> 1 \<ominus>\<^bsub> P\<^esub> monom P a 0) \<noteq> \<zero>\<^bsub>P\<^esub>"
       by (fastforce simp del: r_right_minus_eq)
     have q_not_zero: "q \<noteq> \<zero>\<^bsub>P\<^esub>" using Suc by (auto simp add : lin_fac)
     hence "deg R q = x" using Suc deg deg_mult[OF mon_not_zero q_not_zero _ q]
       by (simp add : lin_fac)
     hence q_IH: "finite {a \<in> carrier R . eval R R id a q = \<zero>}
                 \<and> card {a \<in> carrier R . eval R R id a q = \<zero>} \<le> x" using Suc q q_not_zero by blast
     have subs: "{a \<in> carrier R . eval R R id a f = \<zero>}
                 \<subseteq> {a \<in> carrier R . eval R R id a q = \<zero>} \<union> {a}" (is "?L \<subseteq> ?R \<union> {a}")
       using a_carrier \<open>q \<in> _\<close>
       by (auto simp: evalRR_simps lin_fac R.integral_iff)
     have "{a \<in> carrier R . eval R R id a f = \<zero>} \<subseteq> insert a {a \<in> carrier R . eval R R id a q = \<zero>}"
      using subs by auto
     hence "card {a \<in> carrier R . eval R R id a f = \<zero>} \<le>
            card (insert a {a \<in> carrier R . eval R R id a q = \<zero>})" using q_IH by (blast intro: card_mono)
     also have "\<dots> \<le> deg R f" using q_IH \<open>Suc x = _\<close>
       by (simp add: card_insert_if)
     finally show ?thesis using q_IH \<open>Suc x = _\<close> using finite by force
   next
     case False
     hence "card {a \<in> carrier R. eval R R id a f = \<zero>} = 0" using finite by auto
     also have "\<dots> \<le>  deg R f" by simp
     finally show ?thesis using finite by auto
   qed
 qed
 
 end
 
 lemma (in domain) num_roots_le_deg :
   fixes p d :: nat
   assumes finite: "finite (carrier R)"
   assumes d_neq_zero: "d \<noteq> 0"
   shows "card {x \<in> carrier R. x [^] d = \<one>} \<le> d"
 proof -
   let ?f = "monom (UP R) \<one>\<^bsub>R\<^esub> d \<ominus>\<^bsub> (UP R)\<^esub> monom (UP R) \<one>\<^bsub>R\<^esub> 0"
   have one_in_carrier: "\<one> \<in> carrier R" by simp
   interpret R: UP_domain R "UP R" by (unfold_locales)
   have "deg R ?f = d"
     using d_neq_zero by (simp add: R.deg_minus_eq)
   hence f_not_zero: "?f \<noteq> \<zero>\<^bsub>UP R\<^esub>" using  d_neq_zero by (auto simp add : R.deg_nzero_nzero)
   have roots_bound: "finite {a \<in> carrier R . eval R R id a ?f = \<zero>} \<and>
                     card {a \<in> carrier R . eval R R id a ?f = \<zero>} \<le> deg R ?f"
                     using finite by (intro R.roots_bound[OF _ f_not_zero]) simp
   have subs: "{x \<in> carrier R. x [^] d = \<one>} \<subseteq> {a \<in> carrier R . eval R R id a ?f = \<zero>}"
     by (auto simp: R.evalRR_simps)
   then have "card {x \<in> carrier R. x [^] d = \<one>} \<le>
         card {a \<in> carrier R. eval R R id a ?f = \<zero>}" using finite by (simp add : card_mono)
   thus ?thesis using \<open>deg R ?f = d\<close> roots_bound by linarith
 qed
 
 
 
 section \<open>The Multiplicative Group of a Field\<close>
 text_raw \<open>\label{sec:mult-group}\<close>
 
 
 text \<open>
   In this section we show that the multiplicative group of a finite field
   is generated by a single element, i.e. it is cyclic. The proof is inspired
-  by the first proof given in the survey~@{cite "conrad-cyclicity"}.
+  by the first proof given in the survey~\<^cite>\<open>"conrad-cyclicity"\<close>.
 \<close>
 
 context field begin
 
 lemma num_elems_of_ord_eq_phi':
   assumes finite: "finite (carrier R)" and dvd: "d dvd order (mult_of R)"
       and exists: "\<exists>a\<in>carrier (mult_of R). group.ord (mult_of R) a = d"
   shows "card {a \<in> carrier (mult_of R). group.ord (mult_of R) a = d} = phi' d"
 proof -
   note mult_of_simps[simp]
   have finite': "finite (carrier (mult_of R))" using finite by (rule finite_mult_of)
 
   interpret G:group "mult_of R" rewrites "([^]\<^bsub>mult_of R\<^esub>) = (([^]) :: _ \<Rightarrow> nat \<Rightarrow> _)" and "\<one>\<^bsub>mult_of R\<^esub> = \<one>"
     by (rule field_mult_group) simp_all
 
   from exists
   obtain a where a: "a \<in> carrier (mult_of R)" and ord_a: "group.ord (mult_of R) a = d"
     by (auto simp add: card_gt_0_iff)
 
   have set_eq1: "{a[^]n| n. n \<in> {1 .. d}} = {x \<in> carrier (mult_of R). x [^] d = \<one>}"
   proof (rule card_seteq)
     show "finite {x \<in> carrier (mult_of R). x [^] d = \<one>}" using finite by auto
 
     show "{a[^]n| n. n \<in> {1 ..d}} \<subseteq> {x \<in> carrier (mult_of R). x[^]d = \<one>}"
     proof
       fix x assume "x \<in> {a[^]n | n. n \<in> {1 .. d}}"
       then obtain n where n: "x = a[^]n \<and> n \<in> {1 .. d}" by auto
       have "x[^]d =(a[^]d)[^]n" using n a ord_a by (simp add:nat_pow_pow mult.commute)
       hence "x[^]d = \<one>" using ord_a G.pow_ord_eq_1[OF a] by fastforce
       thus "x \<in> {x \<in> carrier (mult_of R). x[^]d = \<one>}" using G.nat_pow_closed[OF a] n by blast
     qed
 
     show "card {x \<in> carrier (mult_of R). x [^] d = \<one>} \<le> card {a[^]n | n. n \<in> {1 .. d}}"
     proof -
       have *: "{a[^]n | n. n \<in> {1 .. d }} = ((\<lambda> n. a[^]n) ` {1 .. d})" by auto
       have "0 < order (mult_of R)" unfolding order_mult_of[OF finite]
         using card_mono[OF finite, of "{\<zero>, \<one>}"] by (simp add: order_def)
       have "card {x \<in> carrier (mult_of R). x [^] d = \<one>} \<le> card {x \<in> carrier R. x [^] d = \<one>}"
         using finite by (auto intro: card_mono)
       also have "\<dots> \<le> d" using \<open>0 < order (mult_of R)\<close> num_roots_le_deg[OF finite, of d]
         by (simp add : dvd_pos_nat[OF _ \<open>d dvd order (mult_of R)\<close>])
       finally show ?thesis using G.ord_inj'[OF a] ord_a * by (simp add: card_image)
     qed
   qed
 
   have set_eq2: "{x \<in> carrier (mult_of R) . group.ord (mult_of R) x = d}
                 = (\<lambda> n . a[^]n) ` {n \<in> {1 .. d}. group.ord (mult_of R) (a[^]n) = d}" (is "?L = ?R")
   proof
     { fix x assume x: "x \<in> (carrier (mult_of R)) \<and> group.ord (mult_of R) x = d"
       hence "x \<in> {x \<in> carrier (mult_of R). x [^] d = \<one>}"
         by (simp add: G.pow_ord_eq_1[of x, symmetric])
       then obtain n where n: "x = a[^]n \<and> n \<in> {1 .. d}" using set_eq1 by blast
       hence "x \<in> ?R" using x by fast
     } thus "?L \<subseteq> ?R" by blast
     show "?R \<subseteq> ?L" using a by (auto simp add: carrier_mult_of[symmetric] simp del: carrier_mult_of)
   qed
   have "inj_on (\<lambda> n . a[^]n) {n \<in> {1 .. d}. group.ord (mult_of R) (a[^]n) = d}"
     using G.ord_inj'[OF a, unfolded ord_a] unfolding inj_on_def by fast
   hence "card ((\<lambda>n. a[^]n) ` {n \<in> {1 .. d}. group.ord (mult_of R) (a[^]n) = d})
          = card {k \<in> {1 .. d}. group.ord (mult_of R) (a[^]k) = d}"
          using card_image by blast
   thus ?thesis using set_eq2 G.pow_ord_eq_ord_iff[OF finite' \<open>a \<in> _\<close>, unfolded ord_a]
     by (simp add: phi'_def)
 qed
 
 end
 
 
 theorem (in field) finite_field_mult_group_has_gen :
   assumes finite: "finite (carrier R)"
   shows "\<exists> a \<in> carrier (mult_of R) . carrier (mult_of R) = {a[^]i | i::nat . i \<in> UNIV}"
 proof -
   note mult_of_simps[simp]
   have finite': "finite (carrier (mult_of R))" using finite by (rule finite_mult_of)
 
   interpret G: group "mult_of R" rewrites
       "([^]\<^bsub>mult_of R\<^esub>) = (([^]) :: _ \<Rightarrow> nat \<Rightarrow> _)" and "\<one>\<^bsub>mult_of R\<^esub> = \<one>"
     by (rule field_mult_group) (simp_all add: fun_eq_iff nat_pow_def)
 
   let ?N = "\<lambda> x . card {a \<in> carrier (mult_of R). group.ord (mult_of R) a  = x}"
   have "0 < order R - 1" unfolding order_def using card_mono[OF finite, of "{\<zero>, \<one>}"] by simp
   then have *: "0 < order (mult_of R)" using assms by (simp add: order_mult_of)
   have fin: "finite {d. d dvd order (mult_of R) }" using dvd_nat_bounds[OF *] by force
 
   have "(\<Sum>d | d dvd order (mult_of R). ?N d)
       = card (UN d:{d . d dvd order (mult_of R) }. {a \<in> carrier (mult_of R). group.ord (mult_of R) a  = d})"
       (is "_ = card ?U")
     using fin finite by (subst card_UN_disjoint) auto
   also have "?U = carrier (mult_of R)"
   proof
     { fix x assume x: "x \<in> carrier (mult_of R)"
       hence x': "x\<in>carrier (mult_of R)" by simp
       then have "group.ord (mult_of R) x dvd order (mult_of R)"
         using G.ord_dvd_group_order by blast
       hence "x \<in> ?U" using dvd_nat_bounds[of "order (mult_of R)" "group.ord (mult_of R) x"] x by blast
     } thus "carrier (mult_of R) \<subseteq> ?U" by blast
   qed auto
   also have "card ... = order (mult_of R)"
     using order_mult_of finite' by (simp add: order_def)
   finally have sum_Ns_eq: "(\<Sum>d | d dvd order (mult_of R). ?N d) = order (mult_of R)" .
 
   { fix d assume d: "d dvd order (mult_of R)"
     have "card {a \<in> carrier (mult_of R). group.ord (mult_of R) a = d} \<le> phi' d"
     proof cases
       assume "card {a \<in> carrier (mult_of R). group.ord (mult_of R) a = d} = 0" thus ?thesis by presburger
       next
       assume "card {a \<in> carrier (mult_of R). group.ord (mult_of R) a = d} \<noteq> 0"
       hence "\<exists>a \<in> carrier (mult_of R). group.ord (mult_of R) a = d" by (auto simp: card_eq_0_iff)
       thus ?thesis using num_elems_of_ord_eq_phi'[OF finite d] by auto
     qed
   }
   hence all_le: "\<And>i. i \<in> {d. d dvd order (mult_of R) }
         \<Longrightarrow> (\<lambda>i. card {a \<in> carrier (mult_of R). group.ord (mult_of R) a = i}) i \<le> (\<lambda>i. phi' i) i" by fast
   hence le: "(\<Sum>i | i dvd order (mult_of R). ?N i)
             \<le> (\<Sum>i | i dvd order (mult_of R). phi' i)"
             using sum_mono[of "{d .  d dvd order (mult_of R)}"
                   "\<lambda>i. card {a \<in> carrier (mult_of R). group.ord (mult_of R) a = i}"] by presburger
   have "order (mult_of R) = (\<Sum>d | d dvd order (mult_of R). phi' d)" using *
     by (simp add: sum_phi'_factors)
   hence eq: "(\<Sum>i | i dvd order (mult_of R). ?N i)
           = (\<Sum>i | i dvd order (mult_of R). phi' i)" using le sum_Ns_eq by presburger
   have "\<And>i. i \<in> {d. d dvd order (mult_of R) } \<Longrightarrow> ?N i = (\<lambda>i. phi' i) i"
   proof (rule ccontr)
     fix i
     assume i1: "i \<in> {d. d dvd order (mult_of R)}" and "?N i \<noteq> phi' i"
     hence "?N i = 0"
       using num_elems_of_ord_eq_phi'[OF finite, of i] by (auto simp: card_eq_0_iff)
     moreover  have "0 < i" using * i1 by (simp add: dvd_nat_bounds[of "order (mult_of R)" i])
     ultimately have "?N i < phi' i" using phi'_nonzero by presburger
     hence "(\<Sum>i | i dvd order (mult_of R). ?N i)
          < (\<Sum>i | i dvd order (mult_of R). phi' i)"
       using sum_strict_mono_ex1[OF fin, of "?N" "\<lambda> i . phi' i"]
             i1 all_le by auto
     thus False using eq by force
   qed
   hence "?N (order (mult_of R)) > 0" using * by (simp add: phi'_nonzero)
   then obtain a where a: "a \<in> carrier (mult_of R)" and a_ord: "group.ord (mult_of R) a = order (mult_of R)"
     by (auto simp add: card_gt_0_iff)
   hence set_eq: "{a[^]i | i::nat. i \<in> UNIV} = (\<lambda>x. a[^]x) ` {0 .. group.ord (mult_of R) a - 1}"
     using G.ord_elems[OF finite'] by auto
   have card_eq: "card ((\<lambda>x. a[^]x) ` {0 .. group.ord (mult_of R) a - 1}) = card {0 .. group.ord (mult_of R) a - 1}"
     by (intro card_image G.ord_inj finite' a)
   hence "card ((\<lambda> x . a[^]x) ` {0 .. group.ord (mult_of R) a - 1}) = card {0 ..order (mult_of R) - 1}"
     using assms by (simp add: card_eq a_ord)
   hence card_R_minus_1: "card {a[^]i | i::nat. i \<in> UNIV} =  order (mult_of R)"
     using * by (subst set_eq) auto
   have **: "{a[^]i | i::nat. i \<in> UNIV} \<subseteq> carrier (mult_of R)"
     using G.nat_pow_closed[OF a] by auto
   with _ have "carrier (mult_of R) = {a[^]i|i::nat. i \<in> UNIV}"
     by (rule card_seteq[symmetric]) (simp_all add: card_R_minus_1 finite order_def del: UNIV_I)
   thus ?thesis using a by blast
 qed
 
 end
diff --git a/src/HOL/Algebra/Sylow.thy b/src/HOL/Algebra/Sylow.thy
--- a/src/HOL/Algebra/Sylow.thy
+++ b/src/HOL/Algebra/Sylow.thy
@@ -1,355 +1,355 @@
 (*  Title:      HOL/Algebra/Sylow.thy
     Author:     Florian Kammueller, with new proofs by L C Paulson
 *)
 
 theory Sylow
   imports Coset Exponent
 begin
 
-text \<open>See also @{cite "Kammueller-Paulson:1999"}.\<close>
+text \<open>See also \<^cite>\<open>"Kammueller-Paulson:1999"\<close>.\<close>
 
 text \<open>The combinatorial argument is in theory \<open>Exponent\<close>.\<close>
 
 lemma le_extend_mult: "\<lbrakk>0 < c; a \<le> b\<rbrakk> \<Longrightarrow> a \<le> b * c"
   for c :: nat
   by (metis divisors_zero dvd_triv_left leI less_le_trans nat_dvd_not_less zero_less_iff_neq_zero)
 
 locale sylow = group +
   fixes p and a and m and calM and RelM
   assumes prime_p: "prime p"
     and order_G: "order G = (p^a) * m"
     and finite_G[iff]: "finite (carrier G)"
   defines "calM \<equiv> {s. s \<subseteq> carrier G \<and> card s = p^a}"
     and "RelM \<equiv> {(N1, N2). N1 \<in> calM \<and> N2 \<in> calM \<and> (\<exists>g \<in> carrier G. N1 = N2 #> g)}"
 begin
 
 lemma RelM_refl_on: "refl_on calM RelM"
   by (auto simp: refl_on_def RelM_def calM_def) (blast intro!: coset_mult_one [symmetric])
 
 lemma RelM_sym: "sym RelM"
 proof (unfold sym_def RelM_def, clarify)
   fix y g
   assume "y \<in> calM"
     and g: "g \<in> carrier G"
   then have "y = y #> g #> (inv g)"
     by (simp add: coset_mult_assoc calM_def)
   then show "\<exists>g'\<in>carrier G. y = y #> g #> g'"
     by (blast intro: g)
 qed
 
 lemma RelM_trans: "trans RelM"
   by (auto simp add: trans_def RelM_def calM_def coset_mult_assoc)
 
 lemma RelM_equiv: "equiv calM RelM"
   unfolding equiv_def by (blast intro: RelM_refl_on RelM_sym RelM_trans)
 
 lemma M_subset_calM_prep: "M' \<in> calM // RelM  \<Longrightarrow> M' \<subseteq> calM"
   unfolding RelM_def by (blast elim!: quotientE)
 
 end
 
 subsection \<open>Main Part of the Proof\<close>
 
 locale sylow_central = sylow +
   fixes H and M1 and M
   assumes M_in_quot: "M \<in> calM // RelM"
     and not_dvd_M: "\<not> (p ^ Suc (multiplicity p m) dvd card M)"
     and M1_in_M: "M1 \<in> M"
   defines "H \<equiv> {g. g \<in> carrier G \<and> M1 #> g = M1}"
 begin
 
 lemma M_subset_calM: "M \<subseteq> calM"
   by (rule M_in_quot [THEN M_subset_calM_prep])
 
 lemma card_M1: "card M1 = p^a"
   using M1_in_M M_subset_calM calM_def by blast
 
 lemma exists_x_in_M1: "\<exists>x. x \<in> M1"
   using prime_p [THEN prime_gt_Suc_0_nat] card_M1
   by (metis Suc_lessD card_eq_0_iff empty_subsetI equalityI gr_implies_not0 nat_zero_less_power_iff subsetI)
 
 lemma M1_subset_G [simp]: "M1 \<subseteq> carrier G"
   using M1_in_M M_subset_calM calM_def mem_Collect_eq subsetCE by blast
 
 lemma M1_inj_H: "\<exists>f \<in> H\<rightarrow>M1. inj_on f H"
 proof -
   from exists_x_in_M1 obtain m1 where m1M: "m1 \<in> M1"..
   have m1: "m1 \<in> carrier G"
     by (simp add: m1M M1_subset_G [THEN subsetD])
   show ?thesis
   proof
     show "inj_on (\<lambda>z\<in>H. m1 \<otimes> z) H"
       by (simp add: H_def inj_on_def m1)
     show "restrict ((\<otimes>) m1) H \<in> H \<rightarrow> M1"
     proof (rule restrictI)
       fix z
       assume zH: "z \<in> H"
       show "m1 \<otimes> z \<in> M1"
       proof -
         from zH
         have zG: "z \<in> carrier G" and M1zeq: "M1 #> z = M1"
           by (auto simp add: H_def)
         show ?thesis
           by (rule subst [OF M1zeq]) (simp add: m1M zG rcosI)
       qed
     qed
   qed
 qed
 
 end
 
 
 subsection \<open>Discharging the Assumptions of \<open>sylow_central\<close>\<close>
 
 context sylow
 begin
 
 lemma EmptyNotInEquivSet: "{} \<notin> calM // RelM"
   by (blast elim!: quotientE dest: RelM_equiv [THEN equiv_class_self])
 
 lemma existsM1inM: "M \<in> calM // RelM \<Longrightarrow> \<exists>M1. M1 \<in> M"
   using RelM_equiv equiv_Eps_in by blast
 
 lemma zero_less_o_G: "0 < order G"
   by (simp add: order_def card_gt_0_iff carrier_not_empty)
 
 lemma zero_less_m: "m > 0"
   using zero_less_o_G by (simp add: order_G)
 
 lemma card_calM: "card calM = (p^a) * m choose p^a"
   by (simp add: calM_def n_subsets order_G [symmetric] order_def)
 
 lemma zero_less_card_calM: "card calM > 0"
   by (simp add: card_calM zero_less_binomial le_extend_mult zero_less_m)
 
 lemma max_p_div_calM: "\<not> (p ^ Suc (multiplicity p m) dvd card calM)"
 proof
   assume "p ^ Suc (multiplicity p m) dvd card calM"
   with zero_less_card_calM prime_p
   have "Suc (multiplicity p m) \<le> multiplicity p (card calM)"
     by (intro multiplicity_geI) auto
   then have "multiplicity p m < multiplicity p (card calM)" by simp
   also have "multiplicity p m = multiplicity p (card calM)"
     by (simp add: const_p_fac prime_p zero_less_m card_calM)
   finally show False by simp
 qed
 
 lemma finite_calM: "finite calM"
   unfolding calM_def by (rule finite_subset [where B = "Pow (carrier G)"]) auto
 
 lemma lemma_A1: "\<exists>M \<in> calM // RelM. \<not> (p ^ Suc (multiplicity p m) dvd card M)"
   using RelM_equiv equiv_imp_dvd_card finite_calM max_p_div_calM by blast
 
 end
 
 
 subsubsection \<open>Introduction and Destruct Rules for \<open>H\<close>\<close>
 
 context sylow_central
 begin
 
 lemma H_I: "\<lbrakk>g \<in> carrier G; M1 #> g = M1\<rbrakk> \<Longrightarrow> g \<in> H"
   by (simp add: H_def)
 
 lemma H_into_carrier_G: "x \<in> H \<Longrightarrow> x \<in> carrier G"
   by (simp add: H_def)
 
 lemma in_H_imp_eq: "g \<in> H \<Longrightarrow> M1 #> g = M1"
   by (simp add: H_def)
 
 lemma H_m_closed: "\<lbrakk>x \<in> H; y \<in> H\<rbrakk> \<Longrightarrow> x \<otimes> y \<in> H"
   by (simp add: H_def coset_mult_assoc [symmetric])
 
 lemma H_not_empty: "H \<noteq> {}"
   by (force simp add: H_def intro: exI [of _ \<one>])
 
 lemma H_is_subgroup: "subgroup H G"
 proof (rule subgroupI)
   show "H \<subseteq> carrier G"
     using H_into_carrier_G by blast
   show "\<And>a. a \<in> H \<Longrightarrow> inv a \<in> H"
     by (metis H_I H_into_carrier_G H_m_closed M1_subset_G Units_eq Units_inv_closed Units_inv_inv coset_mult_inv1 in_H_imp_eq)
   show "\<And>a b. \<lbrakk>a \<in> H; b \<in> H\<rbrakk> \<Longrightarrow> a \<otimes> b \<in> H"
     by (blast intro: H_m_closed)
 qed (use H_not_empty in auto)
 
 lemma rcosetGM1g_subset_G: "\<lbrakk>g \<in> carrier G; x \<in> M1 #> g\<rbrakk> \<Longrightarrow> x \<in> carrier G"
   by (blast intro: M1_subset_G [THEN r_coset_subset_G, THEN subsetD])
 
 lemma finite_M1: "finite M1"
   by (rule finite_subset [OF M1_subset_G finite_G])
 
 lemma finite_rcosetGM1g: "g \<in> carrier G \<Longrightarrow> finite (M1 #> g)"
   using rcosetGM1g_subset_G finite_G M1_subset_G cosets_finite rcosetsI by blast
 
 lemma M1_cardeq_rcosetGM1g: "g \<in> carrier G \<Longrightarrow> card (M1 #> g) = card M1"
   by (metis M1_subset_G card_rcosets_equal rcosetsI)
 
 lemma M1_RelM_rcosetGM1g: 
   assumes "g \<in> carrier G"
   shows "(M1, M1 #> g) \<in> RelM"
 proof -
   have "M1 #> g \<subseteq> carrier G"
     by (simp add: assms r_coset_subset_G)
   moreover have "card (M1 #> g) = p ^ a"
     using assms by (simp add: card_M1 M1_cardeq_rcosetGM1g)
   moreover have "\<exists>h\<in>carrier G. M1 = M1 #> g #> h"
     by (metis assms M1_subset_G coset_mult_assoc coset_mult_one r_inv_ex)
   ultimately show ?thesis
     by (simp add: RelM_def calM_def card_M1)
 qed
 
 end
 
 
 subsection \<open>Equal Cardinalities of \<open>M\<close> and the Set of Cosets\<close>
 
 text \<open>Injections between \<^term>\<open>M\<close> and \<^term>\<open>rcosets\<^bsub>G\<^esub> H\<close> show that
  their cardinalities are equal.\<close>
 
 lemma ElemClassEquiv: "\<lbrakk>equiv A r; C \<in> A // r\<rbrakk> \<Longrightarrow> \<forall>x \<in> C. \<forall>y \<in> C. (x, y) \<in> r"
   unfolding equiv_def quotient_def sym_def trans_def by blast
 
 context sylow_central
 begin
 
 lemma M_elem_map: "M2 \<in> M \<Longrightarrow> \<exists>g. g \<in> carrier G \<and> M1 #> g = M2"
   using M1_in_M M_in_quot [THEN RelM_equiv [THEN ElemClassEquiv]]
   by (simp add: RelM_def) (blast dest!: bspec)
 
 lemmas M_elem_map_carrier = M_elem_map [THEN someI_ex, THEN conjunct1]
 
 lemmas M_elem_map_eq = M_elem_map [THEN someI_ex, THEN conjunct2]
 
 lemma M_funcset_rcosets_H:
   "(\<lambda>x\<in>M. H #> (SOME g. g \<in> carrier G \<and> M1 #> g = x)) \<in> M \<rightarrow> rcosets H"
   by (metis (lifting) H_is_subgroup M_elem_map_carrier rcosetsI restrictI subgroup.subset)
 
 lemma inj_M_GmodH: "\<exists>f \<in> M \<rightarrow> rcosets H. inj_on f M"
 proof
   let ?inv = "\<lambda>x. SOME g. g \<in> carrier G \<and> M1 #> g = x"
   show "inj_on (\<lambda>x\<in>M. H #> ?inv x) M"
   proof (rule inj_onI, simp)
     fix x y
     assume eq: "H #> ?inv x = H #> ?inv y" and xy: "x \<in> M" "y \<in> M"
     have "x = M1 #> ?inv x"
       by (simp add: M_elem_map_eq \<open>x \<in> M\<close>)
     also have "... = M1 #> ?inv y"
     proof (rule coset_mult_inv1 [OF in_H_imp_eq [OF coset_join1]])
       show "H #> ?inv x \<otimes> inv (?inv y) = H"
         by (simp add: H_into_carrier_G M_elem_map_carrier xy coset_mult_inv2 eq subsetI)
     qed (simp_all add: H_is_subgroup M_elem_map_carrier xy)
     also have "... = y"
       using M_elem_map_eq \<open>y \<in> M\<close> by simp
     finally show "x=y" .
   qed
   show "(\<lambda>x\<in>M. H #> ?inv x) \<in> M \<rightarrow> rcosets H"
     by (rule M_funcset_rcosets_H)
 qed
 
 end
 
 
 subsubsection \<open>The Opposite Injection\<close>
 
 context sylow_central
 begin
 
 lemma H_elem_map: "H1 \<in> rcosets H \<Longrightarrow> \<exists>g. g \<in> carrier G \<and> H #> g = H1"
   by (auto simp: RCOSETS_def)
 
 lemmas H_elem_map_carrier = H_elem_map [THEN someI_ex, THEN conjunct1]
 
 lemmas H_elem_map_eq = H_elem_map [THEN someI_ex, THEN conjunct2]
 
 lemma rcosets_H_funcset_M:
   "(\<lambda>C \<in> rcosets H. M1 #> (SOME g. g \<in> carrier G \<and> H #> g = C)) \<in> rcosets H \<rightarrow> M"
   using in_quotient_imp_closed [OF RelM_equiv M_in_quot _  M1_RelM_rcosetGM1g]
   by (simp add: M1_in_M H_elem_map_carrier RCOSETS_def)
 
 lemma inj_GmodH_M: "\<exists>g \<in> rcosets H\<rightarrow>M. inj_on g (rcosets H)"
 proof
   let ?inv = "\<lambda>x. SOME g. g \<in> carrier G \<and> H #> g = x"
   show "inj_on (\<lambda>C\<in>rcosets H. M1 #> ?inv C) (rcosets H)"
   proof (rule inj_onI, simp)
     fix x y
     assume eq: "M1 #> ?inv x = M1 #> ?inv y" and xy: "x \<in> rcosets H" "y \<in> rcosets H"
     have "x = H #> ?inv x"
       by (simp add: H_elem_map_eq \<open>x \<in> rcosets H\<close>)
     also have "... = H #> ?inv y"
     proof (rule coset_mult_inv1 [OF coset_join2])
       show "?inv x \<otimes> inv (?inv y) \<in> carrier G"
         by (simp add: H_elem_map_carrier \<open>x \<in> rcosets H\<close> \<open>y \<in> rcosets H\<close>)
       then show "(?inv x) \<otimes> inv (?inv y) \<in> H"
         by (simp add: H_I H_elem_map_carrier xy coset_mult_inv2 eq)
       show "H \<subseteq> carrier G"
         by (simp add: H_is_subgroup subgroup.subset)
     qed (simp_all add: H_is_subgroup H_elem_map_carrier xy)
     also have "... = y"
       by (simp add: H_elem_map_eq \<open>y \<in> rcosets H\<close>)
     finally show "x=y" .
   qed
   show "(\<lambda>C\<in>rcosets H. M1 #> ?inv C) \<in> rcosets H \<rightarrow> M"
     using rcosets_H_funcset_M by blast
 qed
 
 lemma calM_subset_PowG: "calM \<subseteq> Pow (carrier G)"
   by (auto simp: calM_def)
 
 
 lemma finite_M: "finite M"
   by (metis M_subset_calM finite_calM rev_finite_subset)
 
 lemma cardMeqIndexH: "card M = card (rcosets H)"
   using inj_M_GmodH inj_GmodH_M
   by (blast intro: card_bij finite_M H_is_subgroup rcosets_subset_PowG [THEN finite_subset])
 
 lemma index_lem: "card M * card H = order G"
   by (simp add: cardMeqIndexH lagrange H_is_subgroup)
 
 lemma card_H_eq: "card H = p^a"
 proof (rule antisym)
   show "p^a \<le> card H"
   proof (rule dvd_imp_le)
     show "p ^ a dvd card H"
       apply (rule div_combine [OF prime_imp_prime_elem[OF prime_p] not_dvd_M])
       by (simp add: index_lem multiplicity_dvd order_G power_add)
     show "0 < card H"
       by (blast intro: subgroup.finite_imp_card_positive H_is_subgroup)
   qed
 next
   show "card H \<le> p^a"
     using M1_inj_H card_M1 card_inj finite_M1 by fastforce
 qed
 
 end
 
 lemma (in sylow) sylow_thm: "\<exists>H. subgroup H G \<and> card H = p^a"
 proof -
   obtain M where M: "M \<in> calM // RelM" "\<not> (p ^ Suc (multiplicity p m) dvd card M)"
     using lemma_A1 by blast
   then obtain M1 where "M1 \<in> M"
     by (metis existsM1inM) 
   define H where "H \<equiv> {g. g \<in> carrier G \<and> M1 #> g = M1}"
   with M \<open>M1 \<in> M\<close>
   interpret sylow_central G p a m calM RelM H M1 M
     by unfold_locales (auto simp add: H_def calM_def RelM_def)
   show ?thesis
     using H_is_subgroup card_H_eq by blast
 qed
 
 text \<open>Needed because the locale's automatic definition refers to
   \<^term>\<open>semigroup G\<close> and \<^term>\<open>group_axioms G\<close> rather than
   simply to \<^term>\<open>group G\<close>.\<close>
 lemma sylow_eq: "sylow G p a m \<longleftrightarrow> group G \<and> sylow_axioms G p a m"
   by (simp add: sylow_def group_def)
 
 
 subsection \<open>Sylow's Theorem\<close>
 
 theorem sylow_thm:
   "\<lbrakk>prime p; group G; order G = (p^a) * m; finite (carrier G)\<rbrakk>
     \<Longrightarrow> \<exists>H. subgroup H G \<and> card H = p^a"
   by (rule sylow.sylow_thm [of G p a m]) (simp add: sylow_eq sylow_axioms_def)
 
 end
diff --git a/src/HOL/Algebra/UnivPoly.thy b/src/HOL/Algebra/UnivPoly.thy
--- a/src/HOL/Algebra/UnivPoly.thy
+++ b/src/HOL/Algebra/UnivPoly.thy
@@ -1,1839 +1,1839 @@
 (*  Title:      HOL/Algebra/UnivPoly.thy
     Author:     Clemens Ballarin, started 9 December 1996
     Copyright:  Clemens Ballarin
 
 Contributions, in particular on long division, by Jesus Aransay.
 *)
 
 theory UnivPoly
 imports Module RingHom
 begin
 
 section \<open>Univariate Polynomials\<close>
 
 text \<open>
   Polynomials are formalised as modules with additional operations for
   extracting coefficients from polynomials and for obtaining monomials
   from coefficients and exponents (record \<open>up_ring\<close>).  The
   carrier set is a set of bounded functions from Nat to the
   coefficient domain.  Bounded means that these functions return zero
   above a certain bound (the degree).  There is a chapter on the
-  formalisation of polynomials in the PhD thesis @{cite "Ballarin:1999"},
+  formalisation of polynomials in the PhD thesis \<^cite>\<open>"Ballarin:1999"\<close>,
   which was implemented with axiomatic type classes.  This was later
   ported to Locales.
 \<close>
 
 
 subsection \<open>The Constructor for Univariate Polynomials\<close>
 
 text \<open>
   Functions with finite support.
 \<close>
 
 locale bound =
   fixes z :: 'a
     and n :: nat
     and f :: "nat => 'a"
   assumes bound: "!!m. n < m \<Longrightarrow> f m = z"
 
 declare bound.intro [intro!]
   and bound.bound [dest]
 
 lemma bound_below:
   assumes bound: "bound z m f" and nonzero: "f n \<noteq> z" shows "n \<le> m"
 proof (rule classical)
   assume "\<not> ?thesis"
   then have "m < n" by arith
   with bound have "f n = z" ..
   with nonzero show ?thesis by contradiction
 qed
 
 record ('a, 'p) up_ring = "('a, 'p) module" +
   monom :: "['a, nat] => 'p"
   coeff :: "['p, nat] => 'a"
 
 definition
   up :: "('a, 'm) ring_scheme => (nat => 'a) set"
   where "up R = {f. f \<in> UNIV \<rightarrow> carrier R \<and> (\<exists>n. bound \<zero>\<^bsub>R\<^esub> n f)}"
 
 definition UP :: "('a, 'm) ring_scheme => ('a, nat => 'a) up_ring"
   where "UP R = \<lparr>
    carrier = up R,
    mult = (\<lambda>p\<in>up R. \<lambda>q\<in>up R. \<lambda>n. \<Oplus>\<^bsub>R\<^esub>i \<in> {..n}. p i \<otimes>\<^bsub>R\<^esub> q (n-i)),
    one = (\<lambda>i. if i=0 then \<one>\<^bsub>R\<^esub> else \<zero>\<^bsub>R\<^esub>),
    zero = (\<lambda>i. \<zero>\<^bsub>R\<^esub>),
    add = (\<lambda>p\<in>up R. \<lambda>q\<in>up R. \<lambda>i. p i \<oplus>\<^bsub>R\<^esub> q i),
    smult = (\<lambda>a\<in>carrier R. \<lambda>p\<in>up R. \<lambda>i. a \<otimes>\<^bsub>R\<^esub> p i),
    monom = (\<lambda>a\<in>carrier R. \<lambda>n i. if i=n then a else \<zero>\<^bsub>R\<^esub>),
    coeff = (\<lambda>p\<in>up R. \<lambda>n. p n)\<rparr>"
 
 text \<open>
   Properties of the set of polynomials \<^term>\<open>up\<close>.
 \<close>
 
 lemma mem_upI [intro]:
   "[| \<And>n. f n \<in> carrier R; \<exists>n. bound (zero R) n f |] ==> f \<in> up R"
   by (simp add: up_def Pi_def)
 
 lemma mem_upD [dest]:
   "f \<in> up R ==> f n \<in> carrier R"
   by (simp add: up_def Pi_def)
 
 context ring
 begin
 
 lemma bound_upD [dest]: "f \<in> up R \<Longrightarrow> \<exists>n. bound \<zero> n f" by (simp add: up_def)
 
 lemma up_one_closed: "(\<lambda>n. if n = 0 then \<one> else \<zero>) \<in> up R" using up_def by force
 
 lemma up_smult_closed: "[| a \<in> carrier R; p \<in> up R |] ==> (\<lambda>i. a \<otimes> p i) \<in> up R" by force
 
 lemma up_add_closed:
   "[| p \<in> up R; q \<in> up R |] ==> (\<lambda>i. p i \<oplus> q i) \<in> up R"
 proof
   fix n
   assume "p \<in> up R" and "q \<in> up R"
   then show "p n \<oplus> q n \<in> carrier R"
     by auto
 next
   assume UP: "p \<in> up R" "q \<in> up R"
   show "\<exists>n. bound \<zero> n (\<lambda>i. p i \<oplus> q i)"
   proof -
     from UP obtain n where boundn: "bound \<zero> n p" by fast
     from UP obtain m where boundm: "bound \<zero> m q" by fast
     have "bound \<zero> (max n m) (\<lambda>i. p i \<oplus> q i)"
     proof
       fix i
       assume "max n m < i"
       with boundn and boundm and UP show "p i \<oplus> q i = \<zero>" by fastforce
     qed
     then show ?thesis ..
   qed
 qed
 
 lemma up_a_inv_closed:
   "p \<in> up R ==> (\<lambda>i. \<ominus> (p i)) \<in> up R"
 proof
   assume R: "p \<in> up R"
   then obtain n where "bound \<zero> n p" by auto
   then have "bound \<zero> n (\<lambda>i. \<ominus> p i)"
     by (simp add: bound_def minus_equality)
   then show "\<exists>n. bound \<zero> n (\<lambda>i. \<ominus> p i)" by auto
 qed auto
 
 lemma up_minus_closed:
   "[| p \<in> up R; q \<in> up R |] ==> (\<lambda>i. p i \<ominus> q i) \<in> up R"
   unfolding a_minus_def
   using mem_upD [of p R] mem_upD [of q R] up_add_closed up_a_inv_closed  by auto
 
 lemma up_mult_closed:
   "[| p \<in> up R; q \<in> up R |] ==>
   (\<lambda>n. \<Oplus>i \<in> {..n}. p i \<otimes> q (n-i)) \<in> up R"
 proof
   fix n
   assume "p \<in> up R" "q \<in> up R"
   then show "(\<Oplus>i \<in> {..n}. p i \<otimes> q (n-i)) \<in> carrier R"
     by (simp add: mem_upD  funcsetI)
 next
   assume UP: "p \<in> up R" "q \<in> up R"
   show "\<exists>n. bound \<zero> n (\<lambda>n. \<Oplus>i \<in> {..n}. p i \<otimes> q (n-i))"
   proof -
     from UP obtain n where boundn: "bound \<zero> n p" by fast
     from UP obtain m where boundm: "bound \<zero> m q" by fast
     have "bound \<zero> (n + m) (\<lambda>n. \<Oplus>i \<in> {..n}. p i \<otimes> q (n - i))"
     proof
       fix k assume bound: "n + m < k"
       {
         fix i
         have "p i \<otimes> q (k-i) = \<zero>"
         proof (cases "n < i")
           case True
           with boundn have "p i = \<zero>" by auto
           moreover from UP have "q (k-i) \<in> carrier R" by auto
           ultimately show ?thesis by simp
         next
           case False
           with bound have "m < k-i" by arith
           with boundm have "q (k-i) = \<zero>" by auto
           moreover from UP have "p i \<in> carrier R" by auto
           ultimately show ?thesis by simp
         qed
       }
       then show "(\<Oplus>i \<in> {..k}. p i \<otimes> q (k-i)) = \<zero>"
         by (simp add: Pi_def)
     qed
     then show ?thesis by fast
   qed
 qed
 
 end
 
 
 subsection \<open>Effect of Operations on Coefficients\<close>
 
 locale UP =
   fixes R (structure) and P (structure)
   defines P_def: "P == UP R"
 
 locale UP_ring = UP + R?: ring R
 
 locale UP_cring = UP + R?: cring R
 
 sublocale UP_cring < UP_ring
   by intro_locales [1] (rule P_def)
 
 locale UP_domain = UP + R?: "domain" R
 
 sublocale UP_domain < UP_cring
   by intro_locales [1] (rule P_def)
 
 context UP
 begin
 
 text \<open>Temporarily declare @{thm P_def} as simp rule.\<close>
 
 declare P_def [simp]
 
 lemma up_eqI:
   assumes prem: "!!n. coeff P p n = coeff P q n" and R: "p \<in> carrier P" "q \<in> carrier P"
   shows "p = q"
 proof
   fix x
   from prem and R show "p x = q x" by (simp add: UP_def)
 qed
 
 lemma coeff_closed [simp]:
   "p \<in> carrier P ==> coeff P p n \<in> carrier R" by (auto simp add: UP_def)
 
 end
 
 context UP_ring
 begin
 
 (* Theorems generalised from commutative rings to rings by Jesus Aransay. *)
 
 lemma coeff_monom [simp]:
   "a \<in> carrier R ==> coeff P (monom P a m) n = (if m=n then a else \<zero>)"
 proof -
   assume R: "a \<in> carrier R"
   then have "(\<lambda>n. if n = m then a else \<zero>) \<in> up R"
     using up_def by force
   with R show ?thesis by (simp add: UP_def)
 qed
 
 lemma coeff_zero [simp]: "coeff P \<zero>\<^bsub>P\<^esub> n = \<zero>" by (auto simp add: UP_def)
 
 lemma coeff_one [simp]: "coeff P \<one>\<^bsub>P\<^esub> n = (if n=0 then \<one> else \<zero>)"
   using up_one_closed by (simp add: UP_def)
 
 lemma coeff_smult [simp]:
   "[| a \<in> carrier R; p \<in> carrier P |] ==> coeff P (a \<odot>\<^bsub>P\<^esub> p) n = a \<otimes> coeff P p n"
   by (simp add: UP_def up_smult_closed)
 
 lemma coeff_add [simp]:
   "[| p \<in> carrier P; q \<in> carrier P |] ==> coeff P (p \<oplus>\<^bsub>P\<^esub> q) n = coeff P p n \<oplus> coeff P q n"
   by (simp add: UP_def up_add_closed)
 
 lemma coeff_mult [simp]:
   "[| p \<in> carrier P; q \<in> carrier P |] ==> coeff P (p \<otimes>\<^bsub>P\<^esub> q) n = (\<Oplus>i \<in> {..n}. coeff P p i \<otimes> coeff P q (n-i))"
   by (simp add: UP_def up_mult_closed)
 
 end
 
 
 subsection \<open>Polynomials Form a Ring.\<close>
 
 context UP_ring
 begin
 
 text \<open>Operations are closed over \<^term>\<open>P\<close>.\<close>
 
 lemma UP_mult_closed [simp]:
   "[| p \<in> carrier P; q \<in> carrier P |] ==> p \<otimes>\<^bsub>P\<^esub> q \<in> carrier P" by (simp add: UP_def up_mult_closed)
 
 lemma UP_one_closed [simp]:
   "\<one>\<^bsub>P\<^esub> \<in> carrier P" by (simp add: UP_def up_one_closed)
 
 lemma UP_zero_closed [intro, simp]:
   "\<zero>\<^bsub>P\<^esub> \<in> carrier P" by (auto simp add: UP_def)
 
 lemma UP_a_closed [intro, simp]:
   "[| p \<in> carrier P; q \<in> carrier P |] ==> p \<oplus>\<^bsub>P\<^esub> q \<in> carrier P" by (simp add: UP_def up_add_closed)
 
 lemma monom_closed [simp]:
   "a \<in> carrier R ==> monom P a n \<in> carrier P" by (auto simp add: UP_def up_def Pi_def)
 
 lemma UP_smult_closed [simp]:
   "[| a \<in> carrier R; p \<in> carrier P |] ==> a \<odot>\<^bsub>P\<^esub> p \<in> carrier P" by (simp add: UP_def up_smult_closed)
 
 end
 
 declare (in UP) P_def [simp del]
 
 text \<open>Algebraic ring properties\<close>
 
 context UP_ring
 begin
 
 lemma UP_a_assoc:
   assumes R: "p \<in> carrier P" "q \<in> carrier P" "r \<in> carrier P"
   shows "(p \<oplus>\<^bsub>P\<^esub> q) \<oplus>\<^bsub>P\<^esub> r = p \<oplus>\<^bsub>P\<^esub> (q \<oplus>\<^bsub>P\<^esub> r)" by (rule up_eqI, simp add: a_assoc R, simp_all add: R)
 
 lemma UP_l_zero [simp]:
   assumes R: "p \<in> carrier P"
   shows "\<zero>\<^bsub>P\<^esub> \<oplus>\<^bsub>P\<^esub> p = p" by (rule up_eqI, simp_all add: R)
 
 lemma UP_l_neg_ex:
   assumes R: "p \<in> carrier P"
   shows "\<exists>q \<in> carrier P. q \<oplus>\<^bsub>P\<^esub> p = \<zero>\<^bsub>P\<^esub>"
 proof -
   let ?q = "\<lambda>i. \<ominus> (p i)"
   from R have closed: "?q \<in> carrier P"
     by (simp add: UP_def P_def up_a_inv_closed)
   from R have coeff: "!!n. coeff P ?q n = \<ominus> (coeff P p n)"
     by (simp add: UP_def P_def up_a_inv_closed)
   show ?thesis
   proof
     show "?q \<oplus>\<^bsub>P\<^esub> p = \<zero>\<^bsub>P\<^esub>"
       by (auto intro!: up_eqI simp add: R closed coeff R.l_neg)
   qed (rule closed)
 qed
 
 lemma UP_a_comm:
   assumes R: "p \<in> carrier P" "q \<in> carrier P"
   shows "p \<oplus>\<^bsub>P\<^esub> q = q \<oplus>\<^bsub>P\<^esub> p" by (rule up_eqI, simp add: a_comm R, simp_all add: R)
 
 lemma UP_m_assoc:
   assumes R: "p \<in> carrier P" "q \<in> carrier P" "r \<in> carrier P"
   shows "(p \<otimes>\<^bsub>P\<^esub> q) \<otimes>\<^bsub>P\<^esub> r = p \<otimes>\<^bsub>P\<^esub> (q \<otimes>\<^bsub>P\<^esub> r)"
 proof (rule up_eqI)
   fix n
   {
     fix k and a b c :: "nat=>'a"
     assume R: "a \<in> UNIV \<rightarrow> carrier R" "b \<in> UNIV \<rightarrow> carrier R"
       "c \<in> UNIV \<rightarrow> carrier R"
     then have "k <= n ==>
       (\<Oplus>j \<in> {..k}. (\<Oplus>i \<in> {..j}. a i \<otimes> b (j-i)) \<otimes> c (n-j)) =
       (\<Oplus>j \<in> {..k}. a j \<otimes> (\<Oplus>i \<in> {..k-j}. b i \<otimes> c (n-j-i)))"
       (is "_ \<Longrightarrow> ?eq k")
     proof (induct k)
       case 0 then show ?case by (simp add: Pi_def m_assoc)
     next
       case (Suc k)
       then have "k <= n" by arith
       from this R have "?eq k" by (rule Suc)
       with R show ?case
         by (simp cong: finsum_cong
              add: Suc_diff_le Pi_def l_distr r_distr m_assoc)
            (simp cong: finsum_cong add: Pi_def a_ac finsum_ldistr m_assoc)
     qed
   }
   with R show "coeff P ((p \<otimes>\<^bsub>P\<^esub> q) \<otimes>\<^bsub>P\<^esub> r) n = coeff P (p \<otimes>\<^bsub>P\<^esub> (q \<otimes>\<^bsub>P\<^esub> r)) n"
     by (simp add: Pi_def)
 qed (simp_all add: R)
 
 lemma UP_r_one [simp]:
   assumes R: "p \<in> carrier P" shows "p \<otimes>\<^bsub>P\<^esub> \<one>\<^bsub>P\<^esub> = p"
 proof (rule up_eqI)
   fix n
   show "coeff P (p \<otimes>\<^bsub>P\<^esub> \<one>\<^bsub>P\<^esub>) n = coeff P p n"
   proof (cases n)
     case 0
     {
       with R show ?thesis by simp
     }
   next
     case Suc
     {
       (*JE: in the locale UP_cring the proof was solved only with "by (simp del: finsum_Suc add: finsum_Suc2 Pi_def)", but I did not get it to work here*)
       fix nn assume Succ: "n = Suc nn"
       have "coeff P (p \<otimes>\<^bsub>P\<^esub> \<one>\<^bsub>P\<^esub>) (Suc nn) = coeff P p (Suc nn)"
       proof -
         have "coeff P (p \<otimes>\<^bsub>P\<^esub> \<one>\<^bsub>P\<^esub>) (Suc nn) = (\<Oplus>i\<in>{..Suc nn}. coeff P p i \<otimes> (if Suc nn \<le> i then \<one> else \<zero>))" using R by simp
         also have "\<dots> = coeff P p (Suc nn) \<otimes> (if Suc nn \<le> Suc nn then \<one> else \<zero>) \<oplus> (\<Oplus>i\<in>{..nn}. coeff P p i \<otimes> (if Suc nn \<le> i then \<one> else \<zero>))"
           using finsum_Suc [of "(\<lambda>i::nat. coeff P p i \<otimes> (if Suc nn \<le> i then \<one> else \<zero>))" "nn"] unfolding Pi_def using R by simp
         also have "\<dots> = coeff P p (Suc nn) \<otimes> (if Suc nn \<le> Suc nn then \<one> else \<zero>)"
         proof -
           have "(\<Oplus>i\<in>{..nn}. coeff P p i \<otimes> (if Suc nn \<le> i then \<one> else \<zero>)) = (\<Oplus>i\<in>{..nn}. \<zero>)"
             using finsum_cong [of "{..nn}" "{..nn}" "(\<lambda>i::nat. coeff P p i \<otimes> (if Suc nn \<le> i then \<one> else \<zero>))" "(\<lambda>i::nat. \<zero>)"] using R
             unfolding Pi_def by simp
           also have "\<dots> = \<zero>" by simp
           finally show ?thesis using r_zero R by simp
         qed
         also have "\<dots> = coeff P p (Suc nn)" using R by simp
         finally show ?thesis by simp
       qed
       then show ?thesis using Succ by simp
     }
   qed
 qed (simp_all add: R)
 
 lemma UP_l_one [simp]:
   assumes R: "p \<in> carrier P"
   shows "\<one>\<^bsub>P\<^esub> \<otimes>\<^bsub>P\<^esub> p = p"
 proof (rule up_eqI)
   fix n
   show "coeff P (\<one>\<^bsub>P\<^esub> \<otimes>\<^bsub>P\<^esub> p) n = coeff P p n"
   proof (cases n)
     case 0 with R show ?thesis by simp
   next
     case Suc with R show ?thesis
       by (simp del: finsum_Suc add: finsum_Suc2 Pi_def)
   qed
 qed (simp_all add: R)
 
 lemma UP_l_distr:
   assumes R: "p \<in> carrier P" "q \<in> carrier P" "r \<in> carrier P"
   shows "(p \<oplus>\<^bsub>P\<^esub> q) \<otimes>\<^bsub>P\<^esub> r = (p \<otimes>\<^bsub>P\<^esub> r) \<oplus>\<^bsub>P\<^esub> (q \<otimes>\<^bsub>P\<^esub> r)"
   by (rule up_eqI) (simp add: l_distr R Pi_def, simp_all add: R)
 
 lemma UP_r_distr:
   assumes R: "p \<in> carrier P" "q \<in> carrier P" "r \<in> carrier P"
   shows "r \<otimes>\<^bsub>P\<^esub> (p \<oplus>\<^bsub>P\<^esub> q) = (r \<otimes>\<^bsub>P\<^esub> p) \<oplus>\<^bsub>P\<^esub> (r \<otimes>\<^bsub>P\<^esub> q)"
   by (rule up_eqI) (simp add: r_distr R Pi_def, simp_all add: R)
 
 theorem UP_ring: "ring P"
   by (auto intro!: ringI abelian_groupI monoidI UP_a_assoc)
     (auto intro: UP_a_comm UP_l_neg_ex UP_m_assoc UP_l_distr UP_r_distr)
 
 end
 
 
 subsection \<open>Polynomials Form a Commutative Ring.\<close>
 
 context UP_cring
 begin
 
 lemma UP_m_comm:
   assumes R1: "p \<in> carrier P" and R2: "q \<in> carrier P" shows "p \<otimes>\<^bsub>P\<^esub> q = q \<otimes>\<^bsub>P\<^esub> p"
 proof (rule up_eqI)
   fix n
   {
     fix k and a b :: "nat=>'a"
     assume R: "a \<in> UNIV \<rightarrow> carrier R" "b \<in> UNIV \<rightarrow> carrier R"
     then have "k <= n ==>
       (\<Oplus>i \<in> {..k}. a i \<otimes> b (n-i)) = (\<Oplus>i \<in> {..k}. a (k-i) \<otimes> b (i+n-k))"
       (is "_ \<Longrightarrow> ?eq k")
     proof (induct k)
       case 0 then show ?case by (simp add: Pi_def)
     next
       case (Suc k) then show ?case
         by (subst (2) finsum_Suc2) (simp add: Pi_def a_comm)+
     qed
   }
   note l = this
   from R1 R2 show "coeff P (p \<otimes>\<^bsub>P\<^esub> q) n =  coeff P (q \<otimes>\<^bsub>P\<^esub> p) n"
     unfolding coeff_mult [OF R1 R2, of n]
     unfolding coeff_mult [OF R2 R1, of n]
     using l [of "(\<lambda>i. coeff P p i)" "(\<lambda>i. coeff P q i)" "n"] by (simp add: Pi_def m_comm)
 qed (simp_all add: R1 R2)
 
 
 subsection \<open>Polynomials over a commutative ring for a commutative ring\<close>
 
 theorem UP_cring:
   "cring P" using UP_ring unfolding cring_def by (auto intro!: comm_monoidI UP_m_assoc UP_m_comm)
 
 end
 
 context UP_ring
 begin
 
 lemma UP_a_inv_closed [intro, simp]:
   "p \<in> carrier P ==> \<ominus>\<^bsub>P\<^esub> p \<in> carrier P"
   by (rule abelian_group.a_inv_closed [OF ring.is_abelian_group [OF UP_ring]])
 
 lemma coeff_a_inv [simp]:
   assumes R: "p \<in> carrier P"
   shows "coeff P (\<ominus>\<^bsub>P\<^esub> p) n = \<ominus> (coeff P p n)"
 proof -
   from R coeff_closed UP_a_inv_closed have
     "coeff P (\<ominus>\<^bsub>P\<^esub> p) n = \<ominus> coeff P p n \<oplus> (coeff P p n \<oplus> coeff P (\<ominus>\<^bsub>P\<^esub> p) n)"
     by algebra
   also from R have "... =  \<ominus> (coeff P p n)"
     by (simp del: coeff_add add: coeff_add [THEN sym]
       abelian_group.r_neg [OF ring.is_abelian_group [OF UP_ring]])
   finally show ?thesis .
 qed
 
 end
 
 sublocale UP_ring < P?: ring P using UP_ring .
 sublocale UP_cring < P?: cring P using UP_cring .
 
 
 subsection \<open>Polynomials Form an Algebra\<close>
 
 context UP_ring
 begin
 
 lemma UP_smult_l_distr:
   "[| a \<in> carrier R; b \<in> carrier R; p \<in> carrier P |] ==>
   (a \<oplus> b) \<odot>\<^bsub>P\<^esub> p = a \<odot>\<^bsub>P\<^esub> p \<oplus>\<^bsub>P\<^esub> b \<odot>\<^bsub>P\<^esub> p"
   by (rule up_eqI) (simp_all add: R.l_distr)
 
 lemma UP_smult_r_distr:
   "[| a \<in> carrier R; p \<in> carrier P; q \<in> carrier P |] ==>
   a \<odot>\<^bsub>P\<^esub> (p \<oplus>\<^bsub>P\<^esub> q) = a \<odot>\<^bsub>P\<^esub> p \<oplus>\<^bsub>P\<^esub> a \<odot>\<^bsub>P\<^esub> q"
   by (rule up_eqI) (simp_all add: R.r_distr)
 
 lemma UP_smult_assoc1:
       "[| a \<in> carrier R; b \<in> carrier R; p \<in> carrier P |] ==>
       (a \<otimes> b) \<odot>\<^bsub>P\<^esub> p = a \<odot>\<^bsub>P\<^esub> (b \<odot>\<^bsub>P\<^esub> p)"
   by (rule up_eqI) (simp_all add: R.m_assoc)
 
 lemma UP_smult_zero [simp]:
       "p \<in> carrier P ==> \<zero> \<odot>\<^bsub>P\<^esub> p = \<zero>\<^bsub>P\<^esub>"
   by (rule up_eqI) simp_all
 
 lemma UP_smult_one [simp]:
       "p \<in> carrier P ==> \<one> \<odot>\<^bsub>P\<^esub> p = p"
   by (rule up_eqI) simp_all
 
 lemma UP_smult_assoc2:
   "[| a \<in> carrier R; p \<in> carrier P; q \<in> carrier P |] ==>
   (a \<odot>\<^bsub>P\<^esub> p) \<otimes>\<^bsub>P\<^esub> q = a \<odot>\<^bsub>P\<^esub> (p \<otimes>\<^bsub>P\<^esub> q)"
   by (rule up_eqI) (simp_all add: R.finsum_rdistr R.m_assoc Pi_def)
 
 end
 
 text \<open>
   Interpretation of lemmas from \<^term>\<open>algebra\<close>.
 \<close>
 
 lemma (in UP_cring) UP_algebra:
   "algebra R P" by (auto intro!: algebraI R.cring_axioms UP_cring UP_smult_l_distr UP_smult_r_distr
     UP_smult_assoc1 UP_smult_assoc2)
 
 sublocale UP_cring < algebra R P using UP_algebra .
 
 
 subsection \<open>Further Lemmas Involving Monomials\<close>
 
 context UP_ring
 begin
 
 lemma monom_zero [simp]:
   "monom P \<zero> n = \<zero>\<^bsub>P\<^esub>" by (simp add: UP_def P_def)
 
 lemma monom_mult_is_smult:
   assumes R: "a \<in> carrier R" "p \<in> carrier P"
   shows "monom P a 0 \<otimes>\<^bsub>P\<^esub> p = a \<odot>\<^bsub>P\<^esub> p"
 proof (rule up_eqI)
   fix n
   show "coeff P (monom P a 0 \<otimes>\<^bsub>P\<^esub> p) n = coeff P (a \<odot>\<^bsub>P\<^esub> p) n"
   proof (cases n)
     case 0 with R show ?thesis by simp
   next
     case Suc with R show ?thesis
       using R.finsum_Suc2 by (simp del: R.finsum_Suc add: Pi_def)
   qed
 qed (simp_all add: R)
 
 lemma monom_one [simp]:
   "monom P \<one> 0 = \<one>\<^bsub>P\<^esub>"
   by (rule up_eqI) simp_all
 
 lemma monom_add [simp]:
   "[| a \<in> carrier R; b \<in> carrier R |] ==>
   monom P (a \<oplus> b) n = monom P a n \<oplus>\<^bsub>P\<^esub> monom P b n"
   by (rule up_eqI) simp_all
 
 lemma monom_one_Suc:
   "monom P \<one> (Suc n) = monom P \<one> n \<otimes>\<^bsub>P\<^esub> monom P \<one> 1"
 proof (rule up_eqI)
   fix k
   show "coeff P (monom P \<one> (Suc n)) k = coeff P (monom P \<one> n \<otimes>\<^bsub>P\<^esub> monom P \<one> 1) k"
   proof (cases "k = Suc n")
     case True show ?thesis
     proof -
       fix m
       from True have less_add_diff:
         "!!i. [| n < i; i <= n + m |] ==> n + m - i < m" by arith
       from True have "coeff P (monom P \<one> (Suc n)) k = \<one>" by simp
       also from True
       have "... = (\<Oplus>i \<in> {..<n} \<union> {n}. coeff P (monom P \<one> n) i \<otimes>
         coeff P (monom P \<one> 1) (k - i))"
         by (simp cong: R.finsum_cong add: Pi_def)
       also have "... = (\<Oplus>i \<in>  {..n}. coeff P (monom P \<one> n) i \<otimes>
         coeff P (monom P \<one> 1) (k - i))"
         by (simp only: ivl_disj_un_singleton)
       also from True
       have "... = (\<Oplus>i \<in> {..n} \<union> {n<..k}. coeff P (monom P \<one> n) i \<otimes>
         coeff P (monom P \<one> 1) (k - i))"
         by (simp cong: R.finsum_cong add: R.finsum_Un_disjoint ivl_disj_int_one
           order_less_imp_not_eq Pi_def)
       also from True have "... = coeff P (monom P \<one> n \<otimes>\<^bsub>P\<^esub> monom P \<one> 1) k"
         by (simp add: ivl_disj_un_one)
       finally show ?thesis .
     qed
   next
     case False
     note neq = False
     let ?s =
       "\<lambda>i. (if n = i then \<one> else \<zero>) \<otimes> (if Suc 0 = k - i then \<one> else \<zero>)"
     from neq have "coeff P (monom P \<one> (Suc n)) k = \<zero>" by simp
     also have "... = (\<Oplus>i \<in> {..k}. ?s i)"
     proof -
       have f1: "(\<Oplus>i \<in> {..<n}. ?s i) = \<zero>"
         by (simp cong: R.finsum_cong add: Pi_def)
       from neq have f2: "(\<Oplus>i \<in> {n}. ?s i) = \<zero>"
         by (simp cong: R.finsum_cong add: Pi_def) arith
       have f3: "n < k ==> (\<Oplus>i \<in> {n<..k}. ?s i) = \<zero>"
         by (simp cong: R.finsum_cong add: order_less_imp_not_eq Pi_def)
       show ?thesis
       proof (cases "k < n")
         case True then show ?thesis by (simp cong: R.finsum_cong add: Pi_def)
       next
         case False then have n_le_k: "n <= k" by arith
         show ?thesis
         proof (cases "n = k")
           case True
           then have "\<zero> = (\<Oplus>i \<in> {..<n} \<union> {n}. ?s i)"
             by (simp cong: R.finsum_cong add: Pi_def)
           also from True have "... = (\<Oplus>i \<in> {..k}. ?s i)"
             by (simp only: ivl_disj_un_singleton)
           finally show ?thesis .
         next
           case False with n_le_k have n_less_k: "n < k" by arith
           with neq have "\<zero> = (\<Oplus>i \<in> {..<n} \<union> {n}. ?s i)"
             by (simp add: R.finsum_Un_disjoint f1 f2 Pi_def del: Un_insert_right)
           also have "... = (\<Oplus>i \<in> {..n}. ?s i)"
             by (simp only: ivl_disj_un_singleton)
           also from n_less_k neq have "... = (\<Oplus>i \<in> {..n} \<union> {n<..k}. ?s i)"
             by (simp add: R.finsum_Un_disjoint f3 ivl_disj_int_one Pi_def)
           also from n_less_k have "... = (\<Oplus>i \<in> {..k}. ?s i)"
             by (simp only: ivl_disj_un_one)
           finally show ?thesis .
         qed
       qed
     qed
     also have "... = coeff P (monom P \<one> n \<otimes>\<^bsub>P\<^esub> monom P \<one> 1) k" by simp
     finally show ?thesis .
   qed
 qed (simp_all)
 
 lemma monom_one_Suc2:
   "monom P \<one> (Suc n) = monom P \<one> 1 \<otimes>\<^bsub>P\<^esub> monom P \<one> n"
 proof (induct n)
   case 0 show ?case by simp
 next
   case Suc
   {
     fix k:: nat
     assume hypo: "monom P \<one> (Suc k) = monom P \<one> 1 \<otimes>\<^bsub>P\<^esub> monom P \<one> k"
     then show "monom P \<one> (Suc (Suc k)) = monom P \<one> 1 \<otimes>\<^bsub>P\<^esub> monom P \<one> (Suc k)"
     proof -
       have lhs: "monom P \<one> (Suc (Suc k)) = monom P \<one> 1 \<otimes>\<^bsub>P\<^esub> monom P \<one> k \<otimes>\<^bsub>P\<^esub> monom P \<one> 1"
         unfolding monom_one_Suc [of "Suc k"] unfolding hypo ..
       note cl = monom_closed [OF R.one_closed, of 1]
       note clk = monom_closed [OF R.one_closed, of k]
       have rhs: "monom P \<one> 1 \<otimes>\<^bsub>P\<^esub> monom P \<one> (Suc k) = monom P \<one> 1 \<otimes>\<^bsub>P\<^esub> monom P \<one> k \<otimes>\<^bsub>P\<^esub> monom P \<one> 1"
         unfolding monom_one_Suc [of k] unfolding sym [OF m_assoc  [OF cl clk cl]] ..
       from lhs rhs show ?thesis by simp
     qed
   }
 qed
 
 text\<open>The following corollary follows from lemmas @{thm "monom_one_Suc"}
   and @{thm "monom_one_Suc2"}, and is trivial in \<^term>\<open>UP_cring\<close>\<close>
 
 corollary monom_one_comm: shows "monom P \<one> k \<otimes>\<^bsub>P\<^esub> monom P \<one> 1 = monom P \<one> 1 \<otimes>\<^bsub>P\<^esub> monom P \<one> k"
   unfolding monom_one_Suc [symmetric] monom_one_Suc2 [symmetric] ..
 
 lemma monom_mult_smult:
   "[| a \<in> carrier R; b \<in> carrier R |] ==> monom P (a \<otimes> b) n = a \<odot>\<^bsub>P\<^esub> monom P b n"
   by (rule up_eqI) simp_all
 
 lemma monom_one_mult:
   "monom P \<one> (n + m) = monom P \<one> n \<otimes>\<^bsub>P\<^esub> monom P \<one> m"
 proof (induct n)
   case 0 show ?case by simp
 next
   case Suc then show ?case
     unfolding add_Suc unfolding monom_one_Suc unfolding Suc.hyps
     using m_assoc monom_one_comm [of m] by simp
 qed
 
 lemma monom_one_mult_comm: "monom P \<one> n \<otimes>\<^bsub>P\<^esub> monom P \<one> m = monom P \<one> m \<otimes>\<^bsub>P\<^esub> monom P \<one> n"
   unfolding monom_one_mult [symmetric] by (rule up_eqI) simp_all
 
 lemma monom_mult [simp]:
   assumes a_in_R: "a \<in> carrier R" and b_in_R: "b \<in> carrier R"
   shows "monom P (a \<otimes> b) (n + m) = monom P a n \<otimes>\<^bsub>P\<^esub> monom P b m"
 proof (rule up_eqI)
   fix k
   show "coeff P (monom P (a \<otimes> b) (n + m)) k = coeff P (monom P a n \<otimes>\<^bsub>P\<^esub> monom P b m) k"
   proof (cases "n + m = k")
     case True
     {
       show ?thesis
         unfolding True [symmetric]
           coeff_mult [OF monom_closed [OF a_in_R, of n] monom_closed [OF b_in_R, of m], of "n + m"]
           coeff_monom [OF a_in_R, of n] coeff_monom [OF b_in_R, of m]
         using R.finsum_cong [of "{.. n + m}" "{.. n + m}" "(\<lambda>i. (if n = i then a else \<zero>) \<otimes> (if m = n + m - i then b else \<zero>))"
           "(\<lambda>i. if n = i then a \<otimes> b else \<zero>)"]
           a_in_R b_in_R
         unfolding simp_implies_def
         using R.finsum_singleton [of n "{.. n + m}" "(\<lambda>i. a \<otimes> b)"]
         unfolding Pi_def by auto
     }
   next
     case False
     {
       show ?thesis
         unfolding coeff_monom [OF R.m_closed [OF a_in_R b_in_R], of "n + m" k] apply (simp add: False)
         unfolding coeff_mult [OF monom_closed [OF a_in_R, of n] monom_closed [OF b_in_R, of m], of k]
         unfolding coeff_monom [OF a_in_R, of n] unfolding coeff_monom [OF b_in_R, of m] using False
         using R.finsum_cong [of "{..k}" "{..k}" "(\<lambda>i. (if n = i then a else \<zero>) \<otimes> (if m = k - i then b else \<zero>))" "(\<lambda>i. \<zero>)"]
         unfolding Pi_def simp_implies_def using a_in_R b_in_R by force
     }
   qed
 qed (simp_all add: a_in_R b_in_R)
 
 lemma monom_a_inv [simp]:
   "a \<in> carrier R ==> monom P (\<ominus> a) n = \<ominus>\<^bsub>P\<^esub> monom P a n"
   by (rule up_eqI) auto
 
 lemma monom_inj:
   "inj_on (\<lambda>a. monom P a n) (carrier R)"
 proof (rule inj_onI)
   fix x y
   assume R: "x \<in> carrier R" "y \<in> carrier R" and eq: "monom P x n = monom P y n"
   then have "coeff P (monom P x n) n = coeff P (monom P y n) n" by simp
   with R show "x = y" by simp
 qed
 
 end
 
 
 subsection \<open>The Degree Function\<close>
 
 definition
   deg :: "[('a, 'm) ring_scheme, nat => 'a] => nat"
   where "deg R p = (LEAST n. bound \<zero>\<^bsub>R\<^esub> n (coeff (UP R) p))"
 
 context UP_ring
 begin
 
 lemma deg_aboveI:
   "[| (!!m. n < m ==> coeff P p m = \<zero>); p \<in> carrier P |] ==> deg R p <= n"
   by (unfold deg_def P_def) (fast intro: Least_le)
 
 (*
 lemma coeff_bound_ex: "EX n. bound n (coeff p)"
 proof -
   have "(\<lambda>n. coeff p n) : UP" by (simp add: coeff_def Rep_UP)
   then obtain n where "bound n (coeff p)" by (unfold UP_def) fast
   then show ?thesis ..
 qed
 
 lemma bound_coeff_obtain:
   assumes prem: "(!!n. bound n (coeff p) ==> P)" shows "P"
 proof -
   have "(\<lambda>n. coeff p n) : UP" by (simp add: coeff_def Rep_UP)
   then obtain n where "bound n (coeff p)" by (unfold UP_def) fast
   with prem show P .
 qed
 *)
 
 lemma deg_aboveD:
   assumes "deg R p < m" and "p \<in> carrier P"
   shows "coeff P p m = \<zero>"
 proof -
   from \<open>p \<in> carrier P\<close> obtain n where "bound \<zero> n (coeff P p)"
     by (auto simp add: UP_def P_def)
   then have "bound \<zero> (deg R p) (coeff P p)"
     by (auto simp: deg_def P_def dest: LeastI)
   from this and \<open>deg R p < m\<close> show ?thesis ..
 qed
 
 lemma deg_belowI:
   assumes non_zero: "n \<noteq> 0 \<Longrightarrow> coeff P p n \<noteq> \<zero>"
     and R: "p \<in> carrier P"
   shows "n \<le> deg R p"
 \<comment> \<open>Logically, this is a slightly stronger version of
    @{thm [source] deg_aboveD}\<close>
 proof (cases "n=0")
   case True then show ?thesis by simp
 next
   case False then have "coeff P p n \<noteq> \<zero>" by (rule non_zero)
   then have "\<not> deg R p < n" by (fast dest: deg_aboveD intro: R)
   then show ?thesis by arith
 qed
 
 lemma lcoeff_nonzero_deg:
   assumes deg: "deg R p \<noteq> 0" and R: "p \<in> carrier P"
   shows "coeff P p (deg R p) \<noteq> \<zero>"
 proof -
   from R obtain m where "deg R p \<le> m" and m_coeff: "coeff P p m \<noteq> \<zero>"
   proof -
     have minus: "\<And>(n::nat) m. n \<noteq> 0 \<Longrightarrow> (n - Suc 0 < m) = (n \<le> m)"
       by arith
     from deg have "deg R p - 1 < (LEAST n. bound \<zero> n (coeff P p))"
       by (unfold deg_def P_def) simp
     then have "\<not> bound \<zero> (deg R p - 1) (coeff P p)" by (rule not_less_Least)
     then have "\<exists>m. deg R p - 1 < m \<and> coeff P p m \<noteq> \<zero>"
       by (unfold bound_def) fast
     then have "\<exists>m. deg R p \<le> m \<and> coeff P p m \<noteq> \<zero>" by (simp add: deg minus)
     then show ?thesis by (auto intro: that)
   qed
   with deg_belowI R have "deg R p = m" by fastforce
   with m_coeff show ?thesis by simp
 qed
 
 lemma lcoeff_nonzero_nonzero:
   assumes deg: "deg R p = 0" and nonzero: "p \<noteq> \<zero>\<^bsub>P\<^esub>" and R: "p \<in> carrier P"
   shows "coeff P p 0 \<noteq> \<zero>"
 proof -
   have "\<exists>m. coeff P p m \<noteq> \<zero>"
   proof (rule classical)
     assume "\<not> ?thesis"
     with R have "p = \<zero>\<^bsub>P\<^esub>" by (auto intro: up_eqI)
     with nonzero show ?thesis by contradiction
   qed
   then obtain m where coeff: "coeff P p m \<noteq> \<zero>" ..
   from this and R have "m \<le> deg R p" by (rule deg_belowI)
   then have "m = 0" by (simp add: deg)
   with coeff show ?thesis by simp
 qed
 
 lemma lcoeff_nonzero:
   assumes neq: "p \<noteq> \<zero>\<^bsub>P\<^esub>" and R: "p \<in> carrier P"
   shows "coeff P p (deg R p) \<noteq> \<zero>"
 proof (cases "deg R p = 0")
   case True with neq R show ?thesis by (simp add: lcoeff_nonzero_nonzero)
 next
   case False with neq R show ?thesis by (simp add: lcoeff_nonzero_deg)
 qed
 
 lemma deg_eqI:
   "[| \<And>m. n < m \<Longrightarrow> coeff P p m = \<zero>;
       \<And>n. n \<noteq> 0 \<Longrightarrow> coeff P p n \<noteq> \<zero>; p \<in> carrier P |] ==> deg R p = n"
 by (fast intro: le_antisym deg_aboveI deg_belowI)
 
 text \<open>Degree and polynomial operations\<close>
 
 lemma deg_add [simp]:
   "p \<in> carrier P \<Longrightarrow> q \<in> carrier P \<Longrightarrow>
   deg R (p \<oplus>\<^bsub>P\<^esub> q) \<le> max (deg R p) (deg R q)"
 by(rule deg_aboveI)(simp_all add: deg_aboveD)
 
 lemma deg_monom_le:
   "a \<in> carrier R \<Longrightarrow> deg R (monom P a n) \<le> n"
   by (intro deg_aboveI) simp_all
 
 lemma deg_monom [simp]:
   "[| a \<noteq> \<zero>; a \<in> carrier R |] ==> deg R (monom P a n) = n"
   by (fastforce intro: le_antisym deg_aboveI deg_belowI)
 
 lemma deg_const [simp]:
   assumes R: "a \<in> carrier R" shows "deg R (monom P a 0) = 0"
 proof (rule le_antisym)
   show "deg R (monom P a 0) \<le> 0" by (rule deg_aboveI) (simp_all add: R)
 next
   show "0 \<le> deg R (monom P a 0)" by (rule deg_belowI) (simp_all add: R)
 qed
 
 lemma deg_zero [simp]:
   "deg R \<zero>\<^bsub>P\<^esub> = 0"
 proof (rule le_antisym)
   show "deg R \<zero>\<^bsub>P\<^esub> \<le> 0" by (rule deg_aboveI) simp_all
 next
   show "0 \<le> deg R \<zero>\<^bsub>P\<^esub>" by (rule deg_belowI) simp_all
 qed
 
 lemma deg_one [simp]:
   "deg R \<one>\<^bsub>P\<^esub> = 0"
 proof (rule le_antisym)
   show "deg R \<one>\<^bsub>P\<^esub> \<le> 0" by (rule deg_aboveI) simp_all
 next
   show "0 \<le> deg R \<one>\<^bsub>P\<^esub>" by (rule deg_belowI) simp_all
 qed
 
 lemma deg_uminus [simp]:
   assumes R: "p \<in> carrier P" shows "deg R (\<ominus>\<^bsub>P\<^esub> p) = deg R p"
 proof (rule le_antisym)
   show "deg R (\<ominus>\<^bsub>P\<^esub> p) \<le> deg R p" by (simp add: deg_aboveI deg_aboveD R)
 next
   show "deg R p \<le> deg R (\<ominus>\<^bsub>P\<^esub> p)"
     by (simp add: deg_belowI lcoeff_nonzero_deg
       inj_on_eq_iff [OF R.a_inv_inj, of _ "\<zero>", simplified] R)
 qed
 
 text\<open>The following lemma is later \emph{overwritten} by the most
   specific one for domains, \<open>deg_smult\<close>.\<close>
 
 lemma deg_smult_ring [simp]:
   "[| a \<in> carrier R; p \<in> carrier P |] ==>
   deg R (a \<odot>\<^bsub>P\<^esub> p) \<le> (if a = \<zero> then 0 else deg R p)"
   by (cases "a = \<zero>") (simp add: deg_aboveI deg_aboveD)+
 
 end
 
 context UP_domain
 begin
 
 lemma deg_smult [simp]:
   assumes R: "a \<in> carrier R" "p \<in> carrier P"
   shows "deg R (a \<odot>\<^bsub>P\<^esub> p) = (if a = \<zero> then 0 else deg R p)"
 proof (rule le_antisym)
   show "deg R (a \<odot>\<^bsub>P\<^esub> p) \<le> (if a = \<zero> then 0 else deg R p)"
     using R by (rule deg_smult_ring)
 next
   show "(if a = \<zero> then 0 else deg R p) \<le> deg R (a \<odot>\<^bsub>P\<^esub> p)"
   proof (cases "a = \<zero>")
   qed (simp, simp add: deg_belowI lcoeff_nonzero_deg integral_iff R)
 qed
 
 end
 
 context UP_ring
 begin
 
 lemma deg_mult_ring:
   assumes R: "p \<in> carrier P" "q \<in> carrier P"
   shows "deg R (p \<otimes>\<^bsub>P\<^esub> q) \<le> deg R p + deg R q"
 proof (rule deg_aboveI)
   fix m
   assume boundm: "deg R p + deg R q < m"
   {
     fix k i
     assume boundk: "deg R p + deg R q < k"
     then have "coeff P p i \<otimes> coeff P q (k - i) = \<zero>"
     proof (cases "deg R p < i")
       case True then show ?thesis by (simp add: deg_aboveD R)
     next
       case False with boundk have "deg R q < k - i" by arith
       then show ?thesis by (simp add: deg_aboveD R)
     qed
   }
   with boundm R show "coeff P (p \<otimes>\<^bsub>P\<^esub> q) m = \<zero>" by simp
 qed (simp add: R)
 
 end
 
 context UP_domain
 begin
 
 lemma deg_mult [simp]:
   "[| p \<noteq> \<zero>\<^bsub>P\<^esub>; q \<noteq> \<zero>\<^bsub>P\<^esub>; p \<in> carrier P; q \<in> carrier P |] ==>
   deg R (p \<otimes>\<^bsub>P\<^esub> q) = deg R p + deg R q"
 proof (rule le_antisym)
   assume "p \<in> carrier P" " q \<in> carrier P"
   then show "deg R (p \<otimes>\<^bsub>P\<^esub> q) \<le> deg R p + deg R q" by (rule deg_mult_ring)
 next
   let ?s = "(\<lambda>i. coeff P p i \<otimes> coeff P q (deg R p + deg R q - i))"
   assume R: "p \<in> carrier P" "q \<in> carrier P" and nz: "p \<noteq> \<zero>\<^bsub>P\<^esub>" "q \<noteq> \<zero>\<^bsub>P\<^esub>"
   have less_add_diff: "!!(k::nat) n m. k < n ==> m < n + m - k" by arith
   show "deg R p + deg R q \<le> deg R (p \<otimes>\<^bsub>P\<^esub> q)"
   proof (rule deg_belowI, simp add: R)
     have "(\<Oplus>i \<in> {.. deg R p + deg R q}. ?s i)
       = (\<Oplus>i \<in> {..< deg R p} \<union> {deg R p .. deg R p + deg R q}. ?s i)"
       by (simp only: ivl_disj_un_one)
     also have "... = (\<Oplus>i \<in> {deg R p .. deg R p + deg R q}. ?s i)"
       by (simp cong: R.finsum_cong add: R.finsum_Un_disjoint ivl_disj_int_one
         deg_aboveD less_add_diff R Pi_def)
     also have "...= (\<Oplus>i \<in> {deg R p} \<union> {deg R p <.. deg R p + deg R q}. ?s i)"
       by (simp only: ivl_disj_un_singleton)
     also have "... = coeff P p (deg R p) \<otimes> coeff P q (deg R q)"
       by (simp cong: R.finsum_cong add: deg_aboveD R Pi_def)
     finally have "(\<Oplus>i \<in> {.. deg R p + deg R q}. ?s i)
       = coeff P p (deg R p) \<otimes> coeff P q (deg R q)" .
     with nz show "(\<Oplus>i \<in> {.. deg R p + deg R q}. ?s i) \<noteq> \<zero>"
       by (simp add: integral_iff lcoeff_nonzero R)
   qed (simp add: R)
 qed
 
 end
 
 text\<open>The following lemmas also can be lifted to \<^term>\<open>UP_ring\<close>.\<close>
 
 context UP_ring
 begin
 
 lemma coeff_finsum:
   assumes fin: "finite A"
   shows "p \<in> A \<rightarrow> carrier P ==>
     coeff P (finsum P p A) k = (\<Oplus>i \<in> A. coeff P (p i) k)"
   using fin by induct (auto simp: Pi_def)
 
 lemma up_repr:
   assumes R: "p \<in> carrier P"
   shows "(\<Oplus>\<^bsub>P\<^esub> i \<in> {..deg R p}. monom P (coeff P p i) i) = p"
 proof (rule up_eqI)
   let ?s = "(\<lambda>i. monom P (coeff P p i) i)"
   fix k
   from R have RR: "!!i. (if i = k then coeff P p i else \<zero>) \<in> carrier R"
     by simp
   show "coeff P (\<Oplus>\<^bsub>P\<^esub> i \<in> {..deg R p}. ?s i) k = coeff P p k"
   proof (cases "k \<le> deg R p")
     case True
     hence "coeff P (\<Oplus>\<^bsub>P\<^esub> i \<in> {..deg R p}. ?s i) k =
           coeff P (\<Oplus>\<^bsub>P\<^esub> i \<in> {..k} \<union> {k<..deg R p}. ?s i) k"
       by (simp only: ivl_disj_un_one)
     also from True
     have "... = coeff P (\<Oplus>\<^bsub>P\<^esub> i \<in> {..k}. ?s i) k"
       by (simp cong: R.finsum_cong add: R.finsum_Un_disjoint
         ivl_disj_int_one order_less_imp_not_eq2 coeff_finsum R RR Pi_def)
     also
     have "... = coeff P (\<Oplus>\<^bsub>P\<^esub> i \<in> {..<k} \<union> {k}. ?s i) k"
       by (simp only: ivl_disj_un_singleton)
     also have "... = coeff P p k"
       by (simp cong: R.finsum_cong add: coeff_finsum deg_aboveD R RR Pi_def)
     finally show ?thesis .
   next
     case False
     hence "coeff P (\<Oplus>\<^bsub>P\<^esub> i \<in> {..deg R p}. ?s i) k =
           coeff P (\<Oplus>\<^bsub>P\<^esub> i \<in> {..<deg R p} \<union> {deg R p}. ?s i) k"
       by (simp only: ivl_disj_un_singleton)
     also from False have "... = coeff P p k"
       by (simp cong: R.finsum_cong add: coeff_finsum deg_aboveD R Pi_def)
     finally show ?thesis .
   qed
 qed (simp_all add: R Pi_def)
 
 lemma up_repr_le:
   "[| deg R p <= n; p \<in> carrier P |] ==>
   (\<Oplus>\<^bsub>P\<^esub> i \<in> {..n}. monom P (coeff P p i) i) = p"
 proof -
   let ?s = "(\<lambda>i. monom P (coeff P p i) i)"
   assume R: "p \<in> carrier P" and "deg R p <= n"
   then have "finsum P ?s {..n} = finsum P ?s ({..deg R p} \<union> {deg R p<..n})"
     by (simp only: ivl_disj_un_one)
   also have "... = finsum P ?s {..deg R p}"
     by (simp cong: P.finsum_cong add: P.finsum_Un_disjoint ivl_disj_int_one
       deg_aboveD R Pi_def)
   also have "... = p" using R by (rule up_repr)
   finally show ?thesis .
 qed
 
 end
 
 
 subsection \<open>Polynomials over Integral Domains\<close>
 
 lemma domainI:
   assumes cring: "cring R"
     and one_not_zero: "one R \<noteq> zero R"
     and integral: "\<And>a b. [| mult R a b = zero R; a \<in> carrier R;
       b \<in> carrier R |] ==> a = zero R \<or> b = zero R"
   shows "domain R"
   by (auto intro!: domain.intro domain_axioms.intro cring.axioms assms
     del: disjCI)
 
 context UP_domain
 begin
 
 lemma UP_one_not_zero:
   "\<one>\<^bsub>P\<^esub> \<noteq> \<zero>\<^bsub>P\<^esub>"
 proof
   assume "\<one>\<^bsub>P\<^esub> = \<zero>\<^bsub>P\<^esub>"
   hence "coeff P \<one>\<^bsub>P\<^esub> 0 = (coeff P \<zero>\<^bsub>P\<^esub> 0)" by simp
   hence "\<one> = \<zero>" by simp
   with R.one_not_zero show "False" by contradiction
 qed
 
 lemma UP_integral:
   "[| p \<otimes>\<^bsub>P\<^esub> q = \<zero>\<^bsub>P\<^esub>; p \<in> carrier P; q \<in> carrier P |] ==> p = \<zero>\<^bsub>P\<^esub> \<or> q = \<zero>\<^bsub>P\<^esub>"
 proof -
   fix p q
   assume pq: "p \<otimes>\<^bsub>P\<^esub> q = \<zero>\<^bsub>P\<^esub>" and R: "p \<in> carrier P" "q \<in> carrier P"
   show "p = \<zero>\<^bsub>P\<^esub> \<or> q = \<zero>\<^bsub>P\<^esub>"
   proof (rule classical)
     assume c: "\<not> (p = \<zero>\<^bsub>P\<^esub> \<or> q = \<zero>\<^bsub>P\<^esub>)"
     with R have "deg R p + deg R q = deg R (p \<otimes>\<^bsub>P\<^esub> q)" by simp
     also from pq have "... = 0" by simp
     finally have "deg R p + deg R q = 0" .
     then have f1: "deg R p = 0 \<and> deg R q = 0" by simp
     from f1 R have "p = (\<Oplus>\<^bsub>P\<^esub> i \<in> {..0}. monom P (coeff P p i) i)"
       by (simp only: up_repr_le)
     also from R have "... = monom P (coeff P p 0) 0" by simp
     finally have p: "p = monom P (coeff P p 0) 0" .
     from f1 R have "q = (\<Oplus>\<^bsub>P\<^esub> i \<in> {..0}. monom P (coeff P q i) i)"
       by (simp only: up_repr_le)
     also from R have "... = monom P (coeff P q 0) 0" by simp
     finally have q: "q = monom P (coeff P q 0) 0" .
     from R have "coeff P p 0 \<otimes> coeff P q 0 = coeff P (p \<otimes>\<^bsub>P\<^esub> q) 0" by simp
     also from pq have "... = \<zero>" by simp
     finally have "coeff P p 0 \<otimes> coeff P q 0 = \<zero>" .
     with R have "coeff P p 0 = \<zero> \<or> coeff P q 0 = \<zero>"
       by (simp add: R.integral_iff)
     with p q show "p = \<zero>\<^bsub>P\<^esub> \<or> q = \<zero>\<^bsub>P\<^esub>" by fastforce
   qed
 qed
 
 theorem UP_domain:
   "domain P"
   by (auto intro!: domainI UP_cring UP_one_not_zero UP_integral del: disjCI)
 
 end
 
 text \<open>
   Interpretation of theorems from \<^term>\<open>domain\<close>.
 \<close>
 
 sublocale UP_domain < "domain" P
   by intro_locales (rule domain.axioms UP_domain)+
 
 
 subsection \<open>The Evaluation Homomorphism and Universal Property\<close>
 
 (* alternative congruence rule (possibly more efficient)
 lemma (in abelian_monoid) finsum_cong2:
   "[| !!i. i \<in> A ==> f i \<in> carrier G = True; A = B;
   !!i. i \<in> B ==> f i = g i |] ==> finsum G f A = finsum G g B"
   sorry*)
 
 lemma (in abelian_monoid) boundD_carrier:
   "[| bound \<zero> n f; n < m |] ==> f m \<in> carrier G"
   by auto
 
 context ring
 begin
 
 theorem diagonal_sum:
   "[| f \<in> {..n + m::nat} \<rightarrow> carrier R; g \<in> {..n + m} \<rightarrow> carrier R |] ==>
   (\<Oplus>k \<in> {..n + m}. \<Oplus>i \<in> {..k}. f i \<otimes> g (k - i)) =
   (\<Oplus>k \<in> {..n + m}. \<Oplus>i \<in> {..n + m - k}. f k \<otimes> g i)"
 proof -
   assume Rf: "f \<in> {..n + m} \<rightarrow> carrier R" and Rg: "g \<in> {..n + m} \<rightarrow> carrier R"
   {
     fix j
     have "j <= n + m ==>
       (\<Oplus>k \<in> {..j}. \<Oplus>i \<in> {..k}. f i \<otimes> g (k - i)) =
       (\<Oplus>k \<in> {..j}. \<Oplus>i \<in> {..j - k}. f k \<otimes> g i)"
     proof (induct j)
       case 0 from Rf Rg show ?case by (simp add: Pi_def)
     next
       case (Suc j)
       have R6: "!!i k. [| k <= j; i <= Suc j - k |] ==> g i \<in> carrier R"
         using Suc by (auto intro!: funcset_mem [OF Rg])
       have R8: "!!i k. [| k <= Suc j; i <= k |] ==> g (k - i) \<in> carrier R"
         using Suc by (auto intro!: funcset_mem [OF Rg])
       have R9: "!!i k. [| k <= Suc j |] ==> f k \<in> carrier R"
         using Suc by (auto intro!: funcset_mem [OF Rf])
       have R10: "!!i k. [| k <= Suc j; i <= Suc j - k |] ==> g i \<in> carrier R"
         using Suc by (auto intro!: funcset_mem [OF Rg])
       have R11: "g 0 \<in> carrier R"
         using Suc by (auto intro!: funcset_mem [OF Rg])
       from Suc show ?case
         by (simp cong: finsum_cong add: Suc_diff_le a_ac
           Pi_def R6 R8 R9 R10 R11)
     qed
   }
   then show ?thesis by fast
 qed
 
 theorem cauchy_product:
   assumes bf: "bound \<zero> n f" and bg: "bound \<zero> m g"
     and Rf: "f \<in> {..n} \<rightarrow> carrier R" and Rg: "g \<in> {..m} \<rightarrow> carrier R"
   shows "(\<Oplus>k \<in> {..n + m}. \<Oplus>i \<in> {..k}. f i \<otimes> g (k - i)) =
     (\<Oplus>i \<in> {..n}. f i) \<otimes> (\<Oplus>i \<in> {..m}. g i)"      (* State reverse direction? *)
 proof -
   have f: "!!x. f x \<in> carrier R"
   proof -
     fix x
     show "f x \<in> carrier R"
       using Rf bf boundD_carrier by (cases "x <= n") (auto simp: Pi_def)
   qed
   have g: "!!x. g x \<in> carrier R"
   proof -
     fix x
     show "g x \<in> carrier R"
       using Rg bg boundD_carrier by (cases "x <= m") (auto simp: Pi_def)
   qed
   from f g have "(\<Oplus>k \<in> {..n + m}. \<Oplus>i \<in> {..k}. f i \<otimes> g (k - i)) =
       (\<Oplus>k \<in> {..n + m}. \<Oplus>i \<in> {..n + m - k}. f k \<otimes> g i)"
     by (simp add: diagonal_sum Pi_def)
   also have "... = (\<Oplus>k \<in> {..n} \<union> {n<..n + m}. \<Oplus>i \<in> {..n + m - k}. f k \<otimes> g i)"
     by (simp only: ivl_disj_un_one)
   also from f g have "... = (\<Oplus>k \<in> {..n}. \<Oplus>i \<in> {..n + m - k}. f k \<otimes> g i)"
     by (simp cong: finsum_cong
       add: bound.bound [OF bf] finsum_Un_disjoint ivl_disj_int_one Pi_def)
   also from f g
   have "... = (\<Oplus>k \<in> {..n}. \<Oplus>i \<in> {..m} \<union> {m<..n + m - k}. f k \<otimes> g i)"
     by (simp cong: finsum_cong add: ivl_disj_un_one le_add_diff Pi_def)
   also from f g have "... = (\<Oplus>k \<in> {..n}. \<Oplus>i \<in> {..m}. f k \<otimes> g i)"
     by (simp cong: finsum_cong
       add: bound.bound [OF bg] finsum_Un_disjoint ivl_disj_int_one Pi_def)
   also from f g have "... = (\<Oplus>i \<in> {..n}. f i) \<otimes> (\<Oplus>i \<in> {..m}. g i)"
     by (simp add: finsum_ldistr diagonal_sum Pi_def,
       simp cong: finsum_cong add: finsum_rdistr Pi_def)
   finally show ?thesis .
 qed
 
 end
 
 lemma (in UP_ring) const_ring_hom:
   "(\<lambda>a. monom P a 0) \<in> ring_hom R P"
   by (auto intro!: ring_hom_memI intro: up_eqI simp: monom_mult_is_smult)
 
 definition
   eval :: "[('a, 'm) ring_scheme, ('b, 'n) ring_scheme,
            'a => 'b, 'b, nat => 'a] => 'b"
   where "eval R S phi s = (\<lambda>p \<in> carrier (UP R).
     \<Oplus>\<^bsub>S\<^esub>i \<in> {..deg R p}. phi (coeff (UP R) p i) \<otimes>\<^bsub>S\<^esub> s [^]\<^bsub>S\<^esub> i)"
 
 context UP
 begin
 
 lemma eval_on_carrier:
   fixes S (structure)
   shows "p \<in> carrier P ==>
   eval R S phi s p = (\<Oplus>\<^bsub>S\<^esub> i \<in> {..deg R p}. phi (coeff P p i) \<otimes>\<^bsub>S\<^esub> s [^]\<^bsub>S\<^esub> i)"
   by (unfold eval_def, fold P_def) simp
 
 lemma eval_extensional:
   "eval R S phi p \<in> extensional (carrier P)"
   by (unfold eval_def, fold P_def) simp
 
 end
 
 text \<open>The universal property of the polynomial ring\<close>
 
 locale UP_pre_univ_prop = ring_hom_cring + UP_cring
 
 locale UP_univ_prop = UP_pre_univ_prop +
   fixes s and Eval
   assumes indet_img_carrier [simp, intro]: "s \<in> carrier S"
   defines Eval_def: "Eval == eval R S h s"
 
 text\<open>JE: I have moved the following lemma from Ring.thy and lifted then to the locale \<^term>\<open>ring_hom_ring\<close> from \<^term>\<open>ring_hom_cring\<close>.\<close>
 text\<open>JE: I was considering using it in \<open>eval_ring_hom\<close>, but that property does not hold for non commutative rings, so
   maybe it is not that necessary.\<close>
 
 lemma (in ring_hom_ring) hom_finsum [simp]:
   "f \<in> A \<rightarrow> carrier R \<Longrightarrow>
   h (finsum R f A) = finsum S (h \<circ> f) A"
   by (induct A rule: infinite_finite_induct, auto simp: Pi_def)
 
 context UP_pre_univ_prop
 begin
 
 theorem eval_ring_hom:
   assumes S: "s \<in> carrier S"
   shows "eval R S h s \<in> ring_hom P S"
 proof (rule ring_hom_memI)
   fix p
   assume R: "p \<in> carrier P"
   then show "eval R S h s p \<in> carrier S"
     by (simp only: eval_on_carrier) (simp add: S Pi_def)
 next
   fix p q
   assume R: "p \<in> carrier P" "q \<in> carrier P"
   then show "eval R S h s (p \<oplus>\<^bsub>P\<^esub> q) = eval R S h s p \<oplus>\<^bsub>S\<^esub> eval R S h s q"
   proof (simp only: eval_on_carrier P.a_closed)
     from S R have
       "(\<Oplus>\<^bsub>S \<^esub>i\<in>{..deg R (p \<oplus>\<^bsub>P\<^esub> q)}. h (coeff P (p \<oplus>\<^bsub>P\<^esub> q) i) \<otimes>\<^bsub>S\<^esub> s [^]\<^bsub>S\<^esub> i) =
       (\<Oplus>\<^bsub>S \<^esub>i\<in>{..deg R (p \<oplus>\<^bsub>P\<^esub> q)} \<union> {deg R (p \<oplus>\<^bsub>P\<^esub> q)<..max (deg R p) (deg R q)}.
         h (coeff P (p \<oplus>\<^bsub>P\<^esub> q) i) \<otimes>\<^bsub>S\<^esub> s [^]\<^bsub>S\<^esub> i)"
       by (simp cong: S.finsum_cong
         add: deg_aboveD S.finsum_Un_disjoint ivl_disj_int_one Pi_def del: coeff_add)
     also from R have "... =
         (\<Oplus>\<^bsub>S\<^esub> i \<in> {..max (deg R p) (deg R q)}.
           h (coeff P (p \<oplus>\<^bsub>P\<^esub> q) i) \<otimes>\<^bsub>S\<^esub> s [^]\<^bsub>S\<^esub> i)"
       by (simp add: ivl_disj_un_one)
     also from R S have "... =
       (\<Oplus>\<^bsub>S\<^esub>i\<in>{..max (deg R p) (deg R q)}. h (coeff P p i) \<otimes>\<^bsub>S\<^esub> s [^]\<^bsub>S\<^esub> i) \<oplus>\<^bsub>S\<^esub>
       (\<Oplus>\<^bsub>S\<^esub>i\<in>{..max (deg R p) (deg R q)}. h (coeff P q i) \<otimes>\<^bsub>S\<^esub> s [^]\<^bsub>S\<^esub> i)"
       by (simp cong: S.finsum_cong
         add: S.l_distr deg_aboveD ivl_disj_int_one Pi_def)
     also have "... =
         (\<Oplus>\<^bsub>S\<^esub> i \<in> {..deg R p} \<union> {deg R p<..max (deg R p) (deg R q)}.
           h (coeff P p i) \<otimes>\<^bsub>S\<^esub> s [^]\<^bsub>S\<^esub> i) \<oplus>\<^bsub>S\<^esub>
         (\<Oplus>\<^bsub>S\<^esub> i \<in> {..deg R q} \<union> {deg R q<..max (deg R p) (deg R q)}.
           h (coeff P q i) \<otimes>\<^bsub>S\<^esub> s [^]\<^bsub>S\<^esub> i)"
       by (simp only: ivl_disj_un_one max.cobounded1 max.cobounded2)
     also from R S have "... =
       (\<Oplus>\<^bsub>S\<^esub> i \<in> {..deg R p}. h (coeff P p i) \<otimes>\<^bsub>S\<^esub> s [^]\<^bsub>S\<^esub> i) \<oplus>\<^bsub>S\<^esub>
       (\<Oplus>\<^bsub>S\<^esub> i \<in> {..deg R q}. h (coeff P q i) \<otimes>\<^bsub>S\<^esub> s [^]\<^bsub>S\<^esub> i)"
       by (simp cong: S.finsum_cong
         add: deg_aboveD S.finsum_Un_disjoint ivl_disj_int_one Pi_def)
     finally show
       "(\<Oplus>\<^bsub>S\<^esub>i \<in> {..deg R (p \<oplus>\<^bsub>P\<^esub> q)}. h (coeff P (p \<oplus>\<^bsub>P\<^esub> q) i) \<otimes>\<^bsub>S\<^esub> s [^]\<^bsub>S\<^esub> i) =
       (\<Oplus>\<^bsub>S\<^esub>i \<in> {..deg R p}. h (coeff P p i) \<otimes>\<^bsub>S\<^esub> s [^]\<^bsub>S\<^esub> i) \<oplus>\<^bsub>S\<^esub>
       (\<Oplus>\<^bsub>S\<^esub>i \<in> {..deg R q}. h (coeff P q i) \<otimes>\<^bsub>S\<^esub> s [^]\<^bsub>S\<^esub> i)" .
   qed
 next
   show "eval R S h s \<one>\<^bsub>P\<^esub> = \<one>\<^bsub>S\<^esub>"
     by (simp only: eval_on_carrier UP_one_closed) simp
 next
   fix p q
   assume R: "p \<in> carrier P" "q \<in> carrier P"
   then show "eval R S h s (p \<otimes>\<^bsub>P\<^esub> q) = eval R S h s p \<otimes>\<^bsub>S\<^esub> eval R S h s q"
   proof (simp only: eval_on_carrier UP_mult_closed)
     from R S have
       "(\<Oplus>\<^bsub>S\<^esub> i \<in> {..deg R (p \<otimes>\<^bsub>P\<^esub> q)}. h (coeff P (p \<otimes>\<^bsub>P\<^esub> q) i) \<otimes>\<^bsub>S\<^esub> s [^]\<^bsub>S\<^esub> i) =
       (\<Oplus>\<^bsub>S\<^esub> i \<in> {..deg R (p \<otimes>\<^bsub>P\<^esub> q)} \<union> {deg R (p \<otimes>\<^bsub>P\<^esub> q)<..deg R p + deg R q}.
         h (coeff P (p \<otimes>\<^bsub>P\<^esub> q) i) \<otimes>\<^bsub>S\<^esub> s [^]\<^bsub>S\<^esub> i)"
       by (simp cong: S.finsum_cong
         add: deg_aboveD S.finsum_Un_disjoint ivl_disj_int_one Pi_def
         del: coeff_mult)
     also from R have "... =
       (\<Oplus>\<^bsub>S\<^esub> i \<in> {..deg R p + deg R q}. h (coeff P (p \<otimes>\<^bsub>P\<^esub> q) i) \<otimes>\<^bsub>S\<^esub> s [^]\<^bsub>S\<^esub> i)"
       by (simp only: ivl_disj_un_one deg_mult_ring)
     also from R S have "... =
       (\<Oplus>\<^bsub>S\<^esub> i \<in> {..deg R p + deg R q}.
          \<Oplus>\<^bsub>S\<^esub> k \<in> {..i}.
            h (coeff P p k) \<otimes>\<^bsub>S\<^esub> h (coeff P q (i - k)) \<otimes>\<^bsub>S\<^esub>
            (s [^]\<^bsub>S\<^esub> k \<otimes>\<^bsub>S\<^esub> s [^]\<^bsub>S\<^esub> (i - k)))"
       by (simp cong: S.finsum_cong add: S.nat_pow_mult Pi_def
         S.m_ac S.finsum_rdistr)
     also from R S have "... =
       (\<Oplus>\<^bsub>S\<^esub> i\<in>{..deg R p}. h (coeff P p i) \<otimes>\<^bsub>S\<^esub> s [^]\<^bsub>S\<^esub> i) \<otimes>\<^bsub>S\<^esub>
       (\<Oplus>\<^bsub>S\<^esub> i\<in>{..deg R q}. h (coeff P q i) \<otimes>\<^bsub>S\<^esub> s [^]\<^bsub>S\<^esub> i)"
       by (simp add: S.cauchy_product [THEN sym] bound.intro deg_aboveD S.m_ac
         Pi_def)
     finally show
       "(\<Oplus>\<^bsub>S\<^esub> i \<in> {..deg R (p \<otimes>\<^bsub>P\<^esub> q)}. h (coeff P (p \<otimes>\<^bsub>P\<^esub> q) i) \<otimes>\<^bsub>S\<^esub> s [^]\<^bsub>S\<^esub> i) =
       (\<Oplus>\<^bsub>S\<^esub> i \<in> {..deg R p}. h (coeff P p i) \<otimes>\<^bsub>S\<^esub> s [^]\<^bsub>S\<^esub> i) \<otimes>\<^bsub>S\<^esub>
       (\<Oplus>\<^bsub>S\<^esub> i \<in> {..deg R q}. h (coeff P q i) \<otimes>\<^bsub>S\<^esub> s [^]\<^bsub>S\<^esub> i)" .
   qed
 qed
 
 text \<open>
   The following lemma could be proved in \<open>UP_cring\<close> with the additional
   assumption that \<open>h\<close> is closed.\<close>
 
 lemma (in UP_pre_univ_prop) eval_const:
   "[| s \<in> carrier S; r \<in> carrier R |] ==> eval R S h s (monom P r 0) = h r"
   by (simp only: eval_on_carrier monom_closed) simp
 
 text \<open>Further properties of the evaluation homomorphism.\<close>
 
 text \<open>The following proof is complicated by the fact that in arbitrary
   rings one might have \<^term>\<open>one R = zero R\<close>.\<close>
 
 (* TODO: simplify by cases "one R = zero R" *)
 
 lemma (in UP_pre_univ_prop) eval_monom1:
   assumes S: "s \<in> carrier S"
   shows "eval R S h s (monom P \<one> 1) = s"
 proof (simp only: eval_on_carrier monom_closed R.one_closed)
    from S have
     "(\<Oplus>\<^bsub>S\<^esub> i\<in>{..deg R (monom P \<one> 1)}. h (coeff P (monom P \<one> 1) i) \<otimes>\<^bsub>S\<^esub> s [^]\<^bsub>S\<^esub> i) =
     (\<Oplus>\<^bsub>S\<^esub> i\<in>{..deg R (monom P \<one> 1)} \<union> {deg R (monom P \<one> 1)<..1}.
       h (coeff P (monom P \<one> 1) i) \<otimes>\<^bsub>S\<^esub> s [^]\<^bsub>S\<^esub> i)"
     by (simp cong: S.finsum_cong del: coeff_monom
       add: deg_aboveD S.finsum_Un_disjoint ivl_disj_int_one Pi_def)
   also have "... =
     (\<Oplus>\<^bsub>S\<^esub> i \<in> {..1}. h (coeff P (monom P \<one> 1) i) \<otimes>\<^bsub>S\<^esub> s [^]\<^bsub>S\<^esub> i)"
     by (simp only: ivl_disj_un_one deg_monom_le R.one_closed)
   also have "... = s"
   proof (cases "s = \<zero>\<^bsub>S\<^esub>")
     case True then show ?thesis by (simp add: Pi_def)
   next
     case False then show ?thesis by (simp add: S Pi_def)
   qed
   finally show "(\<Oplus>\<^bsub>S\<^esub> i \<in> {..deg R (monom P \<one> 1)}.
     h (coeff P (monom P \<one> 1) i) \<otimes>\<^bsub>S\<^esub> s [^]\<^bsub>S\<^esub> i) = s" .
 qed
 
 end
 
 text \<open>Interpretation of ring homomorphism lemmas.\<close>
 
 sublocale UP_univ_prop < ring_hom_cring P S Eval
   unfolding Eval_def
   by unfold_locales (fast intro: eval_ring_hom)
 
 lemma (in UP_cring) monom_pow:
   assumes R: "a \<in> carrier R"
   shows "(monom P a n) [^]\<^bsub>P\<^esub> m = monom P (a [^] m) (n * m)"
 proof (induct m)
   case 0 from R show ?case by simp
 next
   case Suc with R show ?case
     by (simp del: monom_mult add: monom_mult [THEN sym] add.commute)
 qed
 
 lemma (in ring_hom_cring) hom_pow [simp]:
   "x \<in> carrier R ==> h (x [^] n) = h x [^]\<^bsub>S\<^esub> (n::nat)"
   by (induct n) simp_all
 
 lemma (in UP_univ_prop) Eval_monom:
   "r \<in> carrier R ==> Eval (monom P r n) = h r \<otimes>\<^bsub>S\<^esub> s [^]\<^bsub>S\<^esub> n"
 proof -
   assume R: "r \<in> carrier R"
   from R have "Eval (monom P r n) = Eval (monom P r 0 \<otimes>\<^bsub>P\<^esub> (monom P \<one> 1) [^]\<^bsub>P\<^esub> n)"
     by (simp del: monom_mult add: monom_mult [THEN sym] monom_pow)
   also
   from R eval_monom1 [where s = s, folded Eval_def]
   have "... = h r \<otimes>\<^bsub>S\<^esub> s [^]\<^bsub>S\<^esub> n"
     by (simp add: eval_const [where s = s, folded Eval_def])
   finally show ?thesis .
 qed
 
 lemma (in UP_pre_univ_prop) eval_monom:
   assumes R: "r \<in> carrier R" and S: "s \<in> carrier S"
   shows "eval R S h s (monom P r n) = h r \<otimes>\<^bsub>S\<^esub> s [^]\<^bsub>S\<^esub> n"
 proof -
   interpret UP_univ_prop R S h P s "eval R S h s"
     using UP_pre_univ_prop_axioms P_def R S
     by (auto intro: UP_univ_prop.intro UP_univ_prop_axioms.intro)
   from R
   show ?thesis by (rule Eval_monom)
 qed
 
 lemma (in UP_univ_prop) Eval_smult:
   "[| r \<in> carrier R; p \<in> carrier P |] ==> Eval (r \<odot>\<^bsub>P\<^esub> p) = h r \<otimes>\<^bsub>S\<^esub> Eval p"
 proof -
   assume R: "r \<in> carrier R" and P: "p \<in> carrier P"
   then show ?thesis
     by (simp add: monom_mult_is_smult [THEN sym]
       eval_const [where s = s, folded Eval_def])
 qed
 
 lemma ring_hom_cringI:
   assumes "cring R"
     and "cring S"
     and "h \<in> ring_hom R S"
   shows "ring_hom_cring R S h"
   by (fast intro: ring_hom_cring.intro ring_hom_cring_axioms.intro
     cring.axioms assms)
 
 context UP_pre_univ_prop
 begin
 
 lemma UP_hom_unique:
   assumes "ring_hom_cring P S Phi"
   assumes Phi: "Phi (monom P \<one> (Suc 0)) = s"
       "!!r. r \<in> carrier R ==> Phi (monom P r 0) = h r"
   assumes "ring_hom_cring P S Psi"
   assumes Psi: "Psi (monom P \<one> (Suc 0)) = s"
       "!!r. r \<in> carrier R ==> Psi (monom P r 0) = h r"
     and P: "p \<in> carrier P" and S: "s \<in> carrier S"
   shows "Phi p = Psi p"
 proof -
   interpret ring_hom_cring P S Phi by fact
   interpret ring_hom_cring P S Psi by fact
   have "Phi p =
       Phi (\<Oplus>\<^bsub>P \<^esub>i \<in> {..deg R p}. monom P (coeff P p i) 0 \<otimes>\<^bsub>P\<^esub> monom P \<one> 1 [^]\<^bsub>P\<^esub> i)"
     by (simp add: up_repr P monom_mult [THEN sym] monom_pow del: monom_mult)
   also
   have "... =
       Psi (\<Oplus>\<^bsub>P \<^esub>i\<in>{..deg R p}. monom P (coeff P p i) 0 \<otimes>\<^bsub>P\<^esub> monom P \<one> 1 [^]\<^bsub>P\<^esub> i)"
     by (simp add: Phi Psi P Pi_def comp_def)
   also have "... = Psi p"
     by (simp add: up_repr P monom_mult [THEN sym] monom_pow del: monom_mult)
   finally show ?thesis .
 qed
 
 lemma ring_homD:
   assumes Phi: "Phi \<in> ring_hom P S"
   shows "ring_hom_cring P S Phi"
   by unfold_locales (rule Phi)
 
 theorem UP_universal_property:
   assumes S: "s \<in> carrier S"
   shows "\<exists>!Phi. Phi \<in> ring_hom P S \<inter> extensional (carrier P) \<and>
     Phi (monom P \<one> 1) = s \<and>
     (\<forall>r \<in> carrier R. Phi (monom P r 0) = h r)"
   using S eval_monom1
   apply (auto intro: eval_ring_hom eval_const eval_extensional)
   apply (rule extensionalityI)
   apply (auto intro: UP_hom_unique ring_homD)
   done
 
 end
 
 text\<open>JE: The following lemma was added by me; it might be even lifted to a simpler locale\<close>
 
 context monoid
 begin
 
 lemma nat_pow_eone[simp]: assumes x_in_G: "x \<in> carrier G" shows "x [^] (1::nat) = x"
   using nat_pow_Suc [of x 0] unfolding nat_pow_0 [of x] unfolding l_one [OF x_in_G] by simp
 
 end
 
 context UP_ring
 begin
 
 abbreviation lcoeff :: "(nat =>'a) => 'a" where "lcoeff p == coeff P p (deg R p)"
 
 lemma lcoeff_nonzero2: assumes p_in_R: "p \<in> carrier P" and p_not_zero: "p \<noteq> \<zero>\<^bsub>P\<^esub>" shows "lcoeff p \<noteq> \<zero>"
   using lcoeff_nonzero [OF p_not_zero p_in_R] .
 
 
 subsection\<open>The long division algorithm: some previous facts.\<close>
 
 lemma coeff_minus [simp]:
   assumes p: "p \<in> carrier P" and q: "q \<in> carrier P" 
   shows "coeff P (p \<ominus>\<^bsub>P\<^esub> q) n = coeff P p n \<ominus> coeff P q n"
   by (simp add: a_minus_def p q)
 
 lemma lcoeff_closed [simp]: assumes p: "p \<in> carrier P" shows "lcoeff p \<in> carrier R"
   using coeff_closed [OF p, of "deg R p"] by simp
 
 lemma deg_smult_decr: assumes a_in_R: "a \<in> carrier R" and f_in_P: "f \<in> carrier P" shows "deg R (a \<odot>\<^bsub>P\<^esub> f) \<le> deg R f"
   using deg_smult_ring [OF a_in_R f_in_P] by (cases "a = \<zero>", auto)
 
 lemma coeff_monom_mult: assumes R: "c \<in> carrier R" and P: "p \<in> carrier P"
   shows "coeff P (monom P c n \<otimes>\<^bsub>P\<^esub> p) (m + n) = c \<otimes> (coeff P p m)"
 proof -
   have "coeff P (monom P c n \<otimes>\<^bsub>P\<^esub> p) (m + n) = (\<Oplus>i\<in>{..m + n}. (if n = i then c else \<zero>) \<otimes> coeff P p (m + n - i))"
     unfolding coeff_mult [OF monom_closed [OF R, of n] P, of "m + n"] unfolding coeff_monom [OF R, of n] by simp
   also have "(\<Oplus>i\<in>{..m + n}. (if n = i then c else \<zero>) \<otimes> coeff P p (m + n - i)) =
     (\<Oplus>i\<in>{..m + n}. (if n = i then c \<otimes> coeff P p (m + n - i) else \<zero>))"
     using  R.finsum_cong [of "{..m + n}" "{..m + n}" "(\<lambda>i::nat. (if n = i then c else \<zero>) \<otimes> coeff P p (m + n - i))"
       "(\<lambda>i::nat. (if n = i then c \<otimes> coeff P p (m + n - i) else \<zero>))"]
     using coeff_closed [OF P] unfolding Pi_def simp_implies_def using R by auto
   also have "\<dots> = c \<otimes> coeff P p m" using R.finsum_singleton [of n "{..m + n}" "(\<lambda>i. c \<otimes> coeff P p (m + n - i))"]
     unfolding Pi_def using coeff_closed [OF P] using P R by auto
   finally show ?thesis by simp
 qed
 
 lemma deg_lcoeff_cancel:
   assumes p_in_P: "p \<in> carrier P" and q_in_P: "q \<in> carrier P" and r_in_P: "r \<in> carrier P"
   and deg_r_nonzero: "deg R r \<noteq> 0"
   and deg_R_p: "deg R p \<le> deg R r" and deg_R_q: "deg R q \<le> deg R r"
   and coeff_R_p_eq_q: "coeff P p (deg R r) = \<ominus>\<^bsub>R\<^esub> (coeff P q (deg R r))"
   shows "deg R (p \<oplus>\<^bsub>P\<^esub> q) < deg R r"
 proof -
   have deg_le: "deg R (p \<oplus>\<^bsub>P\<^esub> q) \<le> deg R r"
   proof (rule deg_aboveI)
     fix m
     assume deg_r_le: "deg R r < m"
     show "coeff P (p \<oplus>\<^bsub>P\<^esub> q) m = \<zero>"
     proof -
       have slp: "deg R p < m" and "deg R q < m" using deg_R_p deg_R_q using deg_r_le by auto
       then have max_sl: "max (deg R p) (deg R q) < m" by simp
       then have "deg R (p \<oplus>\<^bsub>P\<^esub> q) < m" using deg_add [OF p_in_P q_in_P] by arith
       with deg_R_p deg_R_q show ?thesis using coeff_add [OF p_in_P q_in_P, of m]
         using deg_aboveD [of "p \<oplus>\<^bsub>P\<^esub> q" m] using p_in_P q_in_P by simp
     qed
   qed (simp add: p_in_P q_in_P)
   moreover have deg_ne: "deg R (p \<oplus>\<^bsub>P\<^esub> q) \<noteq> deg R r"
   proof (rule ccontr)
     assume nz: "\<not> deg R (p \<oplus>\<^bsub>P\<^esub> q) \<noteq> deg R r" then have deg_eq: "deg R (p \<oplus>\<^bsub>P\<^esub> q) = deg R r" by simp
     from deg_r_nonzero have r_nonzero: "r \<noteq> \<zero>\<^bsub>P\<^esub>" by (cases "r = \<zero>\<^bsub>P\<^esub>", simp_all)
     have "coeff P (p \<oplus>\<^bsub>P\<^esub> q) (deg R r) = \<zero>\<^bsub>R\<^esub>" using coeff_add [OF p_in_P q_in_P, of "deg R r"] using coeff_R_p_eq_q
       using coeff_closed [OF p_in_P, of "deg R r"] coeff_closed [OF q_in_P, of "deg R r"] by algebra
     with lcoeff_nonzero [OF r_nonzero r_in_P]  and deg_eq show False using lcoeff_nonzero [of "p \<oplus>\<^bsub>P\<^esub> q"] using p_in_P q_in_P
       using deg_r_nonzero by (cases "p \<oplus>\<^bsub>P\<^esub> q \<noteq> \<zero>\<^bsub>P\<^esub>", auto)
   qed
   ultimately show ?thesis by simp
 qed
 
 lemma monom_deg_mult:
   assumes f_in_P: "f \<in> carrier P" and g_in_P: "g \<in> carrier P" and deg_le: "deg R g \<le> deg R f"
   and a_in_R: "a \<in> carrier R"
   shows "deg R (g \<otimes>\<^bsub>P\<^esub> monom P a (deg R f - deg R g)) \<le> deg R f"
   using deg_mult_ring [OF g_in_P monom_closed [OF a_in_R, of "deg R f - deg R g"]]
   apply (cases "a = \<zero>") using g_in_P apply simp
   using deg_monom [OF _ a_in_R, of "deg R f - deg R g"] using deg_le by simp
 
 lemma deg_zero_impl_monom:
   assumes f_in_P: "f \<in> carrier P" and deg_f: "deg R f = 0"
   shows "f = monom P (coeff P f 0) 0"
   apply (rule up_eqI) using coeff_monom [OF coeff_closed [OF f_in_P], of 0 0]
   using f_in_P deg_f using deg_aboveD [of f _] by auto
 
 end
 
 
 subsection \<open>The long division proof for commutative rings\<close>
 
 context UP_cring
 begin
 
 lemma exI3: assumes exist: "Pred x y z"
   shows "\<exists> x y z. Pred x y z"
   using exist by blast
 
 text \<open>Jacobson's Theorem 2.14\<close>
 
 lemma long_div_theorem:
   assumes g_in_P [simp]: "g \<in> carrier P" and f_in_P [simp]: "f \<in> carrier P"
   and g_not_zero: "g \<noteq> \<zero>\<^bsub>P\<^esub>"
   shows "\<exists>q r (k::nat). (q \<in> carrier P) \<and> (r \<in> carrier P) \<and> (lcoeff g)[^]\<^bsub>R\<^esub>k \<odot>\<^bsub>P\<^esub> f = g \<otimes>\<^bsub>P\<^esub> q \<oplus>\<^bsub>P\<^esub> r \<and> (r = \<zero>\<^bsub>P\<^esub> \<or> deg R r < deg R g)"
   using f_in_P
 proof (induct "deg R f" arbitrary: "f" rule: nat_less_induct)
   case (1 f)
   note f_in_P [simp] = "1.prems"
   let ?pred = "(\<lambda> q r (k::nat).
     (q \<in> carrier P) \<and> (r \<in> carrier P)
     \<and> (lcoeff g)[^]\<^bsub>R\<^esub>k \<odot>\<^bsub>P\<^esub> f = g \<otimes>\<^bsub>P\<^esub> q \<oplus>\<^bsub>P\<^esub> r \<and> (r = \<zero>\<^bsub>P\<^esub> \<or> deg R r < deg R g))"
   let ?lg = "lcoeff g" and ?lf = "lcoeff f"
   show ?case
   proof (cases "deg R f < deg R g")
     case True
     have "?pred \<zero>\<^bsub>P\<^esub> f 0" using True by force
     then show ?thesis by blast
   next
     case False then have deg_g_le_deg_f: "deg R g \<le> deg R f" by simp
     {
       let ?k = "1::nat"
       let ?f1 = "(g \<otimes>\<^bsub>P\<^esub> (monom P (?lf) (deg R f - deg R g))) \<oplus>\<^bsub>P\<^esub> \<ominus>\<^bsub>P\<^esub> (?lg \<odot>\<^bsub>P\<^esub> f)"
       let ?q = "monom P (?lf) (deg R f - deg R g)"
       have f1_in_carrier: "?f1 \<in> carrier P" and q_in_carrier: "?q \<in> carrier P" by simp_all
       show ?thesis
       proof (cases "deg R f = 0")
         case True
         {
           have deg_g: "deg R g = 0" using True using deg_g_le_deg_f by simp
           have "?pred f \<zero>\<^bsub>P\<^esub> 1"
             using deg_zero_impl_monom [OF g_in_P deg_g]
             using sym [OF monom_mult_is_smult [OF coeff_closed [OF g_in_P, of 0] f_in_P]]
             using deg_g by simp
           then show ?thesis by blast
         }
       next
         case False note deg_f_nzero = False
         {
           have exist: "lcoeff g [^] ?k \<odot>\<^bsub>P\<^esub> f = g \<otimes>\<^bsub>P\<^esub> ?q \<oplus>\<^bsub>P\<^esub> \<ominus>\<^bsub>P\<^esub> ?f1"
             by (simp add: minus_add r_neg sym [
               OF a_assoc [of "g \<otimes>\<^bsub>P\<^esub> ?q" "\<ominus>\<^bsub>P\<^esub> (g \<otimes>\<^bsub>P\<^esub> ?q)" "lcoeff g \<odot>\<^bsub>P\<^esub> f"]])
           have deg_remainder_l_f: "deg R (\<ominus>\<^bsub>P\<^esub> ?f1) < deg R f"
           proof (unfold deg_uminus [OF f1_in_carrier])
             show "deg R ?f1 < deg R f"
             proof (rule deg_lcoeff_cancel)
               show "deg R (\<ominus>\<^bsub>P\<^esub> (?lg \<odot>\<^bsub>P\<^esub> f)) \<le> deg R f"
                 using deg_smult_ring [of ?lg f]
                 using lcoeff_nonzero2 [OF g_in_P g_not_zero] by simp
               show "deg R (g \<otimes>\<^bsub>P\<^esub> ?q) \<le> deg R f"
                 by (simp add: monom_deg_mult [OF f_in_P g_in_P deg_g_le_deg_f, of ?lf])
               show "coeff P (g \<otimes>\<^bsub>P\<^esub> ?q) (deg R f) = \<ominus> coeff P (\<ominus>\<^bsub>P\<^esub> (?lg \<odot>\<^bsub>P\<^esub> f)) (deg R f)"
                 unfolding coeff_mult [OF g_in_P monom_closed
                   [OF lcoeff_closed [OF f_in_P],
                     of "deg R f - deg R g"], of "deg R f"]
                 unfolding coeff_monom [OF lcoeff_closed
                   [OF f_in_P], of "(deg R f - deg R g)"]
                 using R.finsum_cong' [of "{..deg R f}" "{..deg R f}"
                   "(\<lambda>i. coeff P g i \<otimes> (if deg R f - deg R g = deg R f - i then ?lf else \<zero>))"
                   "(\<lambda>i. if deg R g = i then coeff P g i \<otimes> ?lf else \<zero>)"]
                 using R.finsum_singleton [of "deg R g" "{.. deg R f}" "(\<lambda>i. coeff P g i \<otimes> ?lf)"]
                 unfolding Pi_def using deg_g_le_deg_f by force
             qed (simp_all add: deg_f_nzero)
           qed
           then obtain q' r' k'
             where rem_desc: "?lg [^] (k'::nat) \<odot>\<^bsub>P\<^esub> (\<ominus>\<^bsub>P\<^esub> ?f1) = g \<otimes>\<^bsub>P\<^esub> q' \<oplus>\<^bsub>P\<^esub> r'"
             and rem_deg: "(r' = \<zero>\<^bsub>P\<^esub> \<or> deg R r' < deg R g)"
             and q'_in_carrier: "q' \<in> carrier P" and r'_in_carrier: "r' \<in> carrier P"
             using "1.hyps" using f1_in_carrier by blast
           show ?thesis
           proof (rule exI3 [of _ "((?lg [^] k') \<odot>\<^bsub>P\<^esub> ?q \<oplus>\<^bsub>P\<^esub> q')" r' "Suc k'"], intro conjI)
             show "(?lg [^] (Suc k')) \<odot>\<^bsub>P\<^esub> f = g \<otimes>\<^bsub>P\<^esub> ((?lg [^] k') \<odot>\<^bsub>P\<^esub> ?q \<oplus>\<^bsub>P\<^esub> q') \<oplus>\<^bsub>P\<^esub> r'"
             proof -
               have "(?lg [^] (Suc k')) \<odot>\<^bsub>P\<^esub> f = (?lg [^] k') \<odot>\<^bsub>P\<^esub> (g \<otimes>\<^bsub>P\<^esub> ?q \<oplus>\<^bsub>P\<^esub> \<ominus>\<^bsub>P\<^esub> ?f1)"
                 using smult_assoc1 [OF _ _ f_in_P] using exist by simp
               also have "\<dots> = (?lg [^] k') \<odot>\<^bsub>P\<^esub> (g \<otimes>\<^bsub>P\<^esub> ?q) \<oplus>\<^bsub>P\<^esub> ((?lg [^] k') \<odot>\<^bsub>P\<^esub> ( \<ominus>\<^bsub>P\<^esub> ?f1))"
                 using UP_smult_r_distr by simp
               also have "\<dots> = (?lg [^] k') \<odot>\<^bsub>P\<^esub> (g \<otimes>\<^bsub>P\<^esub> ?q) \<oplus>\<^bsub>P\<^esub> (g \<otimes>\<^bsub>P\<^esub> q' \<oplus>\<^bsub>P\<^esub> r')"
                 unfolding rem_desc ..
               also have "\<dots> = (?lg [^] k') \<odot>\<^bsub>P\<^esub> (g \<otimes>\<^bsub>P\<^esub> ?q) \<oplus>\<^bsub>P\<^esub> g \<otimes>\<^bsub>P\<^esub> q' \<oplus>\<^bsub>P\<^esub> r'"
                 using sym [OF a_assoc [of "?lg [^] k' \<odot>\<^bsub>P\<^esub> (g \<otimes>\<^bsub>P\<^esub> ?q)" "g \<otimes>\<^bsub>P\<^esub> q'" "r'"]]
                 using r'_in_carrier q'_in_carrier by simp
               also have "\<dots> = (?lg [^] k') \<odot>\<^bsub>P\<^esub> (?q \<otimes>\<^bsub>P\<^esub> g) \<oplus>\<^bsub>P\<^esub> q' \<otimes>\<^bsub>P\<^esub> g \<oplus>\<^bsub>P\<^esub> r'"
                 using q'_in_carrier by (auto simp add: m_comm)
               also have "\<dots> = (((?lg [^] k') \<odot>\<^bsub>P\<^esub> ?q) \<otimes>\<^bsub>P\<^esub> g) \<oplus>\<^bsub>P\<^esub> q' \<otimes>\<^bsub>P\<^esub> g \<oplus>\<^bsub>P\<^esub> r'"
                 using smult_assoc2 q'_in_carrier "1.prems" by auto
               also have "\<dots> = ((?lg [^] k') \<odot>\<^bsub>P\<^esub> ?q \<oplus>\<^bsub>P\<^esub> q') \<otimes>\<^bsub>P\<^esub> g \<oplus>\<^bsub>P\<^esub> r'"
                 using sym [OF l_distr] and q'_in_carrier by auto
               finally show ?thesis using m_comm q'_in_carrier by auto
             qed
           qed (simp_all add: rem_deg q'_in_carrier r'_in_carrier)
         }
       qed
     }
   qed
 qed
 
 end
 
 
 text \<open>The remainder theorem as corollary of the long division theorem.\<close>
 
 context UP_cring
 begin
 
 lemma deg_minus_monom:
   assumes a: "a \<in> carrier R"
   and R_not_trivial: "(carrier R \<noteq> {\<zero>})"
   shows "deg R (monom P \<one>\<^bsub>R\<^esub> 1 \<ominus>\<^bsub>P\<^esub> monom P a 0) = 1"
   (is "deg R ?g = 1")
 proof -
   have "deg R ?g \<le> 1"
   proof (rule deg_aboveI)
     fix m
     assume "(1::nat) < m"
     then show "coeff P ?g m = \<zero>"
       using coeff_minus using a by auto algebra
   qed (simp add: a)
   moreover have "deg R ?g \<ge> 1"
   proof (rule deg_belowI)
     show "coeff P ?g 1 \<noteq> \<zero>"
       using a using R.carrier_one_not_zero R_not_trivial by simp algebra
   qed (simp add: a)
   ultimately show ?thesis by simp
 qed
 
 lemma lcoeff_monom:
   assumes a: "a \<in> carrier R" and R_not_trivial: "(carrier R \<noteq> {\<zero>})"
   shows "lcoeff (monom P \<one>\<^bsub>R\<^esub> 1 \<ominus>\<^bsub>P\<^esub> monom P a 0) = \<one>"
   using deg_minus_monom [OF a R_not_trivial]
   using coeff_minus a by auto algebra
 
 lemma deg_nzero_nzero:
   assumes deg_p_nzero: "deg R p \<noteq> 0"
   shows "p \<noteq> \<zero>\<^bsub>P\<^esub>"
   using deg_zero deg_p_nzero by auto
 
 lemma deg_monom_minus:
   assumes a: "a \<in> carrier R"
   and R_not_trivial: "carrier R \<noteq> {\<zero>}"
   shows "deg R (monom P \<one>\<^bsub>R\<^esub> 1 \<ominus>\<^bsub>P\<^esub> monom P a 0) = 1"
   (is "deg R ?g = 1")
 proof -
   have "deg R ?g \<le> 1"
   proof (rule deg_aboveI)
     fix m::nat assume "1 < m" then show "coeff P ?g m = \<zero>"
       using coeff_minus [OF monom_closed [OF R.one_closed, of 1] monom_closed [OF a, of 0], of m]
       using coeff_monom [OF R.one_closed, of 1 m] using coeff_monom [OF a, of 0 m] by auto algebra
   qed (simp add: a)
   moreover have "1 \<le> deg R ?g"
   proof (rule deg_belowI)
     show "coeff P ?g 1 \<noteq> \<zero>"
       using coeff_minus [OF monom_closed [OF R.one_closed, of 1] monom_closed [OF a, of 0], of 1]
       using coeff_monom [OF R.one_closed, of 1 1] using coeff_monom [OF a, of 0 1]
       using R_not_trivial using R.carrier_one_not_zero
       by auto algebra
   qed (simp add: a)
   ultimately show ?thesis by simp
 qed
 
 lemma eval_monom_expr:
   assumes a: "a \<in> carrier R"
   shows "eval R R id a (monom P \<one>\<^bsub>R\<^esub> 1 \<ominus>\<^bsub>P\<^esub> monom P a 0) = \<zero>"
   (is "eval R R id a ?g = _")
 proof -
   interpret UP_pre_univ_prop R R id by unfold_locales simp
   have eval_ring_hom: "eval R R id a \<in> ring_hom P R" using eval_ring_hom [OF a] by simp
   interpret ring_hom_cring P R "eval R R id a" by unfold_locales (rule eval_ring_hom)
   have mon1_closed: "monom P \<one>\<^bsub>R\<^esub> 1 \<in> carrier P"
     and mon0_closed: "monom P a 0 \<in> carrier P"
     and min_mon0_closed: "\<ominus>\<^bsub>P\<^esub> monom P a 0 \<in> carrier P"
     using a R.a_inv_closed by auto
   have "eval R R id a ?g = eval R R id a (monom P \<one> 1) \<ominus> eval R R id a (monom P a 0)"
     by (simp add: a_minus_def mon0_closed)
   also have "\<dots> = a \<ominus> a"
     using eval_monom [OF R.one_closed a, of 1] using eval_monom [OF a a, of 0] using a by simp
   also have "\<dots> = \<zero>"
     using a by algebra
   finally show ?thesis by simp
 qed
 
 lemma remainder_theorem_exist:
   assumes f: "f \<in> carrier P" and a: "a \<in> carrier R"
   and R_not_trivial: "carrier R \<noteq> {\<zero>}"
   shows "\<exists> q r. (q \<in> carrier P) \<and> (r \<in> carrier P) \<and> f = (monom P \<one>\<^bsub>R\<^esub> 1 \<ominus>\<^bsub>P\<^esub> monom P a 0) \<otimes>\<^bsub>P\<^esub> q \<oplus>\<^bsub>P\<^esub> r \<and> (deg R r = 0)"
   (is "\<exists> q r. (q \<in> carrier P) \<and> (r \<in> carrier P) \<and> f = ?g \<otimes>\<^bsub>P\<^esub> q \<oplus>\<^bsub>P\<^esub> r \<and> (deg R r = 0)")
 proof -
   let ?g = "monom P \<one>\<^bsub>R\<^esub> 1 \<ominus>\<^bsub>P\<^esub> monom P a 0"
   from deg_minus_monom [OF a R_not_trivial]
   have deg_g_nzero: "deg R ?g \<noteq> 0" by simp
   have "\<exists>q r (k::nat). q \<in> carrier P \<and> r \<in> carrier P \<and>
     lcoeff ?g [^] k \<odot>\<^bsub>P\<^esub> f = ?g \<otimes>\<^bsub>P\<^esub> q \<oplus>\<^bsub>P\<^esub> r \<and> (r = \<zero>\<^bsub>P\<^esub> \<or> deg R r < deg R ?g)"
     using long_div_theorem [OF _ f deg_nzero_nzero [OF deg_g_nzero]] a
     by auto
   then show ?thesis
     unfolding lcoeff_monom [OF a R_not_trivial]
     unfolding deg_monom_minus [OF a R_not_trivial]
     using smult_one [OF f] using deg_zero by force
 qed
 
 lemma remainder_theorem_expression:
   assumes f [simp]: "f \<in> carrier P" and a [simp]: "a \<in> carrier R"
   and q [simp]: "q \<in> carrier P" and r [simp]: "r \<in> carrier P"
   and R_not_trivial: "carrier R \<noteq> {\<zero>}"
   and f_expr: "f = (monom P \<one>\<^bsub>R\<^esub> 1 \<ominus>\<^bsub>P\<^esub> monom P a 0) \<otimes>\<^bsub>P\<^esub> q \<oplus>\<^bsub>P\<^esub> r"
   (is "f = ?g \<otimes>\<^bsub>P\<^esub> q \<oplus>\<^bsub>P\<^esub> r" is "f = ?gq \<oplus>\<^bsub>P\<^esub> r")
     and deg_r_0: "deg R r = 0"
     shows "r = monom P (eval R R id a f) 0"
 proof -
   interpret UP_pre_univ_prop R R id P by standard simp
   have eval_ring_hom: "eval R R id a \<in> ring_hom P R"
     using eval_ring_hom [OF a] by simp
   have "eval R R id a f = eval R R id a ?gq \<oplus>\<^bsub>R\<^esub> eval R R id a r"
     unfolding f_expr using ring_hom_add [OF eval_ring_hom] by auto
   also have "\<dots> = ((eval R R id a ?g) \<otimes> (eval R R id a q)) \<oplus>\<^bsub>R\<^esub> eval R R id a r"
     using ring_hom_mult [OF eval_ring_hom] by auto
   also have "\<dots> = \<zero> \<oplus> eval R R id a r"
     unfolding eval_monom_expr [OF a] using eval_ring_hom
     unfolding ring_hom_def using q unfolding Pi_def by simp
   also have "\<dots> = eval R R id a r"
     using eval_ring_hom unfolding ring_hom_def using r unfolding Pi_def by simp
   finally have eval_eq: "eval R R id a f = eval R R id a r" by simp
   from deg_zero_impl_monom [OF r deg_r_0]
   have "r = monom P (coeff P r 0) 0" by simp
   with eval_const [OF a, of "coeff P r 0"] eval_eq
   show ?thesis by auto
 qed
 
 corollary remainder_theorem:
   assumes f [simp]: "f \<in> carrier P" and a [simp]: "a \<in> carrier R"
   and R_not_trivial: "carrier R \<noteq> {\<zero>}"
   shows "\<exists> q r. (q \<in> carrier P) \<and> (r \<in> carrier P) \<and>
      f = (monom P \<one>\<^bsub>R\<^esub> 1 \<ominus>\<^bsub>P\<^esub> monom P a 0) \<otimes>\<^bsub>P\<^esub> q \<oplus>\<^bsub>P\<^esub> monom P (eval R R id a f) 0"
   (is "\<exists> q r. (q \<in> carrier P) \<and> (r \<in> carrier P) \<and> f = ?g \<otimes>\<^bsub>P\<^esub> q \<oplus>\<^bsub>P\<^esub> monom P (eval R R id a f) 0")
 proof -
   from remainder_theorem_exist [OF f a R_not_trivial]
   obtain q r
     where q_r: "q \<in> carrier P \<and> r \<in> carrier P \<and> f = ?g \<otimes>\<^bsub>P\<^esub> q \<oplus>\<^bsub>P\<^esub> r"
     and deg_r: "deg R r = 0" by force
   with remainder_theorem_expression [OF f a _ _ R_not_trivial, of q r]
   show ?thesis by auto
 qed
 
 end
 
 
 subsection \<open>Sample Application of Evaluation Homomorphism\<close>
 
 lemma UP_pre_univ_propI:
   assumes "cring R"
     and "cring S"
     and "h \<in> ring_hom R S"
   shows "UP_pre_univ_prop R S h"
   using assms
   by (auto intro!: UP_pre_univ_prop.intro ring_hom_cring.intro
     ring_hom_cring_axioms.intro UP_cring.intro)
 
 definition
   INTEG :: "int ring"
   where "INTEG = \<lparr>carrier = UNIV, mult = (*), one = 1, zero = 0, add = (+)\<rparr>"
 
 lemma INTEG_cring: "cring INTEG"
   by (unfold INTEG_def) (auto intro!: cringI abelian_groupI comm_monoidI
     left_minus distrib_right)
 
 lemma INTEG_id_eval:
   "UP_pre_univ_prop INTEG INTEG id"
   by (fast intro: UP_pre_univ_propI INTEG_cring id_ring_hom)
 
 text \<open>
   Interpretation now enables to import all theorems and lemmas
   valid in the context of homomorphisms between \<^term>\<open>INTEG\<close> and \<^term>\<open>UP INTEG\<close> globally.
 \<close>
 
 interpretation INTEG: UP_pre_univ_prop INTEG INTEG id "UP INTEG"
   using INTEG_id_eval by simp_all
 
 lemma INTEG_closed [intro, simp]:
   "z \<in> carrier INTEG"
   by (unfold INTEG_def) simp
 
 lemma INTEG_mult [simp]:
   "mult INTEG z w = z * w"
   by (unfold INTEG_def) simp
 
 lemma INTEG_pow [simp]:
   "pow INTEG z n = z ^ n"
   by (induct n) (simp_all add: INTEG_def nat_pow_def)
 
 lemma "eval INTEG INTEG id 10 (monom (UP INTEG) 5 2) = 500"
   by (simp add: INTEG.eval_monom)
 
 end
diff --git a/src/HOL/Analysis/Continuous_Extension.thy b/src/HOL/Analysis/Continuous_Extension.thy
--- a/src/HOL/Analysis/Continuous_Extension.thy
+++ b/src/HOL/Analysis/Continuous_Extension.thy
@@ -1,551 +1,551 @@
 (*  Title:      HOL/Analysis/Continuous_Extension.thy
     Authors:    LC Paulson, based on material from HOL Light
 *)
 
 section \<open>Continuous Extensions of Functions\<close>
 
 theory Continuous_Extension
 imports Starlike
 begin
 
 subsection\<open>Partitions of unity subordinate to locally finite open coverings\<close>
 
 text\<open>A difference from HOL Light: all summations over infinite sets equal zero,
    so the "support" must be made explicit in the summation below!\<close>
 
 proposition subordinate_partition_of_unity:
   fixes S :: "'a::metric_space set"
   assumes "S \<subseteq> \<Union>\<C>" and opC: "\<And>T. T \<in> \<C> \<Longrightarrow> open T"
       and fin: "\<And>x. x \<in> S \<Longrightarrow> \<exists>V. open V \<and> x \<in> V \<and> finite {U \<in> \<C>. U \<inter> V \<noteq> {}}"
   obtains F :: "['a set, 'a] \<Rightarrow> real"
     where "\<And>U. U \<in> \<C> \<Longrightarrow> continuous_on S (F U) \<and> (\<forall>x \<in> S. 0 \<le> F U x)"
       and "\<And>x U. \<lbrakk>U \<in> \<C>; x \<in> S; x \<notin> U\<rbrakk> \<Longrightarrow> F U x = 0"
       and "\<And>x. x \<in> S \<Longrightarrow> supp_sum (\<lambda>W. F W x) \<C> = 1"
       and "\<And>x. x \<in> S \<Longrightarrow> \<exists>V. open V \<and> x \<in> V \<and> finite {U \<in> \<C>. \<exists>x\<in>V. F U x \<noteq> 0}"
 proof (cases "\<exists>W. W \<in> \<C> \<and> S \<subseteq> W")
   case True
     then obtain W where "W \<in> \<C>" "S \<subseteq> W" by metis
     then show ?thesis
       by (rule_tac F = "\<lambda>V x. if V = W then 1 else 0" in that) (auto simp: supp_sum_def support_on_def)
 next
   case False
     have nonneg: "0 \<le> supp_sum (\<lambda>V. setdist {x} (S - V)) \<C>" for x
       by (simp add: supp_sum_def sum_nonneg)
     have sd_pos: "0 < setdist {x} (S - V)" if "V \<in> \<C>" "x \<in> S" "x \<in> V" for V x
     proof -
       have "closedin (top_of_set S) (S - V)"
         by (simp add: Diff_Diff_Int closedin_def opC openin_open_Int \<open>V \<in> \<C>\<close>)
       with that False  setdist_pos_le [of "{x}" "S - V"]
       show ?thesis
         using setdist_gt_0_closedin by fastforce
     qed
     have ss_pos: "0 < supp_sum (\<lambda>V. setdist {x} (S - V)) \<C>" if "x \<in> S" for x
     proof -
       obtain U where "U \<in> \<C>" "x \<in> U" using \<open>x \<in> S\<close> \<open>S \<subseteq> \<Union>\<C>\<close>
         by blast
       obtain V where "open V" "x \<in> V" "finite {U \<in> \<C>. U \<inter> V \<noteq> {}}"
         using \<open>x \<in> S\<close> fin by blast
       then have *: "finite {A \<in> \<C>. \<not> S \<subseteq> A \<and> x \<notin> closure (S - A)}"
         using closure_def that by (blast intro: rev_finite_subset)
       have "x \<notin> closure (S - U)"
         using \<open>U \<in> \<C>\<close> \<open>x \<in> U\<close> opC open_Int_closure_eq_empty by fastforce
       then show ?thesis
         apply (simp add: setdist_eq_0_sing_1 supp_sum_def support_on_def)
         apply (rule ordered_comm_monoid_add_class.sum_pos2 [OF *, of U])
         using \<open>U \<in> \<C>\<close> \<open>x \<in> U\<close> False
         apply (auto simp: sd_pos that)
         done
     qed
     define F where
       "F \<equiv> \<lambda>W x. if x \<in> S then setdist {x} (S - W) / supp_sum (\<lambda>V. setdist {x} (S - V)) \<C> else 0"
     show ?thesis
     proof (rule_tac F = F in that)
       have "continuous_on S (F U)" if "U \<in> \<C>" for U
       proof -
         have *: "continuous_on S (\<lambda>x. supp_sum (\<lambda>V. setdist {x} (S - V)) \<C>)"
         proof (clarsimp simp add: continuous_on_eq_continuous_within)
           fix x assume "x \<in> S"
           then obtain X where "open X" and x: "x \<in> S \<inter> X" and finX: "finite {U \<in> \<C>. U \<inter> X \<noteq> {}}"
             using assms by blast
           then have OSX: "openin (top_of_set S) (S \<inter> X)" by blast
           have sumeq: "\<And>x. x \<in> S \<inter> X \<Longrightarrow>
                      (\<Sum>V | V \<in> \<C> \<and> V \<inter> X \<noteq> {}. setdist {x} (S - V))
                      = supp_sum (\<lambda>V. setdist {x} (S - V)) \<C>"
             apply (simp add: supp_sum_def)
             apply (rule sum.mono_neutral_right [OF finX])
             apply (auto simp: setdist_eq_0_sing_1 support_on_def subset_iff)
             apply (meson DiffI closure_subset disjoint_iff_not_equal subsetCE)
             done
           show "continuous (at x within S) (\<lambda>x. supp_sum (\<lambda>V. setdist {x} (S - V)) \<C>)"
             apply (rule continuous_transform_within_openin
                      [where f = "\<lambda>x. (sum (\<lambda>V. setdist {x} (S - V)) {V \<in> \<C>. V \<inter> X \<noteq> {}})"
                         and S ="S \<inter> X"])
             apply (rule continuous_intros continuous_at_setdist continuous_at_imp_continuous_at_within OSX x)+
             apply (simp add: sumeq)
             done
         qed
         show ?thesis
           apply (simp add: F_def)
           apply (rule continuous_intros *)+
           using ss_pos apply force
           done
       qed
       moreover have "\<lbrakk>U \<in> \<C>; x \<in> S\<rbrakk> \<Longrightarrow> 0 \<le> F U x" for U x
         using nonneg [of x] by (simp add: F_def field_split_simps)
       ultimately show "\<And>U. U \<in> \<C> \<Longrightarrow> continuous_on S (F U) \<and> (\<forall>x\<in>S. 0 \<le> F U x)"
         by metis
     next
       show "\<And>x U. \<lbrakk>U \<in> \<C>; x \<in> S; x \<notin> U\<rbrakk> \<Longrightarrow> F U x = 0"
         by (simp add: setdist_eq_0_sing_1 closure_def F_def)
     next
       show "supp_sum (\<lambda>W. F W x) \<C> = 1" if "x \<in> S" for x
         using that ss_pos [OF that]
         by (simp add: F_def field_split_simps supp_sum_divide_distrib [symmetric])
     next
       show "\<exists>V. open V \<and> x \<in> V \<and> finite {U \<in> \<C>. \<exists>x\<in>V. F U x \<noteq> 0}" if "x \<in> S" for x
         using fin [OF that] that
         by (fastforce simp: setdist_eq_0_sing_1 closure_def F_def elim!: rev_finite_subset)
     qed
 qed
 
 
 subsection\<open>Urysohn's Lemma for Euclidean Spaces\<close>
 
 text \<open>For Euclidean spaces the proof is easy using distances.\<close>
 
 lemma Urysohn_both_ne:
   assumes US: "closedin (top_of_set U) S"
       and UT: "closedin (top_of_set U) T"
       and "S \<inter> T = {}" "S \<noteq> {}" "T \<noteq> {}" "a \<noteq> b"
   obtains f :: "'a::euclidean_space \<Rightarrow> 'b::real_normed_vector"
     where "continuous_on U f"
           "\<And>x. x \<in> U \<Longrightarrow> f x \<in> closed_segment a b"
           "\<And>x. x \<in> U \<Longrightarrow> (f x = a \<longleftrightarrow> x \<in> S)"
           "\<And>x. x \<in> U \<Longrightarrow> (f x = b \<longleftrightarrow> x \<in> T)"
 proof -
   have S0: "\<And>x. x \<in> U \<Longrightarrow> setdist {x} S = 0 \<longleftrightarrow> x \<in> S"
     using \<open>S \<noteq> {}\<close>  US setdist_eq_0_closedin  by auto
   have T0: "\<And>x. x \<in> U \<Longrightarrow> setdist {x} T = 0 \<longleftrightarrow> x \<in> T"
     using \<open>T \<noteq> {}\<close>  UT setdist_eq_0_closedin  by auto
   have sdpos: "0 < setdist {x} S + setdist {x} T" if "x \<in> U" for x
   proof -
     have "\<not> (setdist {x} S = 0 \<and> setdist {x} T = 0)"
       using assms by (metis IntI empty_iff setdist_eq_0_closedin that)
     then show ?thesis
       by (metis add.left_neutral add.right_neutral add_pos_pos linorder_neqE_linordered_idom not_le setdist_pos_le)
   qed
   define f where "f \<equiv> \<lambda>x. a + (setdist {x} S / (setdist {x} S + setdist {x} T)) *\<^sub>R (b - a)"
   show ?thesis
   proof (rule_tac f = f in that)
     show "continuous_on U f"
       using sdpos unfolding f_def
       by (intro continuous_intros | force)+
     show "f x \<in> closed_segment a b" if "x \<in> U" for x
         unfolding f_def
       apply (simp add: closed_segment_def)
       apply (rule_tac x="(setdist {x} S / (setdist {x} S + setdist {x} T))" in exI)
       using sdpos that apply (simp add: algebra_simps)
       done
     show "\<And>x. x \<in> U \<Longrightarrow> (f x = a \<longleftrightarrow> x \<in> S)"
       using S0 \<open>a \<noteq> b\<close> f_def sdpos by force
     show "(f x = b \<longleftrightarrow> x \<in> T)" if "x \<in> U" for x
     proof -
       have "f x = b \<longleftrightarrow> (setdist {x} S / (setdist {x} S + setdist {x} T)) = 1"
         unfolding f_def
         apply (rule iffI)
          apply (metis  \<open>a \<noteq> b\<close> add_diff_cancel_left' eq_iff_diff_eq_0 pth_1 real_vector.scale_right_imp_eq, force)
         done
       also have "...  \<longleftrightarrow> setdist {x} T = 0 \<and> setdist {x} S \<noteq> 0"
         using sdpos that
         by (simp add: field_split_simps) linarith
       also have "...  \<longleftrightarrow> x \<in> T"
         using \<open>S \<noteq> {}\<close> \<open>T \<noteq> {}\<close> \<open>S \<inter> T = {}\<close> that
         by (force simp: S0 T0)
       finally show ?thesis .
     qed
   qed
 qed
 
 proposition Urysohn_local_strong:
   assumes US: "closedin (top_of_set U) S"
       and UT: "closedin (top_of_set U) T"
       and "S \<inter> T = {}" "a \<noteq> b"
   obtains f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
     where "continuous_on U f"
           "\<And>x. x \<in> U \<Longrightarrow> f x \<in> closed_segment a b"
           "\<And>x. x \<in> U \<Longrightarrow> (f x = a \<longleftrightarrow> x \<in> S)"
           "\<And>x. x \<in> U \<Longrightarrow> (f x = b \<longleftrightarrow> x \<in> T)"
 proof (cases "S = {}")
   case True show ?thesis
   proof (cases "T = {}")
     case True show ?thesis
     proof (rule_tac f = "\<lambda>x. midpoint a b" in that)
       show "continuous_on U (\<lambda>x. midpoint a b)"
         by (intro continuous_intros)
       show "midpoint a b \<in> closed_segment a b"
         using csegment_midpoint_subset by blast
       show "(midpoint a b = a) = (x \<in> S)" for x
         using \<open>S = {}\<close> \<open>a \<noteq> b\<close> by simp
       show "(midpoint a b = b) = (x \<in> T)" for x
         using \<open>T = {}\<close> \<open>a \<noteq> b\<close> by simp
     qed
   next
     case False
     show ?thesis
     proof (cases "T = U")
       case True with \<open>S = {}\<close> \<open>a \<noteq> b\<close> show ?thesis
         by (rule_tac f = "\<lambda>x. b" in that) (auto)
     next
       case False
       with UT closedin_subset obtain c where c: "c \<in> U" "c \<notin> T"
         by fastforce
       obtain f where f: "continuous_on U f"
                 "\<And>x. x \<in> U \<Longrightarrow> f x \<in> closed_segment (midpoint a b) b"
                 "\<And>x. x \<in> U \<Longrightarrow> (f x = midpoint a b \<longleftrightarrow> x = c)"
                 "\<And>x. x \<in> U \<Longrightarrow> (f x = b \<longleftrightarrow> x \<in> T)"
         apply (rule Urysohn_both_ne [of U "{c}" T "midpoint a b" "b"])
         using c \<open>T \<noteq> {}\<close> assms apply simp_all
         done
       show ?thesis
         apply (rule_tac f=f in that)
         using \<open>S = {}\<close> \<open>T \<noteq> {}\<close> f csegment_midpoint_subset notin_segment_midpoint [OF \<open>a \<noteq> b\<close>]
         apply force+
         done
     qed
   qed
 next
   case False
   show ?thesis
   proof (cases "T = {}")
     case True show ?thesis
     proof (cases "S = U")
       case True with \<open>T = {}\<close> \<open>a \<noteq> b\<close> show ?thesis
         by (rule_tac f = "\<lambda>x. a" in that) (auto)
     next
       case False
       with US closedin_subset obtain c where c: "c \<in> U" "c \<notin> S"
         by fastforce
       obtain f where f: "continuous_on U f"
                 "\<And>x. x \<in> U \<Longrightarrow> f x \<in> closed_segment a (midpoint a b)"
                 "\<And>x. x \<in> U \<Longrightarrow> (f x = midpoint a b \<longleftrightarrow> x = c)"
                 "\<And>x. x \<in> U \<Longrightarrow> (f x = a \<longleftrightarrow> x \<in> S)"
         apply (rule Urysohn_both_ne [of U S "{c}" a "midpoint a b"])
         using c \<open>S \<noteq> {}\<close> assms apply simp_all
         apply (metis midpoint_eq_endpoint)
         done
       show ?thesis
         apply (rule_tac f=f in that)
         using \<open>S \<noteq> {}\<close> \<open>T = {}\<close> f  \<open>a \<noteq> b\<close>
         apply simp_all
         apply (metis (no_types) closed_segment_commute csegment_midpoint_subset midpoint_sym subset_iff)
         apply (metis closed_segment_commute midpoint_sym notin_segment_midpoint)
         done
     qed
   next
     case False
     show ?thesis
       using Urysohn_both_ne [OF US UT \<open>S \<inter> T = {}\<close> \<open>S \<noteq> {}\<close> \<open>T \<noteq> {}\<close> \<open>a \<noteq> b\<close>] that
       by blast
   qed
 qed
 
 lemma Urysohn_local:
   assumes US: "closedin (top_of_set U) S"
       and UT: "closedin (top_of_set U) T"
       and "S \<inter> T = {}"
   obtains f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
     where "continuous_on U f"
           "\<And>x. x \<in> U \<Longrightarrow> f x \<in> closed_segment a b"
           "\<And>x. x \<in> S \<Longrightarrow> f x = a"
           "\<And>x. x \<in> T \<Longrightarrow> f x = b"
 proof (cases "a = b")
   case True then show ?thesis
     by (rule_tac f = "\<lambda>x. b" in that) (auto)
 next
   case False
   then show ?thesis
     apply (rule Urysohn_local_strong [OF assms])
     apply (erule that, assumption)
     apply (meson US closedin_singleton closedin_trans)
     apply (meson UT closedin_singleton closedin_trans)
     done
 qed
 
 lemma Urysohn_strong:
   assumes US: "closed S"
       and UT: "closed T"
       and "S \<inter> T = {}" "a \<noteq> b"
   obtains f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
     where "continuous_on UNIV f"
           "\<And>x. f x \<in> closed_segment a b"
           "\<And>x. f x = a \<longleftrightarrow> x \<in> S"
           "\<And>x. f x = b \<longleftrightarrow> x \<in> T"
 using assms by (auto intro: Urysohn_local_strong [of UNIV S T])
 
 proposition Urysohn:
   assumes US: "closed S"
       and UT: "closed T"
       and "S \<inter> T = {}"
   obtains f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
     where "continuous_on UNIV f"
           "\<And>x. f x \<in> closed_segment a b"
           "\<And>x. x \<in> S \<Longrightarrow> f x = a"
           "\<And>x. x \<in> T \<Longrightarrow> f x = b"
   using assms by (auto intro: Urysohn_local [of UNIV S T a b])
 
 
 subsection\<open>Dugundji's Extension Theorem and Tietze Variants\<close>
 
-text \<open>See \cite{dugundji}.\<close>
+text \<open>See \<^cite>\<open>"dugundji"\<close>.\<close>
 
 lemma convex_supp_sum:
   assumes "convex S" and 1: "supp_sum u I = 1"
       and "\<And>i. i \<in> I \<Longrightarrow> 0 \<le> u i \<and> (u i = 0 \<or> f i \<in> S)"
     shows "supp_sum (\<lambda>i. u i *\<^sub>R f i) I \<in> S"
 proof -
   have fin: "finite {i \<in> I. u i \<noteq> 0}"
     using 1 sum.infinite by (force simp: supp_sum_def support_on_def)
   then have "supp_sum (\<lambda>i. u i *\<^sub>R f i) I = sum (\<lambda>i. u i *\<^sub>R f i) {i \<in> I. u i \<noteq> 0}"
     by (force intro: sum.mono_neutral_left simp: supp_sum_def support_on_def)
   also have "... \<in> S"
     using 1 assms by (force simp: supp_sum_def support_on_def intro: convex_sum [OF fin \<open>convex S\<close>])
   finally show ?thesis .
 qed
 
 theorem Dugundji:
   fixes f :: "'a::{metric_space,second_countable_topology} \<Rightarrow> 'b::real_inner"
   assumes "convex C" "C \<noteq> {}"
       and cloin: "closedin (top_of_set U) S"
       and contf: "continuous_on S f" and "f ` S \<subseteq> C"
   obtains g where "continuous_on U g" "g ` U \<subseteq> C"
                   "\<And>x. x \<in> S \<Longrightarrow> g x = f x"
 proof (cases "S = {}")
   case True then show thesis
     apply (rule_tac g="\<lambda>x. SOME y. y \<in> C" in that)
       apply (rule continuous_intros)
      apply (meson all_not_in_conv \<open>C \<noteq> {}\<close> image_subsetI someI_ex, simp)
     done
 next
   case False
   then have sd_pos: "\<And>x. \<lbrakk>x \<in> U; x \<notin> S\<rbrakk> \<Longrightarrow> 0 < setdist {x} S"
     using setdist_eq_0_closedin [OF cloin] le_less setdist_pos_le by fastforce
   define \<B> where "\<B> = {ball x (setdist {x} S / 2) |x. x \<in> U - S}"
   have [simp]: "\<And>T. T \<in> \<B> \<Longrightarrow> open T"
     by (auto simp: \<B>_def)
   have USS: "U - S \<subseteq> \<Union>\<B>"
     by (auto simp: sd_pos \<B>_def)
   obtain \<C> where USsub: "U - S \<subseteq> \<Union>\<C>"
        and nbrhd: "\<And>U. U \<in> \<C> \<Longrightarrow> open U \<and> (\<exists>T. T \<in> \<B> \<and> U \<subseteq> T)"
        and fin: "\<And>x. x \<in> U - S \<Longrightarrow> \<exists>V. open V \<and> x \<in> V \<and> finite {U. U \<in> \<C> \<and> U \<inter> V \<noteq> {}}"
     by (rule paracompact [OF USS]) auto
   have "\<exists>v a. v \<in> U \<and> v \<notin> S \<and> a \<in> S \<and>
               T \<subseteq> ball v (setdist {v} S / 2) \<and>
               dist v a \<le> 2 * setdist {v} S" if "T \<in> \<C>" for T
   proof -
     obtain v where v: "T \<subseteq> ball v (setdist {v} S / 2)" "v \<in> U" "v \<notin> S"
       using \<open>T \<in> \<C>\<close> nbrhd by (force simp: \<B>_def)
     then obtain a where "a \<in> S" "dist v a < 2 * setdist {v} S"
       using setdist_ltE [of "{v}" S "2 * setdist {v} S"]
       using False sd_pos by force
     with v show ?thesis
       apply (rule_tac x=v in exI)
       apply (rule_tac x=a in exI, auto)
       done
   qed
   then obtain \<V> \<A> where
     VA: "\<And>T. T \<in> \<C> \<Longrightarrow> \<V> T \<in> U \<and> \<V> T \<notin> S \<and> \<A> T \<in> S \<and>
               T \<subseteq> ball (\<V> T) (setdist {\<V> T} S / 2) \<and>
               dist (\<V> T) (\<A> T) \<le> 2 * setdist {\<V> T} S"
     by metis
   have sdle: "setdist {\<V> T} S \<le> 2 * setdist {v} S" if "T \<in> \<C>" "v \<in> T" for T v
     using setdist_Lipschitz [of "\<V> T" S v] VA [OF \<open>T \<in> \<C>\<close>] \<open>v \<in> T\<close> by auto
   have d6: "dist a (\<A> T) \<le> 6 * dist a v" if "T \<in> \<C>" "v \<in> T" "a \<in> S" for T v a
   proof -
     have "dist (\<V> T) v < setdist {\<V> T} S / 2"
       using that VA mem_ball by blast
     also have "\<dots> \<le> setdist {v} S"
       using sdle [OF \<open>T \<in> \<C>\<close> \<open>v \<in> T\<close>] by simp
     also have vS: "setdist {v} S \<le> dist a v"
       by (simp add: setdist_le_dist setdist_sym \<open>a \<in> S\<close>)
     finally have VTV: "dist (\<V> T) v < dist a v" .
     have VTS: "setdist {\<V> T} S \<le> 2 * dist a v"
       using sdle that vS by force
     have "dist a (\<A> T) \<le> dist a v + dist v (\<V> T) + dist (\<V> T) (\<A> T)"
       by (metis add.commute add_le_cancel_left dist_commute dist_triangle2 dist_triangle_le)
     also have "\<dots> \<le> dist a v + dist a v + dist (\<V> T) (\<A> T)"
       using VTV by (simp add: dist_commute)
     also have "\<dots> \<le> 2 * dist a v + 2 * setdist {\<V> T} S"
       using VA [OF \<open>T \<in> \<C>\<close>] by auto
     finally show ?thesis
       using VTS by linarith
   qed
   obtain H :: "['a set, 'a] \<Rightarrow> real"
     where Hcont: "\<And>Z. Z \<in> \<C> \<Longrightarrow> continuous_on (U-S) (H Z)"
       and Hge0: "\<And>Z x. \<lbrakk>Z \<in> \<C>; x \<in> U-S\<rbrakk> \<Longrightarrow> 0 \<le> H Z x"
       and Heq0: "\<And>x Z. \<lbrakk>Z \<in> \<C>; x \<in> U-S; x \<notin> Z\<rbrakk> \<Longrightarrow> H Z x = 0"
       and H1: "\<And>x. x \<in> U-S \<Longrightarrow> supp_sum (\<lambda>W. H W x) \<C> = 1"
       and Hfin: "\<And>x. x \<in> U-S \<Longrightarrow> \<exists>V. open V \<and> x \<in> V \<and> finite {U \<in> \<C>. \<exists>x\<in>V. H U x \<noteq> 0}"
     apply (rule subordinate_partition_of_unity [OF USsub _ fin])
     using nbrhd by auto
   define g where "g \<equiv> \<lambda>x. if x \<in> S then f x else supp_sum (\<lambda>T. H T x *\<^sub>R f(\<A> T)) \<C>"
   show ?thesis
   proof (rule that)
     show "continuous_on U g"
     proof (clarsimp simp: continuous_on_eq_continuous_within)
       fix a assume "a \<in> U"
       show "continuous (at a within U) g"
       proof (cases "a \<in> S")
         case True show ?thesis
         proof (clarsimp simp add: continuous_within_topological)
           fix W
           assume "open W" "g a \<in> W"
           then obtain e where "0 < e" and e: "ball (f a) e \<subseteq> W"
             using openE True g_def by auto
           have "continuous (at a within S) f"
             using True contf continuous_on_eq_continuous_within by blast
           then obtain d where "0 < d"
                         and d: "\<And>x. \<lbrakk>x \<in> S; dist x a < d\<rbrakk> \<Longrightarrow> dist (f x) (f a) < e"
             using continuous_within_eps_delta \<open>0 < e\<close> by force
           have "g y \<in> ball (f a) e" if "y \<in> U" and y: "y \<in> ball a (d / 6)" for y
           proof (cases "y \<in> S")
             case True
             then have "dist (f a) (f y) < e"
               by (metis ball_divide_subset_numeral dist_commute in_mono mem_ball y d)
             then show ?thesis
               by (simp add: True g_def)
           next
             case False
             have *: "dist (f (\<A> T)) (f a) < e" if "T \<in> \<C>" "H T y \<noteq> 0" for T
             proof -
               have "y \<in> T"
                 using Heq0 that False \<open>y \<in> U\<close> by blast
               have "dist (\<A> T) a < d"
                 using d6 [OF \<open>T \<in> \<C>\<close> \<open>y \<in> T\<close> \<open>a \<in> S\<close>] y
                 by (simp add: dist_commute mult.commute)
               then show ?thesis
                 using VA [OF \<open>T \<in> \<C>\<close>] by (auto simp: d)
             qed
             have "supp_sum (\<lambda>T. H T y *\<^sub>R f (\<A> T)) \<C> \<in> ball (f a) e"
               apply (rule convex_supp_sum [OF convex_ball])
               apply (simp_all add: False H1 Hge0 \<open>y \<in> U\<close>)
               by (metis dist_commute *)
             then show ?thesis
               by (simp add: False g_def)
           qed
           then show "\<exists>A. open A \<and> a \<in> A \<and> (\<forall>y\<in>U. y \<in> A \<longrightarrow> g y \<in> W)"
             apply (rule_tac x = "ball a (d / 6)" in exI)
             using e \<open>0 < d\<close> by fastforce
         qed
       next
         case False
         obtain N where N: "open N" "a \<in> N"
                    and finN: "finite {U \<in> \<C>. \<exists>a\<in>N. H U a \<noteq> 0}"
           using Hfin False \<open>a \<in> U\<close> by auto
         have oUS: "openin (top_of_set U) (U - S)"
           using cloin by (simp add: openin_diff)
         have HcontU: "continuous (at a within U) (H T)" if "T \<in> \<C>" for T
           using Hcont [OF \<open>T \<in> \<C>\<close>] False  \<open>a \<in> U\<close> \<open>T \<in> \<C>\<close>
           apply (simp add: continuous_on_eq_continuous_within continuous_within)
           apply (rule Lim_transform_within_set)
           using oUS
             apply (force simp: eventually_at openin_contains_ball dist_commute dest!: bspec)+
           done
         show ?thesis
         proof (rule continuous_transform_within_openin [OF _ oUS])
           show "continuous (at a within U) (\<lambda>x. supp_sum (\<lambda>T. H T x *\<^sub>R f (\<A> T)) \<C>)"
           proof (rule continuous_transform_within_openin)
             show "continuous (at a within U)
                     (\<lambda>x. \<Sum>T\<in>{U \<in> \<C>. \<exists>x\<in>N. H U x \<noteq> 0}. H T x *\<^sub>R f (\<A> T))"
               by (force intro: continuous_intros HcontU)+
           next
             show "openin (top_of_set U) ((U - S) \<inter> N)"
               using N oUS openin_trans by blast
           next
             show "a \<in> (U - S) \<inter> N" using False \<open>a \<in> U\<close> N by blast
           next
             show "\<And>x. x \<in> (U - S) \<inter> N \<Longrightarrow>
                          (\<Sum>T \<in> {U \<in> \<C>. \<exists>x\<in>N. H U x \<noteq> 0}. H T x *\<^sub>R f (\<A> T))
                          = supp_sum (\<lambda>T. H T x *\<^sub>R f (\<A> T)) \<C>"
               by (auto simp: supp_sum_def support_on_def
                        intro: sum.mono_neutral_right [OF finN])
           qed
         next
           show "a \<in> U - S" using False \<open>a \<in> U\<close> by blast
         next
           show "\<And>x. x \<in> U - S \<Longrightarrow> supp_sum (\<lambda>T. H T x *\<^sub>R f (\<A> T)) \<C> = g x"
             by (simp add: g_def)
         qed
       qed
     qed
     show "g ` U \<subseteq> C"
       using \<open>f ` S \<subseteq> C\<close> VA
       by (fastforce simp: g_def Hge0 intro!: convex_supp_sum [OF \<open>convex C\<close>] H1)
     show "\<And>x. x \<in> S \<Longrightarrow> g x = f x"
       by (simp add: g_def)
   qed
 qed
 
 
 corollary Tietze:
   fixes f :: "'a::{metric_space,second_countable_topology} \<Rightarrow> 'b::real_inner"
   assumes "continuous_on S f"
     and "closedin (top_of_set U) S"
     and "0 \<le> B"
     and "\<And>x. x \<in> S \<Longrightarrow> norm(f x) \<le> B"
   obtains g where "continuous_on U g" "\<And>x. x \<in> S \<Longrightarrow> g x = f x"
     "\<And>x. x \<in> U \<Longrightarrow> norm(g x) \<le> B"
   using assms by (auto simp: image_subset_iff intro: Dugundji [of "cball 0 B" U S f])
 
 corollary\<^marker>\<open>tag unimportant\<close> Tietze_closed_interval:
   fixes f :: "'a::{metric_space,second_countable_topology} \<Rightarrow> 'b::euclidean_space"
   assumes "continuous_on S f"
     and "closedin (top_of_set U) S"
     and "cbox a b \<noteq> {}"
     and "\<And>x. x \<in> S \<Longrightarrow> f x \<in> cbox a b"
   obtains g where "continuous_on U g" "\<And>x. x \<in> S \<Longrightarrow> g x = f x"
     "\<And>x. x \<in> U \<Longrightarrow> g x \<in> cbox a b"
   apply (rule Dugundji [of "cbox a b" U S f])
   using assms by auto
 
 corollary\<^marker>\<open>tag unimportant\<close> Tietze_closed_interval_1:
   fixes f :: "'a::{metric_space,second_countable_topology} \<Rightarrow> real"
   assumes "continuous_on S f"
     and "closedin (top_of_set U) S"
     and "a \<le> b"
     and "\<And>x. x \<in> S \<Longrightarrow> f x \<in> cbox a b"
   obtains g where "continuous_on U g" "\<And>x. x \<in> S \<Longrightarrow> g x = f x"
     "\<And>x. x \<in> U \<Longrightarrow> g x \<in> cbox a b"
   apply (rule Dugundji [of "cbox a b" U S f])
   using assms by (auto simp: image_subset_iff)
 
 corollary\<^marker>\<open>tag unimportant\<close> Tietze_open_interval:
   fixes f :: "'a::{metric_space,second_countable_topology} \<Rightarrow> 'b::euclidean_space"
   assumes "continuous_on S f"
     and "closedin (top_of_set U) S"
     and "box a b \<noteq> {}"
     and "\<And>x. x \<in> S \<Longrightarrow> f x \<in> box a b"
   obtains g where "continuous_on U g" "\<And>x. x \<in> S \<Longrightarrow> g x = f x"
     "\<And>x. x \<in> U \<Longrightarrow> g x \<in> box a b"
   apply (rule Dugundji [of "box a b" U S f])
   using assms by auto
 
 corollary\<^marker>\<open>tag unimportant\<close> Tietze_open_interval_1:
   fixes f :: "'a::{metric_space,second_countable_topology} \<Rightarrow> real"
   assumes "continuous_on S f"
     and "closedin (top_of_set U) S"
     and "a < b"
     and no: "\<And>x. x \<in> S \<Longrightarrow> f x \<in> box a b"
   obtains g where "continuous_on U g" "\<And>x. x \<in> S \<Longrightarrow> g x = f x"
     "\<And>x. x \<in> U \<Longrightarrow> g x \<in> box a b"
   apply (rule Dugundji [of "box a b" U S f])
   using assms by (auto simp: image_subset_iff)
 
 corollary\<^marker>\<open>tag unimportant\<close> Tietze_unbounded:
   fixes f :: "'a::{metric_space,second_countable_topology} \<Rightarrow> 'b::real_inner"
   assumes "continuous_on S f"
     and "closedin (top_of_set U) S"
   obtains g where "continuous_on U g" "\<And>x. x \<in> S \<Longrightarrow> g x = f x"
   apply (rule Dugundji [of UNIV U S f])
   using assms by auto
 
 end
diff --git a/src/HOL/Analysis/Infinite_Sum.thy b/src/HOL/Analysis/Infinite_Sum.thy
--- a/src/HOL/Analysis/Infinite_Sum.thy
+++ b/src/HOL/Analysis/Infinite_Sum.thy
@@ -1,2433 +1,2433 @@
 (*
   Title:    HOL/Analysis/Infinite_Sum.thy
   Author:   Dominique Unruh, University of Tartu
             Manuel Eberl, University of Innsbruck
 
   A theory of sums over possibly infinite sets.
 *)
 
 section \<open>Infinite sums\<close>
 \<^latex>\<open>\label{section:Infinite_Sum}\<close>
 
 text \<open>In this theory, we introduce the definition of infinite sums, i.e., sums ranging over an
 infinite, potentially uncountable index set with no particular ordering.
 (This is different from series. Those are sums indexed by natural numbers,
 and the order of the index set matters.)
 
 Our definition is quite standard: $s:=\sum_{x\in A} f(x)$ is the limit of finite sums $s_F:=\sum_{x\in F} f(x)$ for increasing $F$.
 That is, $s$ is the limit of the net $s_F$ where $F$ are finite subsets of $A$ ordered by inclusion.
 We believe that this is the standard definition for such sums.
-See, e.g., Definition 4.11 in \cite{conway2013course}.
+See, e.g., Definition 4.11 in \<^cite>\<open>"conway2013course"\<close>.
 This definition is quite general: it is well-defined whenever $f$ takes values in some
 commutative monoid endowed with a Hausdorff topology.
 (Examples are reals, complex numbers, normed vector spaces, and more.)\<close>
 
 theory Infinite_Sum
   imports
     Elementary_Topology
     "HOL-Library.Extended_Nonnegative_Real"
     "HOL-Library.Complex_Order"
 begin
 
 subsection \<open>Definition and syntax\<close>
 
 definition has_sum :: \<open>('a \<Rightarrow> 'b :: {comm_monoid_add, topological_space}) \<Rightarrow> 'a set \<Rightarrow> 'b \<Rightarrow> bool\<close> where
   \<open>has_sum f A x \<longleftrightarrow> (sum f \<longlongrightarrow> x) (finite_subsets_at_top A)\<close>
 
 definition summable_on :: "('a \<Rightarrow> 'b::{comm_monoid_add, topological_space}) \<Rightarrow> 'a set \<Rightarrow> bool" (infixr "summable'_on" 46) where
   "f summable_on A \<longleftrightarrow> (\<exists>x. has_sum f A x)"
 
 definition infsum :: "('a \<Rightarrow> 'b::{comm_monoid_add,t2_space}) \<Rightarrow> 'a set \<Rightarrow> 'b" where
   "infsum f A = (if f summable_on A then Lim (finite_subsets_at_top A) (sum f) else 0)"
 
 abbreviation abs_summable_on :: "('a \<Rightarrow> 'b::real_normed_vector) \<Rightarrow> 'a set \<Rightarrow> bool" (infixr "abs'_summable'_on" 46) where
   "f abs_summable_on A \<equiv> (\<lambda>x. norm (f x)) summable_on A"
 
 syntax (ASCII)
   "_infsum" :: "pttrn \<Rightarrow> 'a set \<Rightarrow> 'b \<Rightarrow> 'b::topological_comm_monoid_add"  ("(3INFSUM (_/:_)./ _)" [0, 51, 10] 10)
 syntax
   "_infsum" :: "pttrn \<Rightarrow> 'a set \<Rightarrow> 'b \<Rightarrow> 'b::topological_comm_monoid_add"  ("(2\<Sum>\<^sub>\<infinity>(_/\<in>_)./ _)" [0, 51, 10] 10)
 translations \<comment> \<open>Beware of argument permutation!\<close>
   "\<Sum>\<^sub>\<infinity>i\<in>A. b" \<rightleftharpoons> "CONST infsum (\<lambda>i. b) A"
 
 syntax (ASCII)
   "_univinfsum" :: "pttrn \<Rightarrow> 'a \<Rightarrow> 'a"  ("(3INFSUM _./ _)" [0, 10] 10)
 syntax
   "_univinfsum" :: "pttrn \<Rightarrow> 'a \<Rightarrow> 'a"  ("(2\<Sum>\<^sub>\<infinity>_./ _)" [0, 10] 10)
 translations
   "\<Sum>\<^sub>\<infinity>x. t" \<rightleftharpoons> "CONST infsum (\<lambda>x. t) (CONST UNIV)"
 
 syntax (ASCII)
   "_qinfsum" :: "pttrn \<Rightarrow> bool \<Rightarrow> 'a \<Rightarrow> 'a"  ("(3INFSUM _ |/ _./ _)" [0, 0, 10] 10)
 syntax
   "_qinfsum" :: "pttrn \<Rightarrow> bool \<Rightarrow> 'a \<Rightarrow> 'a"  ("(2\<Sum>\<^sub>\<infinity>_ | (_)./ _)" [0, 0, 10] 10)
 translations
   "\<Sum>\<^sub>\<infinity>x|P. t" => "CONST infsum (\<lambda>x. t) {x. P}"
 
 print_translation \<open>
 let
   fun sum_tr' [Abs (x, Tx, t), Const (@{const_syntax Collect}, _) $ Abs (y, Ty, P)] =
         if x <> y then raise Match
         else
           let
             val x' = Syntax_Trans.mark_bound_body (x, Tx);
             val t' = subst_bound (x', t);
             val P' = subst_bound (x', P);
           in
             Syntax.const @{syntax_const "_qinfsum"} $ Syntax_Trans.mark_bound_abs (x, Tx) $ P' $ t'
           end
     | sum_tr' _ = raise Match;
 in [(@{const_syntax infsum}, K sum_tr')] end
 \<close>
 
 subsection \<open>General properties\<close>
 
 lemma infsumI:
   fixes f g :: \<open>'a \<Rightarrow> 'b::{comm_monoid_add, t2_space}\<close>
   assumes \<open>has_sum f A x\<close>
   shows \<open>infsum f A = x\<close>
   by (metis assms finite_subsets_at_top_neq_bot infsum_def summable_on_def has_sum_def tendsto_Lim)
 
 lemma infsum_eqI:
   fixes f g :: \<open>'a \<Rightarrow> 'b::{comm_monoid_add, t2_space}\<close>
   assumes \<open>x = y\<close>
   assumes \<open>has_sum f A x\<close>
   assumes \<open>has_sum g B y\<close>
   shows \<open>infsum f A = infsum g B\<close>
   by (metis assms(1) assms(2) assms(3) finite_subsets_at_top_neq_bot infsum_def summable_on_def has_sum_def tendsto_Lim)
 
 lemma infsum_eqI':
   fixes f g :: \<open>'a \<Rightarrow> 'b::{comm_monoid_add, t2_space}\<close>
   assumes \<open>\<And>x. has_sum f A x \<longleftrightarrow> has_sum g B x\<close>
   shows \<open>infsum f A = infsum g B\<close>
   by (metis assms infsum_def infsum_eqI summable_on_def)
 
 lemma infsum_not_exists:
   fixes f :: \<open>'a \<Rightarrow> 'b::{comm_monoid_add, t2_space}\<close>
   assumes \<open>\<not> f summable_on A\<close>
   shows \<open>infsum f A = 0\<close>
   by (simp add: assms infsum_def)
 
 lemma summable_iff_has_sum_infsum: "f summable_on A \<longleftrightarrow> has_sum f A (infsum f A)"
   using infsumI summable_on_def by blast
 
 lemma has_sum_infsum[simp]:
   assumes \<open>f summable_on S\<close>
   shows \<open>has_sum f S (infsum f S)\<close>
   using assms by (auto simp: summable_on_def infsum_def has_sum_def tendsto_Lim)
 
 lemma has_sum_cong_neutral:
   fixes f g :: \<open>'a \<Rightarrow> 'b::{comm_monoid_add, topological_space}\<close>
   assumes \<open>\<And>x. x\<in>T-S \<Longrightarrow> g x = 0\<close>
   assumes \<open>\<And>x. x\<in>S-T \<Longrightarrow> f x = 0\<close>
   assumes \<open>\<And>x. x\<in>S\<inter>T \<Longrightarrow> f x = g x\<close>
   shows "has_sum f S x \<longleftrightarrow> has_sum g T x"
 proof -
   have \<open>eventually P (filtermap (sum f) (finite_subsets_at_top S))
       = eventually P (filtermap (sum g) (finite_subsets_at_top T))\<close> for P
   proof 
     assume \<open>eventually P (filtermap (sum f) (finite_subsets_at_top S))\<close>
     then obtain F0 where \<open>finite F0\<close> and \<open>F0 \<subseteq> S\<close> and F0_P: \<open>\<And>F. finite F \<Longrightarrow> F \<subseteq> S \<Longrightarrow> F \<supseteq> F0 \<Longrightarrow> P (sum f F)\<close>
       by (metis (no_types, lifting) eventually_filtermap eventually_finite_subsets_at_top)
     define F0' where \<open>F0' = F0 \<inter> T\<close>
     have [simp]: \<open>finite F0'\<close> \<open>F0' \<subseteq> T\<close>
       by (simp_all add: F0'_def \<open>finite F0\<close>)
     have \<open>P (sum g F)\<close> if \<open>finite F\<close> \<open>F \<subseteq> T\<close> \<open>F \<supseteq> F0'\<close> for F
     proof -
       have \<open>P (sum f ((F\<inter>S) \<union> (F0\<inter>S)))\<close>
         by (intro F0_P) (use \<open>F0 \<subseteq> S\<close> \<open>finite F0\<close> that in auto)
       also have \<open>sum f ((F\<inter>S) \<union> (F0\<inter>S)) = sum g F\<close>
         by (intro sum.mono_neutral_cong) (use that \<open>finite F0\<close> F0'_def assms in auto)
       finally show ?thesis .
     qed
     with \<open>F0' \<subseteq> T\<close> \<open>finite F0'\<close> show \<open>eventually P (filtermap (sum g) (finite_subsets_at_top T))\<close>
       by (metis (no_types, lifting) eventually_filtermap eventually_finite_subsets_at_top)
   next
     assume \<open>eventually P (filtermap (sum g) (finite_subsets_at_top T))\<close>
     then obtain F0 where \<open>finite F0\<close> and \<open>F0 \<subseteq> T\<close> and F0_P: \<open>\<And>F. finite F \<Longrightarrow> F \<subseteq> T \<Longrightarrow> F \<supseteq> F0 \<Longrightarrow> P (sum g F)\<close>
       by (metis (no_types, lifting) eventually_filtermap eventually_finite_subsets_at_top)
     define F0' where \<open>F0' = F0 \<inter> S\<close>
     have [simp]: \<open>finite F0'\<close> \<open>F0' \<subseteq> S\<close>
       by (simp_all add: F0'_def \<open>finite F0\<close>)
     have \<open>P (sum f F)\<close> if \<open>finite F\<close> \<open>F \<subseteq> S\<close> \<open>F \<supseteq> F0'\<close> for F
     proof -
       have \<open>P (sum g ((F\<inter>T) \<union> (F0\<inter>T)))\<close>
         by (intro F0_P) (use \<open>F0 \<subseteq> T\<close> \<open>finite F0\<close> that in auto)
       also have \<open>sum g ((F\<inter>T) \<union> (F0\<inter>T)) = sum f F\<close>
         by (intro sum.mono_neutral_cong) (use that \<open>finite F0\<close> F0'_def assms in auto)
       finally show ?thesis .
     qed
     with \<open>F0' \<subseteq> S\<close> \<open>finite F0'\<close> show \<open>eventually P (filtermap (sum f) (finite_subsets_at_top S))\<close>
       by (metis (no_types, lifting) eventually_filtermap eventually_finite_subsets_at_top)
   qed
 
   then have tendsto_x: "(sum f \<longlongrightarrow> x) (finite_subsets_at_top S) \<longleftrightarrow> (sum g \<longlongrightarrow> x) (finite_subsets_at_top T)" for x
     by (simp add: le_filter_def filterlim_def)
 
   then show ?thesis
     by (simp add: has_sum_def)
 qed
 
 lemma summable_on_cong_neutral: 
   fixes f g :: \<open>'a \<Rightarrow> 'b::{comm_monoid_add, topological_space}\<close>
   assumes \<open>\<And>x. x\<in>T-S \<Longrightarrow> g x = 0\<close>
   assumes \<open>\<And>x. x\<in>S-T \<Longrightarrow> f x = 0\<close>
   assumes \<open>\<And>x. x\<in>S\<inter>T \<Longrightarrow> f x = g x\<close>
   shows "f summable_on S \<longleftrightarrow> g summable_on T"
   using has_sum_cong_neutral[of T S g f, OF assms]
   by (simp add: summable_on_def)
 
 lemma infsum_cong_neutral: 
   fixes f g :: \<open>'a \<Rightarrow> 'b::{comm_monoid_add, t2_space}\<close>
   assumes \<open>\<And>x. x\<in>T-S \<Longrightarrow> g x = 0\<close>
   assumes \<open>\<And>x. x\<in>S-T \<Longrightarrow> f x = 0\<close>
   assumes \<open>\<And>x. x\<in>S\<inter>T \<Longrightarrow> f x = g x\<close>
   shows \<open>infsum f S = infsum g T\<close>
   by (smt (verit, best) assms has_sum_cong_neutral infsum_eqI')
 
 lemma has_sum_cong: 
   assumes "\<And>x. x\<in>A \<Longrightarrow> f x = g x"
   shows "has_sum f A x \<longleftrightarrow> has_sum g A x"
   using assms by (intro has_sum_cong_neutral) auto
 
 lemma summable_on_cong:
   assumes "\<And>x. x\<in>A \<Longrightarrow> f x = g x"
   shows "f summable_on A \<longleftrightarrow> g summable_on A"
   by (metis assms summable_on_def has_sum_cong)
 
 lemma infsum_cong:
   assumes "\<And>x. x\<in>A \<Longrightarrow> f x = g x"
   shows "infsum f A = infsum g A"
   using assms infsum_eqI' has_sum_cong by blast
 
 lemma summable_on_cofin_subset:
   fixes f :: "'a \<Rightarrow> 'b::topological_ab_group_add"
   assumes "f summable_on A" and [simp]: "finite F"
   shows "f summable_on (A - F)"
 proof -
   from assms(1) obtain x where lim_f: "(sum f \<longlongrightarrow> x) (finite_subsets_at_top A)"
     unfolding summable_on_def has_sum_def by auto
   define F' where "F' = F\<inter>A"
   with assms have "finite F'" and "A-F = A-F'"
     by auto
   have "filtermap ((\<union>)F') (finite_subsets_at_top (A-F))
       \<le> finite_subsets_at_top A"
   proof (rule filter_leI)
     fix P assume "eventually P (finite_subsets_at_top A)"
     then obtain X where [simp]: "finite X" and XA: "X \<subseteq> A" 
       and P: "\<forall>Y. finite Y \<and> X \<subseteq> Y \<and> Y \<subseteq> A \<longrightarrow> P Y"
       unfolding eventually_finite_subsets_at_top by auto
     define X' where "X' = X-F"
     hence [simp]: "finite X'" and [simp]: "X' \<subseteq> A-F"
       using XA by auto
     hence "finite Y \<and> X' \<subseteq> Y \<and> Y \<subseteq> A - F \<longrightarrow> P (F' \<union> Y)" for Y
       using P XA unfolding X'_def using F'_def \<open>finite F'\<close> by blast
     thus "eventually P (filtermap ((\<union>) F') (finite_subsets_at_top (A - F)))"
       unfolding eventually_filtermap eventually_finite_subsets_at_top
       by (rule_tac x=X' in exI, simp)
   qed
   with lim_f have "(sum f \<longlongrightarrow> x) (filtermap ((\<union>)F') (finite_subsets_at_top (A-F)))"
     using tendsto_mono by blast
   have "((\<lambda>G. sum f (F' \<union> G)) \<longlongrightarrow> x) (finite_subsets_at_top (A - F))"
     if "((sum f \<circ> (\<union>) F') \<longlongrightarrow> x) (finite_subsets_at_top (A - F))"
     using that unfolding o_def by auto
   hence "((\<lambda>G. sum f (F' \<union> G)) \<longlongrightarrow> x) (finite_subsets_at_top (A-F))"
     using tendsto_compose_filtermap [symmetric]
     by (simp add: \<open>(sum f \<longlongrightarrow> x) (filtermap ((\<union>) F') (finite_subsets_at_top (A - F)))\<close> 
         tendsto_compose_filtermap)
   have "\<forall>Y. finite Y \<and> Y \<subseteq> A - F \<longrightarrow> sum f (F' \<union> Y) = sum f F' + sum f Y"
     by (metis Diff_disjoint Int_Diff \<open>A - F = A - F'\<close> \<open>finite F'\<close> inf.orderE sum.union_disjoint)
   hence "\<forall>\<^sub>F x in finite_subsets_at_top (A - F). sum f (F' \<union> x) = sum f F' + sum f x"
     unfolding eventually_finite_subsets_at_top
     using exI [where x = "{}"]
     by (simp add: \<open>\<And>P. P {} \<Longrightarrow> \<exists>x. P x\<close>) 
   hence "((\<lambda>G. sum f F' + sum f G) \<longlongrightarrow> x) (finite_subsets_at_top (A-F))"
     using tendsto_cong [THEN iffD1 , rotated]
       \<open>((\<lambda>G. sum f (F' \<union> G)) \<longlongrightarrow> x) (finite_subsets_at_top (A - F))\<close> by fastforce
   hence "((\<lambda>G. sum f F' + sum f G) \<longlongrightarrow> sum f F' + (x-sum f F')) (finite_subsets_at_top (A-F))"
     by simp
   hence "(sum f \<longlongrightarrow> x - sum f F') (finite_subsets_at_top (A-F))"
     using tendsto_add_const_iff by blast    
   thus "f summable_on (A - F)"
     unfolding summable_on_def has_sum_def by auto
 qed
 
 lemma
   fixes f :: "'a \<Rightarrow> 'b::{topological_ab_group_add}"
   assumes \<open>has_sum f B b\<close> and \<open>has_sum f A a\<close> and AB: "A \<subseteq> B"
   shows has_sum_Diff: "has_sum f (B - A) (b - a)"
 proof -
   have finite_subsets1:
     "finite_subsets_at_top (B - A) \<le> filtermap (\<lambda>F. F - A) (finite_subsets_at_top B)"
   proof (rule filter_leI)
     fix P assume "eventually P (filtermap (\<lambda>F. F - A) (finite_subsets_at_top B))"
     then obtain X where "finite X" and "X \<subseteq> B" 
       and P: "finite Y \<and> X \<subseteq> Y \<and> Y \<subseteq> B \<longrightarrow> P (Y - A)" for Y
       unfolding eventually_filtermap eventually_finite_subsets_at_top by auto
 
     hence "finite (X-A)" and "X-A \<subseteq> B - A"
       by auto
     moreover have "finite Y \<and> X-A \<subseteq> Y \<and> Y \<subseteq> B - A \<longrightarrow> P Y" for Y
       using P[where Y="Y\<union>X"] \<open>finite X\<close> \<open>X \<subseteq> B\<close>
       by (metis Diff_subset Int_Diff Un_Diff finite_Un inf.orderE le_sup_iff sup.orderE sup_ge2)
     ultimately show "eventually P (finite_subsets_at_top (B - A))"
       unfolding eventually_finite_subsets_at_top by meson
   qed
   have finite_subsets2: 
     "filtermap (\<lambda>F. F \<inter> A) (finite_subsets_at_top B) \<le> finite_subsets_at_top A"
     apply (rule filter_leI)
       using assms unfolding eventually_filtermap eventually_finite_subsets_at_top
       by (metis Int_subset_iff finite_Int inf_le2 subset_trans)
 
   from assms(1) have limB: "(sum f \<longlongrightarrow> b) (finite_subsets_at_top B)"
     using has_sum_def by auto
   from assms(2) have limA: "(sum f \<longlongrightarrow> a) (finite_subsets_at_top A)"
     using has_sum_def by blast
   have "((\<lambda>F. sum f (F\<inter>A)) \<longlongrightarrow> a) (finite_subsets_at_top B)"
   proof (subst asm_rl [of "(\<lambda>F. sum f (F\<inter>A)) = sum f \<circ> (\<lambda>F. F\<inter>A)"])
     show "(\<lambda>F. sum f (F \<inter> A)) = sum f \<circ> (\<lambda>F. F \<inter> A)"
       unfolding o_def by auto
     show "((sum f \<circ> (\<lambda>F. F \<inter> A)) \<longlongrightarrow> a) (finite_subsets_at_top B)"
       unfolding o_def 
       using tendsto_compose_filtermap finite_subsets2 limA tendsto_mono
         \<open>(\<lambda>F. sum f (F \<inter> A)) = sum f \<circ> (\<lambda>F. F \<inter> A)\<close> by fastforce
   qed
 
   with limB have "((\<lambda>F. sum f F - sum f (F\<inter>A)) \<longlongrightarrow> b - a) (finite_subsets_at_top B)"
     using tendsto_diff by blast
   have "sum f X - sum f (X \<inter> A) = sum f (X - A)" if "finite X" and "X \<subseteq> B" for X :: "'a set"
     using that by (metis add_diff_cancel_left' sum.Int_Diff)
   hence "\<forall>\<^sub>F x in finite_subsets_at_top B. sum f x - sum f (x \<inter> A) = sum f (x - A)"
     by (rule eventually_finite_subsets_at_top_weakI)  
   hence "((\<lambda>F. sum f (F-A)) \<longlongrightarrow> b - a) (finite_subsets_at_top B)"
     using tendsto_cong [THEN iffD1 , rotated]
       \<open>((\<lambda>F. sum f F - sum f (F \<inter> A)) \<longlongrightarrow> b - a) (finite_subsets_at_top B)\<close> by fastforce
   hence "(sum f \<longlongrightarrow> b - a) (filtermap (\<lambda>F. F-A) (finite_subsets_at_top B))"
     by (subst tendsto_compose_filtermap[symmetric], simp add: o_def)
   thus ?thesis
     using finite_subsets1 has_sum_def tendsto_mono by blast
 qed
 
 
 lemma
   fixes f :: "'a \<Rightarrow> 'b::{topological_ab_group_add}"
   assumes "f summable_on B" and "f summable_on A" and "A \<subseteq> B"
   shows summable_on_Diff: "f summable_on (B-A)"
   by (meson assms summable_on_def has_sum_Diff)
 
 lemma
   fixes f :: "'a \<Rightarrow> 'b::{topological_ab_group_add,t2_space}"
   assumes "f summable_on B" and "f summable_on A" and AB: "A \<subseteq> B"
   shows infsum_Diff: "infsum f (B - A) = infsum f B - infsum f A"
   by (metis AB assms has_sum_Diff infsumI summable_on_def)
 
 lemma has_sum_mono_neutral:
   fixes f :: "'a\<Rightarrow>'b::{ordered_comm_monoid_add,linorder_topology}"
   (* Does this really require a linorder topology? (Instead of order topology.) *)
   assumes \<open>has_sum f A a\<close> and "has_sum g B b"
   assumes \<open>\<And>x. x \<in> A\<inter>B \<Longrightarrow> f x \<le> g x\<close>
   assumes \<open>\<And>x. x \<in> A-B \<Longrightarrow> f x \<le> 0\<close>
   assumes \<open>\<And>x. x \<in> B-A \<Longrightarrow> g x \<ge> 0\<close>
   shows "a \<le> b"
 proof -
   define f' g' where \<open>f' x = (if x \<in> A then f x else 0)\<close> and \<open>g' x = (if x \<in> B then g x else 0)\<close> for x
   have [simp]: \<open>f summable_on A\<close> \<open>g summable_on B\<close>
     using assms(1,2) summable_on_def by auto
   have \<open>has_sum f' (A\<union>B) a\<close>
     by (smt (verit, best) DiffE IntE Un_iff f'_def assms(1) has_sum_cong_neutral)
   then have f'_lim: \<open>(sum f' \<longlongrightarrow> a) (finite_subsets_at_top (A\<union>B))\<close>
     by (meson has_sum_def)
   have \<open>has_sum g' (A\<union>B) b\<close>
   by (smt (verit, best) DiffD1 DiffD2 IntE UnCI g'_def assms(2) has_sum_cong_neutral)
   then have g'_lim: \<open>(sum g' \<longlongrightarrow> b) (finite_subsets_at_top (A\<union>B))\<close>
     using has_sum_def by blast
 
   have "\<And>X i. \<lbrakk>X \<subseteq> A \<union> B; i \<in> X\<rbrakk> \<Longrightarrow> f' i \<le> g' i"
     using assms by (auto simp: f'_def g'_def)
   then have \<open>\<forall>\<^sub>F x in finite_subsets_at_top (A \<union> B). sum f' x \<le> sum g' x\<close>
     by (intro eventually_finite_subsets_at_top_weakI sum_mono)
   then show ?thesis
     using f'_lim finite_subsets_at_top_neq_bot g'_lim tendsto_le by blast
 qed
 
 lemma infsum_mono_neutral:
   fixes f :: "'a\<Rightarrow>'b::{ordered_comm_monoid_add,linorder_topology}"
   assumes "f summable_on A" and "g summable_on B"
   assumes \<open>\<And>x. x \<in> A\<inter>B \<Longrightarrow> f x \<le> g x\<close>
   assumes \<open>\<And>x. x \<in> A-B \<Longrightarrow> f x \<le> 0\<close>
   assumes \<open>\<And>x. x \<in> B-A \<Longrightarrow> g x \<ge> 0\<close>
   shows "infsum f A \<le> infsum g B"
   by (rule has_sum_mono_neutral[of f A _ g B _]) (use assms in \<open>auto intro: has_sum_infsum\<close>)
 
 lemma has_sum_mono:
   fixes f :: "'a\<Rightarrow>'b::{ordered_comm_monoid_add,linorder_topology}"
   assumes "has_sum f A x" and "has_sum g A y"
   assumes \<open>\<And>x. x \<in> A \<Longrightarrow> f x \<le> g x\<close>
   shows "x \<le> y"
   using assms has_sum_mono_neutral by force
 
 lemma infsum_mono:
   fixes f :: "'a\<Rightarrow>'b::{ordered_comm_monoid_add,linorder_topology}"
   assumes "f summable_on A" and "g summable_on A"
   assumes \<open>\<And>x. x \<in> A \<Longrightarrow> f x \<le> g x\<close>
   shows "infsum f A \<le> infsum g A"
   by (meson assms has_sum_infsum has_sum_mono)
 
 lemma has_sum_finite[simp]:
   assumes "finite F"
   shows "has_sum f F (sum f F)"
   using assms
   by (auto intro: tendsto_Lim simp: finite_subsets_at_top_finite infsum_def has_sum_def principal_eq_bot_iff)
 
 lemma summable_on_finite[simp]:
   fixes f :: \<open>'a \<Rightarrow> 'b::{comm_monoid_add,topological_space}\<close>
   assumes "finite F"
   shows "f summable_on F"
   using assms summable_on_def has_sum_finite by blast
 
 lemma infsum_finite[simp]:
   assumes "finite F"
   shows "infsum f F = sum f F"
   using assms by (auto intro: tendsto_Lim simp: finite_subsets_at_top_finite infsum_def principal_eq_bot_iff)
 
 lemma has_sum_finite_approximation:
   fixes f :: "'a \<Rightarrow> 'b::{comm_monoid_add,metric_space}"
   assumes "has_sum f A x" and "\<epsilon> > 0"
   shows "\<exists>F. finite F \<and> F \<subseteq> A \<and> dist (sum f F) x \<le> \<epsilon>"
 proof -
   have "(sum f \<longlongrightarrow> x) (finite_subsets_at_top A)"
     by (meson assms(1) has_sum_def)
   hence *: "\<forall>\<^sub>F F in (finite_subsets_at_top A). dist (sum f F) x < \<epsilon>"
     using assms(2) by (rule tendstoD)
   thus ?thesis
     unfolding eventually_finite_subsets_at_top by fastforce
 qed
 
 lemma infsum_finite_approximation:
   fixes f :: "'a \<Rightarrow> 'b::{comm_monoid_add,metric_space}"
   assumes "f summable_on A" and "\<epsilon> > 0"
   shows "\<exists>F. finite F \<and> F \<subseteq> A \<and> dist (sum f F) (infsum f A) \<le> \<epsilon>"
 proof -
   from assms have "has_sum f A (infsum f A)"
     by (simp add: summable_iff_has_sum_infsum)
   from this and \<open>\<epsilon> > 0\<close> show ?thesis
     by (rule has_sum_finite_approximation)
 qed
 
 lemma abs_summable_summable:
   fixes f :: \<open>'a \<Rightarrow> 'b :: banach\<close>
   assumes \<open>f abs_summable_on A\<close>
   shows \<open>f summable_on A\<close>
 proof -
   from assms obtain L where lim: \<open>(sum (\<lambda>x. norm (f x)) \<longlongrightarrow> L) (finite_subsets_at_top A)\<close>
     unfolding has_sum_def summable_on_def by blast
   then have *: \<open>cauchy_filter (filtermap (sum (\<lambda>x. norm (f x))) (finite_subsets_at_top A))\<close>
     by (auto intro!: nhds_imp_cauchy_filter simp: filterlim_def)
   have \<open>\<exists>P. eventually P (finite_subsets_at_top A) \<and>
               (\<forall>F F'. P F \<and> P F' \<longrightarrow> dist (sum f F) (sum f F') < e)\<close> if \<open>e>0\<close> for e
   proof -
     define d P where \<open>d = e/4\<close> and \<open>P F \<longleftrightarrow> finite F \<and> F \<subseteq> A \<and> dist (sum (\<lambda>x. norm (f x)) F) L < d\<close> for F
     then have \<open>d > 0\<close>
       by (simp add: d_def that)
     have ev_P: \<open>eventually P (finite_subsets_at_top A)\<close>
       using lim
       by (auto simp add: P_def[abs_def] \<open>0 < d\<close> eventually_conj_iff eventually_finite_subsets_at_top_weakI tendsto_iff)
     
     moreover have \<open>dist (sum f F1) (sum f F2) < e\<close> if \<open>P F1\<close> and \<open>P F2\<close> for F1 F2
     proof -
       from ev_P
       obtain F' where \<open>finite F'\<close> and \<open>F' \<subseteq> A\<close> and P_sup_F': \<open>finite F \<and> F \<supseteq> F' \<and> F \<subseteq> A \<Longrightarrow> P F\<close> for F
         by atomize_elim (simp add: eventually_finite_subsets_at_top)
       define F where \<open>F = F' \<union> F1 \<union> F2\<close>
       have \<open>finite F\<close> and \<open>F \<subseteq> A\<close>
         using F_def P_def[abs_def] that \<open>finite F'\<close> \<open>F' \<subseteq> A\<close> by auto
       have dist_F: \<open>dist (sum (\<lambda>x. norm (f x)) F) L < d\<close>
         by (metis F_def \<open>F \<subseteq> A\<close> P_def P_sup_F' \<open>finite F\<close> le_supE order_refl)
 
       have dist_F_subset: \<open>dist (sum f F) (sum f F') < 2*d\<close> if F': \<open>F' \<subseteq> F\<close> \<open>P F'\<close> for F'
       proof -
         have \<open>dist (sum f F) (sum f F') = norm (sum f (F-F'))\<close>
           unfolding dist_norm using \<open>finite F\<close> F' by (subst sum_diff) auto
         also have \<open>\<dots> \<le> norm (\<Sum>x\<in>F-F'. norm (f x))\<close>
           by (rule order.trans[OF sum_norm_le[OF order.refl]]) auto
         also have \<open>\<dots> = dist (\<Sum>x\<in>F. norm (f x)) (\<Sum>x\<in>F'. norm (f x))\<close>
           unfolding dist_norm using \<open>finite F\<close> F' by (subst sum_diff) auto
         also have \<open>\<dots> < 2 * d\<close>
           using dist_F F' unfolding P_def dist_norm real_norm_def by linarith
         finally show \<open>dist (sum f F) (sum f F') < 2*d\<close> .
       qed
 
       have \<open>dist (sum f F1) (sum f F2) \<le> dist (sum f F) (sum f F1) + dist (sum f F) (sum f F2)\<close>
         by (rule dist_triangle3)
       also have \<open>\<dots> < 2 * d + 2 * d\<close>
         by (intro add_strict_mono dist_F_subset that) (auto simp: F_def)
       also have \<open>\<dots> \<le> e\<close>
         by (auto simp: d_def)
       finally show \<open>dist (sum f F1) (sum f F2) < e\<close> .
     qed
     then show ?thesis
       using ev_P by blast
   qed
   then have \<open>cauchy_filter (filtermap (sum f) (finite_subsets_at_top A))\<close>
     by (simp add: cauchy_filter_metric_filtermap)
   moreover have "complete (UNIV::'b set)"
     by (meson Cauchy_convergent UNIV_I complete_def convergent_def)
   ultimately obtain L' where \<open>(sum f \<longlongrightarrow> L') (finite_subsets_at_top A)\<close>
     using complete_uniform[where S=UNIV] by (force simp add: filterlim_def)
   then show ?thesis
     using summable_on_def has_sum_def by blast
 qed
 
 text \<open>The converse of @{thm [source] abs_summable_summable} does not hold:
   Consider the Hilbert space of square-summable sequences.
   Let $e_i$ denote the sequence with 1 in the $i$th position and 0 elsewhere.
   Let $f(i) := e_i/i$ for $i\geq1$. We have \<^term>\<open>\<not> f abs_summable_on UNIV\<close> because $\lVert f(i)\rVert=1/i$
   and thus the sum over $\lVert f(i)\rVert$ diverges. On the other hand, we have \<^term>\<open>f summable_on UNIV\<close>;
   the limit is the sequence with $1/i$ in the $i$th position.
 
   (We have not formalized this separating example here because to the best of our knowledge,
   this Hilbert space has not been formalized in Isabelle/HOL yet.)\<close>
 
 lemma norm_has_sum_bound:
   fixes f :: "'b \<Rightarrow> 'a::real_normed_vector"
     and A :: "'b set"
   assumes "has_sum (\<lambda>x. norm (f x)) A n"
   assumes "has_sum f A a"
   shows "norm a \<le> n"
 proof -
   have "norm a \<le> n + \<epsilon>" if "\<epsilon>>0" for \<epsilon>
   proof-
     have "\<exists>F. norm (a - sum f F) \<le> \<epsilon> \<and> finite F \<and> F \<subseteq> A"
       using has_sum_finite_approximation[where A=A and f=f and \<epsilon>="\<epsilon>"] assms \<open>0 < \<epsilon>\<close>
       by (metis dist_commute dist_norm)
     then obtain F where "norm (a - sum f F) \<le> \<epsilon>"
       and "finite F" and "F \<subseteq> A"
       by (simp add: atomize_elim)
     hence "norm a \<le> norm (sum f F) + \<epsilon>"
       by (metis add.commute diff_add_cancel dual_order.refl norm_triangle_mono)
     also have "\<dots> \<le> sum (\<lambda>x. norm (f x)) F + \<epsilon>"
       using norm_sum by auto
     also have "\<dots> \<le> n + \<epsilon>"
     proof (intro add_right_mono [OF has_sum_mono_neutral])
       show "has_sum (\<lambda>x. norm (f x)) F (\<Sum>x\<in>F. norm (f x))"
         by (simp add: \<open>finite F\<close>)
     qed (use \<open>F \<subseteq> A\<close> assms in auto)
     finally show ?thesis 
       by assumption
   qed
   thus ?thesis
     using linordered_field_class.field_le_epsilon by blast
 qed
 
 lemma norm_infsum_bound:
   fixes f :: "'b \<Rightarrow> 'a::real_normed_vector"
     and A :: "'b set"
   assumes "f abs_summable_on A"
   shows "norm (infsum f A) \<le> infsum (\<lambda>x. norm (f x)) A"
 proof (cases "f summable_on A")
   case True
   have "has_sum (\<lambda>x. norm (f x)) A (\<Sum>\<^sub>\<infinity>x\<in>A. norm (f x))"
     by (simp add: assms)
   then show ?thesis
     by (metis True has_sum_infsum norm_has_sum_bound)
 next
   case False
   obtain t where t_def: "(sum (\<lambda>x. norm (f x)) \<longlongrightarrow> t) (finite_subsets_at_top A)"
     using assms unfolding summable_on_def has_sum_def by blast
   have sumpos: "sum (\<lambda>x. norm (f x)) X \<ge> 0"
     for X
     by (simp add: sum_nonneg)
   have tgeq0:"t \<ge> 0"
   proof(rule ccontr)
     define S::"real set" where "S = {s. s < 0}"
     assume "\<not> 0 \<le> t"
     hence "t < 0" by simp
     hence "t \<in> S"
       unfolding S_def by blast
     moreover have "open S"
     proof-
       have "closed {s::real. s \<ge> 0}"
         using Elementary_Topology.closed_sequential_limits[where S = "{s::real. s \<ge> 0}"]
         by (metis Lim_bounded2 mem_Collect_eq)
       moreover have "{s::real. s \<ge> 0} = UNIV - S"
         unfolding S_def by auto
       ultimately have "closed (UNIV - S)"
         by simp
       thus ?thesis
         by (simp add: Compl_eq_Diff_UNIV open_closed) 
     qed
     ultimately have "\<forall>\<^sub>F X in finite_subsets_at_top A. (\<Sum>x\<in>X. norm (f x)) \<in> S"
       using t_def unfolding tendsto_def by blast
     hence "\<exists>X. (\<Sum>x\<in>X. norm (f x)) \<in> S"
       by (metis (no_types, lifting) eventually_mono filterlim_iff finite_subsets_at_top_neq_bot tendsto_Lim)
     then obtain X where "(\<Sum>x\<in>X. norm (f x)) \<in> S"
       by blast
     hence "(\<Sum>x\<in>X. norm (f x)) < 0"
       unfolding S_def by auto      
     thus False by (simp add: leD sumpos)
   qed
   have "\<exists>!h. (sum (\<lambda>x. norm (f x)) \<longlongrightarrow> h) (finite_subsets_at_top A)"
     using t_def finite_subsets_at_top_neq_bot tendsto_unique by blast
   hence "t = (Topological_Spaces.Lim (finite_subsets_at_top A) (sum (\<lambda>x. norm (f x))))"
     using t_def unfolding Topological_Spaces.Lim_def
     by (metis the_equality)     
   hence "Lim (finite_subsets_at_top A) (sum (\<lambda>x. norm (f x))) \<ge> 0"
     using tgeq0 by blast
   thus ?thesis unfolding infsum_def 
     using False by auto
 qed
 
 lemma infsum_tendsto:
   assumes \<open>f summable_on S\<close>
   shows \<open>((\<lambda>F. sum f F) \<longlongrightarrow> infsum f S) (finite_subsets_at_top S)\<close>
   using assms by (simp flip: has_sum_def)
 
 lemma has_sum_0: 
   assumes \<open>\<And>x. x\<in>M \<Longrightarrow> f x = 0\<close>
   shows \<open>has_sum f M 0\<close>
   by (metis assms finite.intros(1) has_sum_cong has_sum_cong_neutral has_sum_finite sum.neutral_const)
 
 lemma summable_on_0:
   assumes \<open>\<And>x. x\<in>M \<Longrightarrow> f x = 0\<close>
   shows \<open>f summable_on M\<close>
   using assms summable_on_def has_sum_0 by blast
 
 lemma infsum_0:
   assumes \<open>\<And>x. x\<in>M \<Longrightarrow> f x = 0\<close>
   shows \<open>infsum f M = 0\<close>
   by (metis assms finite_subsets_at_top_neq_bot infsum_def has_sum_0 has_sum_def tendsto_Lim)
 
 text \<open>Variants of @{thm [source] infsum_0} etc. suitable as simp-rules\<close>
 lemma infsum_0_simp[simp]: \<open>infsum (\<lambda>_. 0) M = 0\<close>
   by (simp_all add: infsum_0)
 lemma summable_on_0_simp[simp]: \<open>(\<lambda>_. 0) summable_on M\<close>
   by (simp_all add: summable_on_0)
 lemma has_sum_0_simp[simp]: \<open>has_sum (\<lambda>_. 0) M 0\<close>
   by (simp_all add: has_sum_0)
 
 
 lemma has_sum_add:
   fixes f g :: "'a \<Rightarrow> 'b::{topological_comm_monoid_add}"
   assumes \<open>has_sum f A a\<close>
   assumes \<open>has_sum g A b\<close>
   shows \<open>has_sum (\<lambda>x. f x + g x) A (a + b)\<close>
 proof -
   from assms have lim_f: \<open>(sum f \<longlongrightarrow> a)  (finite_subsets_at_top A)\<close>
     and lim_g: \<open>(sum g \<longlongrightarrow> b)  (finite_subsets_at_top A)\<close>
     by (simp_all add: has_sum_def)
   then have lim: \<open>(sum (\<lambda>x. f x + g x) \<longlongrightarrow> a + b) (finite_subsets_at_top A)\<close>
     unfolding sum.distrib by (rule tendsto_add)
   then show ?thesis
     by (simp_all add: has_sum_def)
 qed
 
 lemma summable_on_add:
   fixes f g :: "'a \<Rightarrow> 'b::{topological_comm_monoid_add}"
   assumes \<open>f summable_on A\<close>
   assumes \<open>g summable_on A\<close>
   shows \<open>(\<lambda>x. f x + g x) summable_on A\<close>
   by (metis (full_types) assms(1) assms(2) summable_on_def has_sum_add)
 
 lemma infsum_add:
   fixes f g :: "'a \<Rightarrow> 'b::{topological_comm_monoid_add, t2_space}"
   assumes \<open>f summable_on A\<close>
   assumes \<open>g summable_on A\<close>
   shows \<open>infsum (\<lambda>x. f x + g x) A = infsum f A + infsum g A\<close>
 proof -
   have \<open>has_sum (\<lambda>x. f x + g x) A (infsum f A + infsum g A)\<close>
     by (simp add: assms(1) assms(2) has_sum_add)
   then show ?thesis
     using infsumI by blast
 qed
 
 
 lemma has_sum_Un_disjoint:
   fixes f :: "'a \<Rightarrow> 'b::topological_comm_monoid_add"
   assumes "has_sum f A a"
   assumes "has_sum f B b"
   assumes disj: "A \<inter> B = {}"
   shows \<open>has_sum f (A \<union> B) (a + b)\<close>
 proof -
   define fA fB where \<open>fA x = (if x \<in> A then f x else 0)\<close>
     and \<open>fB x = (if x \<notin> A then f x else 0)\<close> for x
   have fA: \<open>has_sum fA (A \<union> B) a\<close>
     by (smt (verit, ccfv_SIG) DiffD1 DiffD2 UnCI fA_def assms(1) has_sum_cong_neutral inf_sup_absorb)
   have fB: \<open>has_sum fB (A \<union> B) b\<close>
     by (smt (verit, best) DiffD1 DiffD2 IntE Un_iff fB_def assms(2) disj disjoint_iff has_sum_cong_neutral)
   have fAB: \<open>f x = fA x + fB x\<close> for x
     unfolding fA_def fB_def by simp
   show ?thesis
     unfolding fAB
     using fA fB by (rule has_sum_add)
 qed
 
 lemma summable_on_Un_disjoint:
   fixes f :: "'a \<Rightarrow> 'b::topological_comm_monoid_add"
   assumes "f summable_on A"
   assumes "f summable_on B"
   assumes disj: "A \<inter> B = {}"
   shows \<open>f summable_on (A \<union> B)\<close>
   by (meson assms(1) assms(2) disj summable_on_def has_sum_Un_disjoint)
 
 lemma infsum_Un_disjoint:
   fixes f :: "'a \<Rightarrow> 'b::{topological_comm_monoid_add, t2_space}"
   assumes "f summable_on A"
   assumes "f summable_on B"
   assumes disj: "A \<inter> B = {}"
   shows \<open>infsum f (A \<union> B) = infsum f A + infsum f B\<close>
   by (intro infsumI has_sum_Un_disjoint has_sum_infsum assms)  
 
 lemma norm_summable_imp_has_sum:
   fixes f :: "nat \<Rightarrow> 'a :: banach"
   assumes "summable (\<lambda>n. norm (f n))" and "f sums S"
   shows   "has_sum f (UNIV :: nat set) S"
   unfolding has_sum_def tendsto_iff eventually_finite_subsets_at_top
 proof (safe, goal_cases)
   case (1 \<epsilon>)
   from assms(1) obtain S' where S': "(\<lambda>n. norm (f n)) sums S'"
     by (auto simp: summable_def)
   with 1 obtain N where N: "\<And>n. n \<ge> N \<Longrightarrow> \<bar>S' - (\<Sum>i<n. norm (f i))\<bar> < \<epsilon>"
     by (auto simp: tendsto_iff eventually_at_top_linorder sums_def dist_norm abs_minus_commute)
   
   show ?case
   proof (rule exI[of _ "{..<N}"], safe, goal_cases)
     case (2 Y)
     from 2 have "(\<lambda>n. if n \<in> Y then 0 else f n) sums (S - sum f Y)"
       by (intro sums_If_finite_set'[OF \<open>f sums S\<close>]) (auto simp: sum_negf)
     hence "S - sum f Y = (\<Sum>n. if n \<in> Y then 0 else f n)"
       by (simp add: sums_iff)
     also have "norm \<dots> \<le> (\<Sum>n. norm (if n \<in> Y then 0 else f n))"
       by (rule summable_norm[OF summable_comparison_test'[OF assms(1)]]) auto
     also have "\<dots> \<le> (\<Sum>n. if n < N then 0 else norm (f n))"
       using 2 by (intro suminf_le summable_comparison_test'[OF assms(1)]) auto
     also have "(\<lambda>n. if n \<in> {..<N} then 0 else norm (f n)) sums (S' - (\<Sum>i<N. norm (f i)))" 
       by (intro sums_If_finite_set'[OF S']) (auto simp: sum_negf)
     hence "(\<Sum>n. if n < N then 0 else norm (f n)) = S' - (\<Sum>i<N. norm (f i))"
       by (simp add: sums_iff)
     also have "S' - (\<Sum>i<N. norm (f i)) \<le> \<bar>S' - (\<Sum>i<N. norm (f i))\<bar>" by simp
     also have "\<dots> < \<epsilon>" by (rule N) auto
     finally show ?case by (simp add: dist_norm norm_minus_commute)
   qed auto
 qed
 
 lemma norm_summable_imp_summable_on:
   fixes f :: "nat \<Rightarrow> 'a :: banach"
   assumes "summable (\<lambda>n. norm (f n))"
   shows   "f summable_on UNIV"
   using norm_summable_imp_has_sum[OF assms, of "suminf f"] assms
   by (auto simp: sums_iff summable_on_def dest: summable_norm_cancel)
 
 text \<open>The following lemma indeed needs a complete space (as formalized by the premise \<^term>\<open>complete UNIV\<close>).
   The following two counterexamples show this:
   \begin{itemize}
   \item Consider the real vector space $V$ of sequences with finite support, and with the $\ell_2$-norm (sum of squares).
       Let $e_i$ denote the sequence with a $1$ at position $i$.
       Let $f : \mathbb Z \to V$ be defined as $f(n) := e_{\lvert n\rvert} / n$ (with $f(0) := 0$).
       We have that $\sum_{n\in\mathbb Z} f(n) = 0$ (it even converges absolutely). 
       But $\sum_{n\in\mathbb N} f(n)$ does not exist (it would converge against a sequence with infinite support).
   
   \item Let $f$ be a positive rational valued function such that $\sum_{x\in B} f(x)$ is $\sqrt 2$ and $\sum_{x\in A} f(x)$ is 1 (over the reals, with $A\subseteq B$).
       Then $\sum_{x\in B} f(x)$ does not exist over the rationals. But $\sum_{x\in A} f(x)$ exists.
   \end{itemize}
 
   The lemma also requires uniform continuity of the addition. And example of a topological group with continuous 
   but not uniformly continuous addition would be the positive reals with the usual multiplication as the addition.
   We do not know whether the lemma would also hold for such topological groups.\<close>
 
 lemma summable_on_subset:
   fixes A B and f :: \<open>'a \<Rightarrow> 'b::{ab_group_add, uniform_space}\<close>
   assumes \<open>complete (UNIV :: 'b set)\<close>
   assumes plus_cont: \<open>uniformly_continuous_on UNIV (\<lambda>(x::'b,y). x+y)\<close>
   assumes \<open>f summable_on A\<close>
   assumes \<open>B \<subseteq> A\<close>
   shows \<open>f summable_on B\<close>
 proof -
   let ?filter_fB = \<open>filtermap (sum f) (finite_subsets_at_top B)\<close>
   from \<open>f summable_on A\<close>
   obtain S where \<open>(sum f \<longlongrightarrow> S) (finite_subsets_at_top A)\<close> (is \<open>(sum f \<longlongrightarrow> S) ?filter_A\<close>)
     using summable_on_def has_sum_def by blast
   then have cauchy_fA: \<open>cauchy_filter (filtermap (sum f) (finite_subsets_at_top A))\<close> (is \<open>cauchy_filter ?filter_fA\<close>)
     by (auto intro!: nhds_imp_cauchy_filter simp: filterlim_def)
 
   have \<open>cauchy_filter (filtermap (sum f) (finite_subsets_at_top B))\<close>
   proof (unfold cauchy_filter_def, rule filter_leI)
     fix E :: \<open>('b\<times>'b) \<Rightarrow> bool\<close> assume \<open>eventually E uniformity\<close>
     then obtain E' where \<open>eventually E' uniformity\<close> and E'E'E: \<open>E' (x, y) \<longrightarrow> E' (y, z) \<longrightarrow> E (x, z)\<close> for x y z
       using uniformity_trans by blast
     obtain D where \<open>eventually D uniformity\<close> and DE: \<open>D (x, y) \<Longrightarrow> E' (x+c, y+c)\<close> for x y c
       using plus_cont \<open>eventually E' uniformity\<close>
       unfolding uniformly_continuous_on_uniformity filterlim_def le_filter_def uniformity_prod_def
       by (auto simp: case_prod_beta eventually_filtermap eventually_prod_same uniformity_refl)
     have DE': "E' (x, y)" if "D (x + c, y + c)" for x y c
       using DE[of "x + c" "y + c" "-c"] that by simp
 
     from \<open>eventually D uniformity\<close> and cauchy_fA have \<open>eventually D (?filter_fA \<times>\<^sub>F ?filter_fA)\<close>
       unfolding cauchy_filter_def le_filter_def by simp
     then obtain P1 P2
       where ev_P1: \<open>eventually (\<lambda>F. P1 (sum f F)) ?filter_A\<close> 
         and ev_P2: \<open>eventually (\<lambda>F. P2 (sum f F)) ?filter_A\<close>
         and P1P2E: \<open>P1 x \<Longrightarrow> P2 y \<Longrightarrow> D (x, y)\<close> for x y
       unfolding eventually_prod_filter eventually_filtermap
       by auto
     from ev_P1 obtain F1 where F1: \<open>finite F1\<close> \<open>F1 \<subseteq> A\<close> \<open>\<And>F. F\<supseteq>F1 \<Longrightarrow> finite F \<Longrightarrow> F\<subseteq>A \<Longrightarrow> P1 (sum f F)\<close>
       by (metis eventually_finite_subsets_at_top)
     from ev_P2 obtain F2 where F2: \<open>finite F2\<close> \<open>F2 \<subseteq> A\<close> \<open>\<And>F. F\<supseteq>F2 \<Longrightarrow> finite F \<Longrightarrow> F\<subseteq>A \<Longrightarrow> P2 (sum f F)\<close>
       by (metis eventually_finite_subsets_at_top)
     define F0 F0A F0B where \<open>F0 \<equiv> F1 \<union> F2\<close> and \<open>F0A \<equiv> F0 - B\<close> and \<open>F0B \<equiv> F0 \<inter> B\<close>
     have [simp]: \<open>finite F0\<close>  \<open>F0 \<subseteq> A\<close>
       using \<open>F1 \<subseteq> A\<close> \<open>F2 \<subseteq> A\<close> \<open>finite F1\<close> \<open>finite F2\<close> unfolding F0_def by blast+
  
     have *: "E' (sum f F1', sum f F2')"
       if "F1'\<supseteq>F0B" "F2'\<supseteq>F0B" "finite F1'" "finite F2'" "F1'\<subseteq>B" "F2'\<subseteq>B" for F1' F2'
     proof (intro DE'[where c = "sum f F0A"] P1P2E)
       have "P1 (sum f (F1' \<union> F0A))"
         using that assms F1(1,2) F2(1,2) by (intro F1) (auto simp: F0A_def F0B_def F0_def)
       thus "P1 (sum f F1' + sum f F0A)"
         by (subst (asm) sum.union_disjoint) (use that in \<open>auto simp: F0A_def\<close>)
     next
       have "P2 (sum f (F2' \<union> F0A))"
         using that assms F1(1,2) F2(1,2) by (intro F2) (auto simp: F0A_def F0B_def F0_def)
       thus "P2 (sum f F2' + sum f F0A)"
         by (subst (asm) sum.union_disjoint) (use that in \<open>auto simp: F0A_def\<close>)      
     qed
 
     show \<open>eventually E (?filter_fB \<times>\<^sub>F ?filter_fB)\<close>
       unfolding eventually_prod_filter
     proof (safe intro!: exI)
       show "eventually (\<lambda>x. E' (x, sum f F0B)) (filtermap (sum f) (finite_subsets_at_top B))"
        and "eventually (\<lambda>x. E' (sum f F0B, x)) (filtermap (sum f) (finite_subsets_at_top B))"
         unfolding eventually_filtermap eventually_finite_subsets_at_top
         by (rule exI[of _ F0B]; use * in \<open>force simp: F0B_def\<close>)+
     next
       show "E (x, y)" if "E' (x, sum f F0B)" and "E' (sum f F0B, y)" for x y
         using E'E'E that by blast
     qed
   qed
 
   then obtain x where \<open>?filter_fB \<le> nhds x\<close>
     using cauchy_filter_complete_converges[of ?filter_fB UNIV] \<open>complete (UNIV :: _)\<close>
     by (auto simp: filtermap_bot_iff)
   then have \<open>(sum f \<longlongrightarrow> x) (finite_subsets_at_top B)\<close>
     by (auto simp: filterlim_def)
   then show ?thesis
     by (auto simp: summable_on_def has_sum_def)
 qed
 
 text \<open>A special case of @{thm [source] summable_on_subset} for Banach spaces with less premises.\<close>
 
 lemma summable_on_subset_banach:
   fixes A B and f :: \<open>'a \<Rightarrow> 'b::banach\<close>
   assumes \<open>f summable_on A\<close>
   assumes \<open>B \<subseteq> A\<close>
   shows \<open>f summable_on B\<close>
   by (rule summable_on_subset[OF _ _ assms])
      (auto simp: complete_def convergent_def dest!: Cauchy_convergent)
 
 lemma has_sum_empty[simp]: \<open>has_sum f {} 0\<close>
   by (meson ex_in_conv has_sum_0)
 
 lemma summable_on_empty[simp]: \<open>f summable_on {}\<close>
   by auto
 
 lemma infsum_empty[simp]: \<open>infsum f {} = 0\<close>
   by simp
 
 lemma sum_has_sum:
   fixes f :: "'a \<Rightarrow> 'b::topological_comm_monoid_add"
   assumes finite: \<open>finite A\<close>
   assumes conv: \<open>\<And>a. a \<in> A \<Longrightarrow> has_sum f (B a) (s a)\<close>
   assumes disj: \<open>\<And>a a'. a\<in>A \<Longrightarrow> a'\<in>A \<Longrightarrow> a\<noteq>a' \<Longrightarrow> B a \<inter> B a' = {}\<close>
   shows \<open>has_sum f (\<Union>a\<in>A. B a) (sum s A)\<close>
   using assms finite conv 
 proof (induction)
   case empty
   then show ?case 
     by simp
 next
   case (insert x A)
   have \<open>has_sum f (B x) (s x)\<close>
     by (simp add: insert.prems)
   moreover have IH: \<open>has_sum f (\<Union>a\<in>A. B a) (sum s A)\<close>
     using insert by simp
   ultimately have \<open>has_sum f (B x \<union> (\<Union>a\<in>A. B a)) (s x + sum s A)\<close>
     using insert by (intro has_sum_Un_disjoint) auto
   then show ?case
     using insert.hyps by auto
 qed
 
 
 lemma summable_on_finite_union_disjoint:
   fixes f :: "'a \<Rightarrow> 'b::topological_comm_monoid_add"
   assumes finite: \<open>finite A\<close>
   assumes conv: \<open>\<And>a. a \<in> A \<Longrightarrow> f summable_on (B a)\<close>
   assumes disj: \<open>\<And>a a'. a\<in>A \<Longrightarrow> a'\<in>A \<Longrightarrow> a\<noteq>a' \<Longrightarrow> B a \<inter> B a' = {}\<close>
   shows \<open>f summable_on (\<Union>a\<in>A. B a)\<close>
   using finite conv disj by induction (auto intro!: summable_on_Un_disjoint)
 
 lemma sum_infsum:
   fixes f :: "'a \<Rightarrow> 'b::{topological_comm_monoid_add, t2_space}"
   assumes finite: \<open>finite A\<close>
   assumes conv: \<open>\<And>a. a \<in> A \<Longrightarrow> f summable_on (B a)\<close>
   assumes disj: \<open>\<And>a a'. a\<in>A \<Longrightarrow> a'\<in>A \<Longrightarrow> a\<noteq>a' \<Longrightarrow> B a \<inter> B a' = {}\<close>
   shows \<open>sum (\<lambda>a. infsum f (B a)) A = infsum f (\<Union>a\<in>A. B a)\<close>
   by (rule sym, rule infsumI)
      (use sum_has_sum[of A f B \<open>\<lambda>a. infsum f (B a)\<close>] assms in auto)
 
 text \<open>The lemmas \<open>infsum_comm_additive_general\<close> and \<open>infsum_comm_additive\<close> (and variants) below both state that the infinite sum commutes with
   a continuous additive function. \<open>infsum_comm_additive_general\<close> is stated more for more general type classes
   at the expense of a somewhat less compact formulation of the premises.
   E.g., by avoiding the constant \<^const>\<open>additive\<close> which introduces an additional sort constraint
   (group instead of monoid). For example, extended reals (\<^typ>\<open>ereal\<close>, \<^typ>\<open>ennreal\<close>) are not covered
   by \<open>infsum_comm_additive\<close>.\<close>
 
 
 lemma has_sum_comm_additive_general: 
   fixes f :: \<open>'b :: {comm_monoid_add,topological_space} \<Rightarrow> 'c :: {comm_monoid_add,topological_space}\<close>
   assumes f_sum: \<open>\<And>F. finite F \<Longrightarrow> F \<subseteq> S \<Longrightarrow> sum (f \<circ> g) F = f (sum g F)\<close>
       \<comment> \<open>Not using \<^const>\<open>additive\<close> because it would add sort constraint \<^class>\<open>ab_group_add\<close>\<close>
   assumes cont: \<open>f \<midarrow>x\<rightarrow> f x\<close>
     \<comment> \<open>For \<^class>\<open>t2_space\<close>, this is equivalent to \<open>isCont f x\<close> by @{thm [source] isCont_def}.\<close>
   assumes infsum: \<open>has_sum g S x\<close>
   shows \<open>has_sum (f \<circ> g) S (f x)\<close> 
 proof -
   have \<open>(sum g \<longlongrightarrow> x) (finite_subsets_at_top S)\<close>
     using infsum has_sum_def by blast
   then have \<open>((f \<circ> sum g) \<longlongrightarrow> f x) (finite_subsets_at_top S)\<close>
     by (meson cont filterlim_def tendsto_at_iff_tendsto_nhds tendsto_compose_filtermap tendsto_mono)
   then have \<open>(sum (f \<circ> g) \<longlongrightarrow> f x) (finite_subsets_at_top S)\<close>
     using tendsto_cong f_sum
     by (simp add: Lim_transform_eventually eventually_finite_subsets_at_top_weakI)
   then show \<open>has_sum (f \<circ> g) S (f x)\<close>
     using has_sum_def by blast 
 qed
 
 lemma summable_on_comm_additive_general:
   fixes f :: \<open>'b :: {comm_monoid_add,topological_space} \<Rightarrow> 'c :: {comm_monoid_add,topological_space}\<close>
   assumes \<open>\<And>F. finite F \<Longrightarrow> F \<subseteq> S \<Longrightarrow> sum (f \<circ> g) F = f (sum g F)\<close>
     \<comment> \<open>Not using \<^const>\<open>additive\<close> because it would add sort constraint \<^class>\<open>ab_group_add\<close>\<close>
   assumes \<open>\<And>x. has_sum g S x \<Longrightarrow> f \<midarrow>x\<rightarrow> f x\<close>
     \<comment> \<open>For \<^class>\<open>t2_space\<close>, this is equivalent to \<open>isCont f x\<close> by @{thm [source] isCont_def}.\<close>
   assumes \<open>g summable_on S\<close>
   shows \<open>(f \<circ> g) summable_on S\<close>
   by (meson assms summable_on_def has_sum_comm_additive_general has_sum_def infsum_tendsto)
 
 lemma infsum_comm_additive_general:
   fixes f :: \<open>'b :: {comm_monoid_add,t2_space} \<Rightarrow> 'c :: {comm_monoid_add,t2_space}\<close>
   assumes f_sum: \<open>\<And>F. finite F \<Longrightarrow> F \<subseteq> S \<Longrightarrow> sum (f \<circ> g) F = f (sum g F)\<close>
       \<comment> \<open>Not using \<^const>\<open>additive\<close> because it would add sort constraint \<^class>\<open>ab_group_add\<close>\<close>
   assumes \<open>isCont f (infsum g S)\<close>
   assumes \<open>g summable_on S\<close>
   shows \<open>infsum (f \<circ> g) S = f (infsum g S)\<close>
   using assms
   by (intro infsumI has_sum_comm_additive_general has_sum_infsum) (auto simp: isCont_def)
 
 lemma has_sum_comm_additive: 
   fixes f :: \<open>'b :: {ab_group_add,topological_space} \<Rightarrow> 'c :: {ab_group_add,topological_space}\<close>
   assumes \<open>additive f\<close>
   assumes \<open>f \<midarrow>x\<rightarrow> f x\<close>
     \<comment> \<open>For \<^class>\<open>t2_space\<close>, this is equivalent to \<open>isCont f x\<close> by @{thm [source] isCont_def}.\<close>
   assumes infsum: \<open>has_sum g S x\<close>
   shows \<open>has_sum (f \<circ> g) S (f x)\<close>
   using assms
   by (intro has_sum_comm_additive_general has_sum_infsum) (auto simp: isCont_def additive.sum) 
 
 lemma summable_on_comm_additive:
   fixes f :: \<open>'b :: {ab_group_add,t2_space} \<Rightarrow> 'c :: {ab_group_add,topological_space}\<close>
   assumes \<open>additive f\<close>
   assumes \<open>isCont f (infsum g S)\<close>
   assumes \<open>g summable_on S\<close>
   shows \<open>(f \<circ> g) summable_on S\<close>
   by (meson assms(1) assms(2) assms(3) summable_on_def has_sum_comm_additive has_sum_infsum isContD)
 
 lemma infsum_comm_additive:
   fixes f :: \<open>'b :: {ab_group_add,t2_space} \<Rightarrow> 'c :: {ab_group_add,t2_space}\<close>
   assumes \<open>additive f\<close>
   assumes \<open>isCont f (infsum g S)\<close>
   assumes \<open>g summable_on S\<close>
   shows \<open>infsum (f \<circ> g) S = f (infsum g S)\<close>
   by (rule infsum_comm_additive_general; auto simp: assms additive.sum)
 
 lemma nonneg_bdd_above_has_sum:
   fixes f :: \<open>'a \<Rightarrow> 'b :: {conditionally_complete_linorder, ordered_comm_monoid_add, linorder_topology}\<close>
   assumes \<open>\<And>x. x\<in>A \<Longrightarrow> f x \<ge> 0\<close>
   assumes \<open>bdd_above (sum f ` {F. F\<subseteq>A \<and> finite F})\<close>
   shows \<open>has_sum f A (SUP F\<in>{F. finite F \<and> F\<subseteq>A}. sum f F)\<close>
 proof -
   have \<open>(sum f \<longlongrightarrow> (SUP F\<in>{F. finite F \<and> F\<subseteq>A}. sum f F)) (finite_subsets_at_top A)\<close>
   proof (rule order_tendstoI)
     fix a assume \<open>a < (SUP F\<in>{F. finite F \<and> F\<subseteq>A}. sum f F)\<close>
     then obtain F where \<open>a < sum f F\<close> and \<open>finite F\<close> and \<open>F \<subseteq> A\<close>
       by (metis (mono_tags, lifting) Collect_cong Collect_empty_eq assms(2) empty_subsetI finite.emptyI less_cSUP_iff mem_Collect_eq)
     show \<open>\<forall>\<^sub>F x in finite_subsets_at_top A. a < sum f x\<close>
       unfolding eventually_finite_subsets_at_top
     proof (rule exI[of _ F], safe)
       fix Y assume Y: "finite Y" "F \<subseteq> Y" "Y \<subseteq> A"
       have "a < sum f F"
         by fact
       also have "\<dots> \<le> sum f Y"
         using assms Y by (intro sum_mono2) auto
       finally show "a < sum f Y" .
     qed (use \<open>finite F\<close> \<open>F \<subseteq> A\<close> in auto)
   next
     fix a assume *: \<open>(SUP F\<in>{F. finite F \<and> F\<subseteq>A}. sum f F) < a\<close>
     have \<open>sum f F < a\<close> if \<open>F\<subseteq>A\<close> and \<open>finite F\<close> for F
     proof -
       have "sum f F \<le> (SUP F\<in>{F. finite F \<and> F\<subseteq>A}. sum f F)"
         by (rule cSUP_upper) (use that assms(2) in \<open>auto simp: conj_commute\<close>)
       also have "\<dots> < a"
         by fact
       finally show ?thesis .
     qed
     then show \<open>\<forall>\<^sub>F x in finite_subsets_at_top A. sum f x < a\<close>
       by (rule eventually_finite_subsets_at_top_weakI)
   qed
   then show ?thesis
     using has_sum_def by blast
 qed
 
 lemma nonneg_bdd_above_summable_on:
   fixes f :: \<open>'a \<Rightarrow> 'b :: {conditionally_complete_linorder, ordered_comm_monoid_add, linorder_topology}\<close>
   assumes \<open>\<And>x. x\<in>A \<Longrightarrow> f x \<ge> 0\<close>
   assumes \<open>bdd_above (sum f ` {F. F\<subseteq>A \<and> finite F})\<close>
   shows \<open>f summable_on A\<close>
   using assms(1) assms(2) summable_on_def nonneg_bdd_above_has_sum by blast
 
 lemma nonneg_bdd_above_infsum:
   fixes f :: \<open>'a \<Rightarrow> 'b :: {conditionally_complete_linorder, ordered_comm_monoid_add, linorder_topology}\<close>
   assumes \<open>\<And>x. x\<in>A \<Longrightarrow> f x \<ge> 0\<close>
   assumes \<open>bdd_above (sum f ` {F. F\<subseteq>A \<and> finite F})\<close>
   shows \<open>infsum f A = (SUP F\<in>{F. finite F \<and> F\<subseteq>A}. sum f F)\<close>
   using assms by (auto intro!: infsumI nonneg_bdd_above_has_sum)
 
 lemma nonneg_has_sum_complete:
   fixes f :: \<open>'a \<Rightarrow> 'b :: {complete_linorder, ordered_comm_monoid_add, linorder_topology}\<close>
   assumes \<open>\<And>x. x\<in>A \<Longrightarrow> f x \<ge> 0\<close>
   shows \<open>has_sum f A (SUP F\<in>{F. finite F \<and> F\<subseteq>A}. sum f F)\<close>
   using assms nonneg_bdd_above_has_sum by blast
 
 lemma nonneg_summable_on_complete:
   fixes f :: \<open>'a \<Rightarrow> 'b :: {complete_linorder, ordered_comm_monoid_add, linorder_topology}\<close>
   assumes \<open>\<And>x. x\<in>A \<Longrightarrow> f x \<ge> 0\<close>
   shows \<open>f summable_on A\<close>
   using assms nonneg_bdd_above_summable_on by blast
 
 lemma nonneg_infsum_complete:
   fixes f :: \<open>'a \<Rightarrow> 'b :: {complete_linorder, ordered_comm_monoid_add, linorder_topology}\<close>
   assumes \<open>\<And>x. x\<in>A \<Longrightarrow> f x \<ge> 0\<close>
   shows \<open>infsum f A = (SUP F\<in>{F. finite F \<and> F\<subseteq>A}. sum f F)\<close>
   using assms nonneg_bdd_above_infsum by blast
 
 lemma has_sum_nonneg:
   fixes f :: "'a \<Rightarrow> 'b::{ordered_comm_monoid_add,linorder_topology}"
   assumes "has_sum f M a"
     and "\<And>x. x \<in> M \<Longrightarrow> 0 \<le> f x"
   shows "a \<ge> 0"
   by (metis (no_types, lifting) DiffD1 assms(1) assms(2) empty_iff has_sum_0 has_sum_mono_neutral order_refl)
 
 lemma infsum_nonneg:
   fixes f :: "'a \<Rightarrow> 'b::{ordered_comm_monoid_add,linorder_topology}"
   assumes "\<And>x. x \<in> M \<Longrightarrow> 0 \<le> f x"
   shows "infsum f M \<ge> 0" (is "?lhs \<ge> _")
   by (metis assms has_sum_infsum has_sum_nonneg infsum_not_exists linorder_linear)
 
 lemma has_sum_mono2:
   fixes f :: "'a \<Rightarrow> 'b::{topological_ab_group_add, ordered_comm_monoid_add,linorder_topology}"
   assumes "has_sum f A S" "has_sum f B S'" "A \<subseteq> B"
   assumes "\<And>x. x \<in> B - A \<Longrightarrow> f x \<ge> 0"
   shows   "S \<le> S'"
 proof -
   have "has_sum f (B - A) (S' - S)"
     by (rule has_sum_Diff) fact+
   hence "S' - S \<ge> 0"
     by (rule has_sum_nonneg) (use assms(4) in auto)
   thus ?thesis
     by (metis add_0 add_mono_thms_linordered_semiring(3) diff_add_cancel)
 qed
 
 lemma infsum_mono2:
   fixes f :: "'a \<Rightarrow> 'b::{topological_ab_group_add, ordered_comm_monoid_add,linorder_topology}"
   assumes "f summable_on A" "f summable_on B" "A \<subseteq> B"
   assumes "\<And>x. x \<in> B - A \<Longrightarrow> f x \<ge> 0"
   shows   "infsum f A \<le> infsum f B"
   by (rule has_sum_mono2[OF has_sum_infsum has_sum_infsum]) (use assms in auto)
 
 lemma finite_sum_le_has_sum:
   fixes f :: "'a \<Rightarrow> 'b::{topological_ab_group_add, ordered_comm_monoid_add,linorder_topology}"
   assumes "has_sum f A S" "finite B" "B \<subseteq> A"
   assumes "\<And>x. x \<in> A - B \<Longrightarrow> f x \<ge> 0"
   shows   "sum f B \<le> S"
 proof (rule has_sum_mono2)
   show "has_sum f A S"
     by fact
   show "has_sum f B (sum f B)"
     by (rule has_sum_finite) fact+
 qed (use assms in auto)
 
 lemma finite_sum_le_infsum:
   fixes f :: "'a \<Rightarrow> 'b::{topological_ab_group_add, ordered_comm_monoid_add,linorder_topology}"
   assumes "f summable_on A" "finite B" "B \<subseteq> A"
   assumes "\<And>x. x \<in> A - B \<Longrightarrow> f x \<ge> 0"
   shows   "sum f B \<le> infsum f A"
   by (rule finite_sum_le_has_sum[OF has_sum_infsum]) (use assms in auto)
 
 lemma has_sum_reindex:
   assumes \<open>inj_on h A\<close>
   shows \<open>has_sum g (h ` A) x \<longleftrightarrow> has_sum (g \<circ> h) A x\<close>
 proof -
   have \<open>has_sum g (h ` A) x \<longleftrightarrow> (sum g \<longlongrightarrow> x) (finite_subsets_at_top (h ` A))\<close>
     by (simp add: has_sum_def)
   also have \<open>\<dots> \<longleftrightarrow> ((\<lambda>F. sum g (h ` F)) \<longlongrightarrow> x) (finite_subsets_at_top A)\<close>
     by (metis assms filterlim_filtermap filtermap_image_finite_subsets_at_top)
   also have \<open>\<dots> \<longleftrightarrow> (sum (g \<circ> h) \<longlongrightarrow> x) (finite_subsets_at_top A)\<close>
   proof (intro tendsto_cong eventually_finite_subsets_at_top_weakI sum.reindex)
     show "\<And>X. \<lbrakk>finite X; X \<subseteq> A\<rbrakk> \<Longrightarrow> inj_on h X"
       using assms subset_inj_on by blast
   qed
   also have \<open>\<dots> \<longleftrightarrow> has_sum (g \<circ> h) A x\<close>
     by (simp add: has_sum_def)
   finally show ?thesis .
 qed
 
 lemma summable_on_reindex:
   assumes \<open>inj_on h A\<close>
   shows \<open>g summable_on (h ` A) \<longleftrightarrow> (g \<circ> h) summable_on A\<close>
   by (simp add: assms summable_on_def has_sum_reindex)
 
 lemma infsum_reindex:
   assumes \<open>inj_on h A\<close>
   shows \<open>infsum g (h ` A) = infsum (g \<circ> h) A\<close>
   by (metis (no_types, opaque_lifting) assms finite_subsets_at_top_neq_bot infsum_def 
         summable_on_reindex has_sum_def has_sum_infsum has_sum_reindex tendsto_Lim)
 
 lemma summable_on_reindex_bij_betw:
   assumes "bij_betw g A B"
   shows   "(\<lambda>x. f (g x)) summable_on A \<longleftrightarrow> f summable_on B"
 proof -
   have "inj_on g A"
     using assms bij_betw_imp_inj_on by blast
   then have \<open>(\<lambda>x. f (g x)) summable_on A \<longleftrightarrow> f summable_on g ` A\<close>
     by (metis (mono_tags, lifting) comp_apply summable_on_cong summable_on_reindex)
   also have \<open>\<dots> \<longleftrightarrow> f summable_on B\<close>
     using assms bij_betw_imp_surj_on by blast
   finally show ?thesis .
 qed
 
 lemma infsum_reindex_bij_betw:
   assumes "bij_betw g A B"
   shows   "infsum (\<lambda>x. f (g x)) A = infsum f B"
 proof -
   have \<open>infsum (\<lambda>x. f (g x)) A = infsum f (g ` A)\<close>
     by (metis (mono_tags, lifting) assms bij_betw_imp_inj_on infsum_cong infsum_reindex o_def)
   also have \<open>\<dots> = infsum f B\<close>
     using assms bij_betw_imp_surj_on by blast
   finally show ?thesis .
 qed
 
 lemma sum_uniformity:
   assumes plus_cont: \<open>uniformly_continuous_on UNIV (\<lambda>(x::'b::{uniform_space,comm_monoid_add},y). x+y)\<close>
   assumes \<open>eventually E uniformity\<close>
   obtains D where \<open>eventually D uniformity\<close> 
     and \<open>\<And>M::'a set. \<And>f f' :: 'a \<Rightarrow> 'b. card M \<le> n \<and> (\<forall>m\<in>M. D (f m, f' m)) \<Longrightarrow> E (sum f M, sum f' M)\<close>
 proof (atomize_elim, insert \<open>eventually E uniformity\<close>, induction n arbitrary: E rule:nat_induct)
   case 0
   then show ?case
     by (metis card_eq_0_iff equals0D le_zero_eq sum.infinite sum.not_neutral_contains_not_neutral uniformity_refl)
 next
   case (Suc n)
   from plus_cont[unfolded uniformly_continuous_on_uniformity filterlim_def le_filter_def, rule_format, OF Suc.prems]
   obtain D1 D2 where \<open>eventually D1 uniformity\<close> and \<open>eventually D2 uniformity\<close> 
     and D1D2E: \<open>D1 (x, y) \<Longrightarrow> D2 (x', y') \<Longrightarrow> E (x + x', y + y')\<close> for x y x' y'
     apply atomize_elim
     by (auto simp: eventually_prod_filter case_prod_beta uniformity_prod_def eventually_filtermap)
 
   from Suc.IH[OF \<open>eventually D2 uniformity\<close>]
   obtain D3 where \<open>eventually D3 uniformity\<close> and D3: \<open>card M \<le> n \<Longrightarrow> (\<forall>m\<in>M. D3 (f m, f' m)) \<Longrightarrow> D2 (sum f M, sum f' M)\<close> 
     for M :: \<open>'a set\<close> and f f'
     by metis
 
   define D where \<open>D x \<equiv> D1 x \<and> D3 x\<close> for x
   have \<open>eventually D uniformity\<close>
     using D_def \<open>eventually D1 uniformity\<close> \<open>eventually D3 uniformity\<close> eventually_elim2 by blast
 
   have \<open>E (sum f M, sum f' M)\<close> 
     if \<open>card M \<le> Suc n\<close> and DM: \<open>\<forall>m\<in>M. D (f m, f' m)\<close>
     for M :: \<open>'a set\<close> and f f'
   proof (cases \<open>card M = 0\<close>)
     case True
     then show ?thesis
       by (metis Suc.prems card_eq_0_iff sum.empty sum.infinite uniformity_refl) 
   next
     case False
     with \<open>card M \<le> Suc n\<close> obtain N x where \<open>card N \<le> n\<close> and \<open>x \<notin> N\<close> and \<open>M = insert x N\<close>
       by (metis card_Suc_eq less_Suc_eq_0_disj less_Suc_eq_le)
 
     from DM have \<open>\<And>m. m\<in>N \<Longrightarrow> D (f m, f' m)\<close>
       using \<open>M = insert x N\<close> by blast
     with D3[OF \<open>card N \<le> n\<close>]
     have D2_N: \<open>D2 (sum f N, sum f' N)\<close>
       using D_def by blast
 
     from DM 
     have \<open>D (f x, f' x)\<close>
       using \<open>M = insert x N\<close> by blast
     then have \<open>D1 (f x, f' x)\<close>
       by (simp add: D_def)
 
     with D2_N
     have \<open>E (f x + sum f N, f' x + sum f' N)\<close>
       using D1D2E by presburger
 
     then show \<open>E (sum f M, sum f' M)\<close>
       by (metis False \<open>M = insert x N\<close> \<open>x \<notin> N\<close> card.infinite finite_insert sum.insert)
   qed
   with \<open>eventually D uniformity\<close>
   show ?case 
     by auto
 qed
 
 lemma has_sum_Sigma:
   fixes A :: "'a set" and B :: "'a \<Rightarrow> 'b set"
     and f :: \<open>'a \<times> 'b \<Rightarrow> 'c::{comm_monoid_add,uniform_space}\<close>
   assumes plus_cont: \<open>uniformly_continuous_on UNIV (\<lambda>(x::'c,y). x+y)\<close>
   assumes summableAB: "has_sum f (Sigma A B) a"
   assumes summableB: \<open>\<And>x. x\<in>A \<Longrightarrow> has_sum (\<lambda>y. f (x, y)) (B x) (b x)\<close>
   shows "has_sum b A a"
 proof -
   define F FB FA where \<open>F = finite_subsets_at_top (Sigma A B)\<close> and \<open>FB x = finite_subsets_at_top (B x)\<close>
     and \<open>FA = finite_subsets_at_top A\<close> for x
 
   from summableB
   have sum_b: \<open>(sum (\<lambda>y. f (x, y)) \<longlongrightarrow> b x) (FB x)\<close> if \<open>x \<in> A\<close> for x
     using FB_def[abs_def] has_sum_def that by auto
   from summableAB
   have sum_S: \<open>(sum f \<longlongrightarrow> a) F\<close>
     using F_def has_sum_def by blast
 
   have finite_proj: \<open>finite {b| b. (a,b) \<in> H}\<close> if \<open>finite H\<close> for H :: \<open>('a\<times>'b) set\<close> and a
     by (metis (no_types, lifting) finite_imageI finite_subset image_eqI mem_Collect_eq snd_conv subsetI that)
 
   have \<open>(sum b \<longlongrightarrow> a) FA\<close>
   proof (rule tendsto_iff_uniformity[THEN iffD2, rule_format])
     fix E :: \<open>('c \<times> 'c) \<Rightarrow> bool\<close>
     assume \<open>eventually E uniformity\<close>
     then obtain D where D_uni: \<open>eventually D uniformity\<close> and DDE': \<open>\<And>x y z. D (x, y) \<Longrightarrow> D (y, z) \<Longrightarrow> E (x, z)\<close>
       by (metis (no_types, lifting) \<open>eventually E uniformity\<close> uniformity_transE)
     from sum_S obtain G where \<open>finite G\<close> and \<open>G \<subseteq> Sigma A B\<close>
       and G_sum: \<open>G \<subseteq> H \<Longrightarrow> H \<subseteq> Sigma A B \<Longrightarrow> finite H \<Longrightarrow> D (sum f H, a)\<close> for H
       unfolding tendsto_iff_uniformity
       by (metis (mono_tags, lifting) D_uni F_def eventually_finite_subsets_at_top)
     have \<open>finite (fst ` G)\<close> and \<open>fst ` G \<subseteq> A\<close>
       using \<open>finite G\<close> \<open>G \<subseteq> Sigma A B\<close> by auto
     thm uniformity_prod_def
     define Ga where \<open>Ga a = {b. (a,b) \<in> G}\<close> for a
     have Ga_fin: \<open>finite (Ga a)\<close> and Ga_B: \<open>Ga a \<subseteq> B a\<close> for a
       using \<open>finite G\<close> \<open>G \<subseteq> Sigma A B\<close> finite_proj by (auto simp: Ga_def finite_proj)
 
     have \<open>E (sum b M, a)\<close> if \<open>M \<supseteq> fst ` G\<close> and \<open>finite M\<close> and \<open>M \<subseteq> A\<close> for M
     proof -
       define FMB where \<open>FMB = finite_subsets_at_top (Sigma M B)\<close>
       have \<open>eventually (\<lambda>H. D (\<Sum>a\<in>M. b a, \<Sum>(a,b)\<in>H. f (a,b))) FMB\<close>
       proof -
         obtain D' where D'_uni: \<open>eventually D' uniformity\<close> 
           and \<open>card M' \<le> card M \<and> (\<forall>m\<in>M'. D' (g m, g' m)) \<Longrightarrow> D (sum g M', sum g' M')\<close>
         for M' :: \<open>'a set\<close> and g g'
           using sum_uniformity[OF plus_cont \<open>eventually D uniformity\<close>] by blast
         then have D'_sum_D: \<open>(\<forall>m\<in>M. D' (g m, g' m)) \<Longrightarrow> D (sum g M, sum g' M)\<close> for g g'
           by auto
 
         obtain Ha where \<open>Ha a \<supseteq> Ga a\<close> and Ha_fin: \<open>finite (Ha a)\<close> and Ha_B: \<open>Ha a \<subseteq> B a\<close>
           and D'_sum_Ha: \<open>Ha a \<subseteq> L \<Longrightarrow> L \<subseteq> B a \<Longrightarrow> finite L \<Longrightarrow> D' (b a, sum (\<lambda>b. f (a,b)) L)\<close> if \<open>a \<in> A\<close> for a L
         proof -
           from sum_b[unfolded tendsto_iff_uniformity, rule_format, OF _ D'_uni[THEN uniformity_sym]]
           obtain Ha0 where \<open>finite (Ha0 a)\<close> and \<open>Ha0 a \<subseteq> B a\<close>
             and \<open>Ha0 a \<subseteq> L \<Longrightarrow> L \<subseteq> B a \<Longrightarrow> finite L \<Longrightarrow> D' (b a, sum (\<lambda>b. f (a,b)) L)\<close> if \<open>a \<in> A\<close> for a L
             unfolding FB_def eventually_finite_subsets_at_top unfolding prod.case by metis
           moreover define Ha where \<open>Ha a = Ha0 a \<union> Ga a\<close> for a
           ultimately show ?thesis
             using that[where Ha=Ha]
             using Ga_fin Ga_B by auto
         qed
 
         have \<open>D (\<Sum>a\<in>M. b a, \<Sum>(a,b)\<in>H. f (a,b))\<close> if \<open>finite H\<close> and \<open>H \<subseteq> Sigma M B\<close> and \<open>H \<supseteq> Sigma M Ha\<close> for H
         proof -
           define Ha' where \<open>Ha' a = {b| b. (a,b) \<in> H}\<close> for a
           have [simp]: \<open>finite (Ha' a)\<close> and [simp]: \<open>Ha' a \<supseteq> Ha a\<close> and [simp]: \<open>Ha' a \<subseteq> B a\<close> if \<open>a \<in> M\<close> for a
             unfolding Ha'_def using \<open>finite H\<close> \<open>H \<subseteq> Sigma M B\<close> \<open>Sigma M Ha \<subseteq> H\<close> that finite_proj by auto
           have \<open>Sigma M Ha' = H\<close>
             using that by (auto simp: Ha'_def)
           then have *: \<open>(\<Sum>(a,b)\<in>H. f (a,b)) = (\<Sum>a\<in>M. \<Sum>b\<in>Ha' a. f (a,b))\<close>
             by (simp add: \<open>finite M\<close> sum.Sigma)
           have \<open>D' (b a, sum (\<lambda>b. f (a,b)) (Ha' a))\<close> if \<open>a \<in> M\<close> for a
             using D'_sum_Ha \<open>M \<subseteq> A\<close> that by auto
           then have \<open>D (\<Sum>a\<in>M. b a, \<Sum>a\<in>M. sum (\<lambda>b. f (a,b)) (Ha' a))\<close>
             by (rule_tac D'_sum_D, auto)
           with * show ?thesis
             by auto
         qed
         moreover have \<open>Sigma M Ha \<subseteq> Sigma M B\<close>
           using Ha_B \<open>M \<subseteq> A\<close> by auto
         ultimately show ?thesis
           unfolding FMB_def eventually_finite_subsets_at_top
           by (intro exI[of _ "Sigma M Ha"])
              (use Ha_fin that(2,3) in \<open>fastforce intro!: finite_SigmaI\<close>)
       qed
       moreover have \<open>eventually (\<lambda>H. D (\<Sum>(a,b)\<in>H. f (a,b), a)) FMB\<close>
         unfolding FMB_def eventually_finite_subsets_at_top
       proof (rule exI[of _ G], safe)
         fix Y assume Y: "finite Y" "G \<subseteq> Y" "Y \<subseteq> Sigma M B"
         have "Y \<subseteq> Sigma A B"
           using Y \<open>M \<subseteq> A\<close> by blast
         thus "D (\<Sum>(a,b)\<in>Y. f (a, b), a)"
           using G_sum[of Y] Y by auto
       qed (use \<open>finite G\<close> \<open>G \<subseteq> Sigma A B\<close> that in auto)
       ultimately have \<open>\<forall>\<^sub>F x in FMB. E (sum b M, a)\<close>
         by eventually_elim (use DDE' in auto)
       then show \<open>E (sum b M, a)\<close>
         by (rule eventually_const[THEN iffD1, rotated]) (force simp: FMB_def)
     qed
     then show \<open>\<forall>\<^sub>F x in FA. E (sum b x, a)\<close>
       using \<open>finite (fst ` G)\<close> and \<open>fst ` G \<subseteq> A\<close>
       by (auto intro!: exI[of _ \<open>fst ` G\<close>] simp add: FA_def eventually_finite_subsets_at_top)
   qed
   then show ?thesis
     by (simp add: FA_def has_sum_def)
 qed
 
 lemma summable_on_Sigma:
   fixes A :: "'a set" and B :: "'a \<Rightarrow> 'b set"
     and f :: \<open>'a \<Rightarrow> 'b \<Rightarrow> 'c::{comm_monoid_add, t2_space, uniform_space}\<close>
   assumes plus_cont: \<open>uniformly_continuous_on UNIV (\<lambda>(x::'c,y). x+y)\<close>
   assumes summableAB: "(\<lambda>(x,y). f x y) summable_on (Sigma A B)"
   assumes summableB: \<open>\<And>x. x\<in>A \<Longrightarrow> (f x) summable_on (B x)\<close>
   shows \<open>(\<lambda>x. infsum (f x) (B x)) summable_on A\<close>
 proof -
   from summableAB obtain a where a: \<open>has_sum (\<lambda>(x,y). f x y) (Sigma A B) a\<close>
     using has_sum_infsum by blast
   from summableB have b: \<open>\<And>x. x\<in>A \<Longrightarrow> has_sum (f x) (B x) (infsum (f x) (B x))\<close>
     by (auto intro!: has_sum_infsum)
   show ?thesis
     using plus_cont a b 
     by (auto intro: has_sum_Sigma[where f=\<open>\<lambda>(x,y). f x y\<close>, simplified] simp: summable_on_def)
 qed
 
 lemma infsum_Sigma:
   fixes A :: "'a set" and B :: "'a \<Rightarrow> 'b set"
     and f :: \<open>'a \<times> 'b \<Rightarrow> 'c::{comm_monoid_add, t2_space, uniform_space}\<close>
   assumes plus_cont: \<open>uniformly_continuous_on UNIV (\<lambda>(x::'c,y). x+y)\<close>
   assumes summableAB: "f summable_on (Sigma A B)"
   assumes summableB: \<open>\<And>x. x\<in>A \<Longrightarrow> (\<lambda>y. f (x, y)) summable_on (B x)\<close>
   shows "infsum f (Sigma A B) = infsum (\<lambda>x. infsum (\<lambda>y. f (x, y)) (B x)) A"
 proof -
   from summableAB have a: \<open>has_sum f (Sigma A B) (infsum f (Sigma A B))\<close>
     using has_sum_infsum by blast
   from summableB have b: \<open>\<And>x. x\<in>A \<Longrightarrow> has_sum (\<lambda>y. f (x, y)) (B x) (infsum (\<lambda>y. f (x, y)) (B x))\<close>
     by (auto intro!: has_sum_infsum)
   show ?thesis
     using plus_cont a b by (auto intro: infsumI[symmetric] has_sum_Sigma simp: summable_on_def)
 qed
 
 lemma infsum_Sigma':
   fixes A :: "'a set" and B :: "'a \<Rightarrow> 'b set"
     and f :: \<open>'a \<Rightarrow> 'b \<Rightarrow> 'c::{comm_monoid_add, t2_space, uniform_space}\<close>
   assumes plus_cont: \<open>uniformly_continuous_on UNIV (\<lambda>(x::'c,y). x+y)\<close>
   assumes summableAB: "(\<lambda>(x,y). f x y) summable_on (Sigma A B)"
   assumes summableB: \<open>\<And>x. x\<in>A \<Longrightarrow> (f x) summable_on (B x)\<close>
   shows \<open>infsum (\<lambda>x. infsum (f x) (B x)) A = infsum (\<lambda>(x,y). f x y) (Sigma A B)\<close>
   using infsum_Sigma[of \<open>\<lambda>(x,y). f x y\<close> A B]
   using assms by auto
 
 text \<open>A special case of @{thm [source] infsum_Sigma} etc. for Banach spaces. It has less premises.\<close>
 lemma
   fixes A :: "'a set" and B :: "'a \<Rightarrow> 'b set"
     and f :: \<open>'a \<Rightarrow> 'b \<Rightarrow> 'c::banach\<close>
   assumes [simp]: "(\<lambda>(x,y). f x y) summable_on (Sigma A B)"
   shows infsum_Sigma'_banach: \<open>infsum (\<lambda>x. infsum (f x) (B x)) A = infsum (\<lambda>(x,y). f x y) (Sigma A B)\<close> (is ?thesis1)
     and summable_on_Sigma_banach: \<open>(\<lambda>x. infsum (f x) (B x)) summable_on A\<close> (is ?thesis2)
 proof -
   have fsum: \<open>(f x) summable_on (B x)\<close> if \<open>x \<in> A\<close> for x
   proof -
     from assms
     have \<open>(\<lambda>(x,y). f x y) summable_on (Pair x ` B x)\<close>
       by (meson image_subset_iff summable_on_subset_banach mem_Sigma_iff that)
     then have \<open>((\<lambda>(x,y). f x y) \<circ> Pair x) summable_on (B x)\<close>
       by (metis summable_on_reindex inj_on_def prod.inject)
     then show ?thesis
       by (auto simp: o_def)
   qed
   show ?thesis1
     using fsum assms infsum_Sigma' isUCont_plus by blast
   show ?thesis2
     using fsum assms isUCont_plus summable_on_Sigma by blast
 qed
 
 lemma infsum_Sigma_banach:
   fixes A :: "'a set" and B :: "'a \<Rightarrow> 'b set"
     and f :: \<open>'a \<times> 'b \<Rightarrow> 'c::banach\<close>
   assumes [simp]: "f summable_on (Sigma A B)"
   shows \<open>infsum (\<lambda>x. infsum (\<lambda>y. f (x,y)) (B x)) A = infsum f (Sigma A B)\<close>
   using assms
   by (subst infsum_Sigma'_banach) auto
 
 lemma infsum_swap:
   fixes A :: "'a set" and B :: "'b set"
   fixes f :: "'a \<Rightarrow> 'b \<Rightarrow> 'c::{comm_monoid_add,t2_space,uniform_space}"
   assumes plus_cont: \<open>uniformly_continuous_on UNIV (\<lambda>(x::'c,y). x+y)\<close>
   assumes \<open>(\<lambda>(x, y). f x y) summable_on (A \<times> B)\<close>
   assumes \<open>\<And>a. a\<in>A \<Longrightarrow> (f a) summable_on B\<close>
   assumes \<open>\<And>b. b\<in>B \<Longrightarrow> (\<lambda>a. f a b) summable_on A\<close>
   shows \<open>infsum (\<lambda>x. infsum (\<lambda>y. f x y) B) A = infsum (\<lambda>y. infsum (\<lambda>x. f x y) A) B\<close>
 proof -
   have "(\<lambda>(x, y). f y x) \<circ> prod.swap summable_on A \<times> B"
     by (simp add: assms(2) summable_on_cong)
   then have fyx: \<open>(\<lambda>(x, y). f y x) summable_on (B \<times> A)\<close>
     by (metis has_sum_reindex infsum_reindex inj_swap product_swap summable_iff_has_sum_infsum)
   have \<open>infsum (\<lambda>x. infsum (\<lambda>y. f x y) B) A = infsum (\<lambda>(x,y). f x y) (A \<times> B)\<close>
     using assms infsum_Sigma' by blast
   also have \<open>\<dots> = infsum (\<lambda>(x,y). f y x) (B \<times> A)\<close>
     apply (subst product_swap[symmetric])
     apply (subst infsum_reindex)
     using assms by (auto simp: o_def)
   also have \<open>\<dots> = infsum (\<lambda>y. infsum (\<lambda>x. f x y) A) B\<close>
     by (smt (verit) fyx assms(1) assms(4) infsum_Sigma' infsum_cong)
   finally show ?thesis .
 qed
 
 lemma infsum_swap_banach:
   fixes A :: "'a set" and B :: "'b set"
   fixes f :: "'a \<Rightarrow> 'b \<Rightarrow> 'c::banach"
   assumes \<open>(\<lambda>(x, y). f x y) summable_on (A \<times> B)\<close>
   shows "infsum (\<lambda>x. infsum (\<lambda>y. f x y) B) A = infsum (\<lambda>y. infsum (\<lambda>x. f x y) A) B"
 proof -
   have \<section>: \<open>(\<lambda>(x, y). f y x) summable_on (B \<times> A)\<close>
     by (metis (mono_tags, lifting) assms case_swap inj_swap o_apply product_swap summable_on_cong summable_on_reindex)
   have \<open>infsum (\<lambda>x. infsum (\<lambda>y. f x y) B) A = infsum (\<lambda>(x,y). f x y) (A \<times> B)\<close>
     using assms infsum_Sigma'_banach by blast
   also have \<open>\<dots> = infsum (\<lambda>(x,y). f y x) (B \<times> A)\<close>
     apply (subst product_swap[symmetric])
     apply (subst infsum_reindex)
     using assms by (auto simp: o_def)
   also have \<open>\<dots> = infsum (\<lambda>y. infsum (\<lambda>x. f x y) A) B\<close>
     by (metis (mono_tags, lifting) \<section> infsum_Sigma'_banach infsum_cong)
   finally show ?thesis .
 qed
 
 lemma nonneg_infsum_le_0D:
   fixes f :: "'a \<Rightarrow> 'b::{topological_ab_group_add,ordered_ab_group_add,linorder_topology}"
   assumes "infsum f A \<le> 0"
     and abs_sum: "f summable_on A"
     and nneg: "\<And>x. x \<in> A \<Longrightarrow> f x \<ge> 0"
     and "x \<in> A"
   shows "f x = 0"
 proof (rule ccontr)
   assume \<open>f x \<noteq> 0\<close>
   have ex: \<open>f summable_on (A-{x})\<close>
     by (rule summable_on_cofin_subset) (use assms in auto)
   have pos: \<open>infsum f (A - {x}) \<ge> 0\<close>
     by (rule infsum_nonneg) (use nneg in auto)
 
   have [trans]: \<open>x \<ge> y \<Longrightarrow> y > z \<Longrightarrow> x > z\<close> for x y z :: 'b by auto
 
   have \<open>infsum f A = infsum f (A-{x}) + infsum f {x}\<close>
     by (subst infsum_Un_disjoint[symmetric]) (use assms ex in \<open>auto simp: insert_absorb\<close>)
   also have \<open>\<dots> \<ge> infsum f {x}\<close> (is \<open>_ \<ge> \<dots>\<close>)
     using pos by (rule add_increasing) simp
   also have \<open>\<dots> = f x\<close> (is \<open>_ = \<dots>\<close>)
     by (subst infsum_finite) auto
   also have \<open>\<dots> > 0\<close>
     using \<open>f x \<noteq> 0\<close> assms(4) nneg by fastforce
   finally show False
     using assms by auto
 qed
 
 lemma nonneg_has_sum_le_0D:
   fixes f :: "'a \<Rightarrow> 'b::{topological_ab_group_add,ordered_ab_group_add,linorder_topology}"
   assumes "has_sum f A a" \<open>a \<le> 0\<close>
     and nneg: "\<And>x. x \<in> A \<Longrightarrow> f x \<ge> 0"
     and "x \<in> A"
   shows "f x = 0"
   by (metis assms(1) assms(2) assms(4) infsumI nonneg_infsum_le_0D summable_on_def nneg)
 
 lemma has_sum_cmult_left:
   fixes f :: "'a \<Rightarrow> 'b :: {topological_semigroup_mult, semiring_0}"
   assumes \<open>has_sum f A a\<close>
   shows "has_sum (\<lambda>x. f x * c) A (a * c)"
 proof -
   from assms have \<open>(sum f \<longlongrightarrow> a) (finite_subsets_at_top A)\<close>
     using has_sum_def by blast
   then have \<open>((\<lambda>F. sum f F * c) \<longlongrightarrow> a * c) (finite_subsets_at_top A)\<close>
     by (simp add: tendsto_mult_right)
   then have \<open>(sum (\<lambda>x. f x * c) \<longlongrightarrow> a * c) (finite_subsets_at_top A)\<close>
     by (metis (mono_tags) tendsto_cong eventually_finite_subsets_at_top_weakI sum_distrib_right)
   then show ?thesis
     using infsumI has_sum_def by blast
 qed
 
 lemma infsum_cmult_left:
   fixes f :: "'a \<Rightarrow> 'b :: {t2_space, topological_semigroup_mult, semiring_0}"
   assumes \<open>c \<noteq> 0 \<Longrightarrow> f summable_on A\<close>
   shows "infsum (\<lambda>x. f x * c) A = infsum f A * c"
 proof (cases \<open>c=0\<close>)
   case True
   then show ?thesis by auto
 next
   case False
   then have \<open>has_sum f A (infsum f A)\<close>
     by (simp add: assms)
   then show ?thesis
     by (auto intro!: infsumI has_sum_cmult_left)
 qed
 
 lemma summable_on_cmult_left:
   fixes f :: "'a \<Rightarrow> 'b :: {t2_space, topological_semigroup_mult, semiring_0}"
   assumes \<open>f summable_on A\<close>
   shows "(\<lambda>x. f x * c) summable_on A"
   using assms summable_on_def has_sum_cmult_left by blast
 
 lemma has_sum_cmult_right:
   fixes f :: "'a \<Rightarrow> 'b :: {topological_semigroup_mult, semiring_0}"
   assumes \<open>has_sum f A a\<close>
   shows "has_sum (\<lambda>x. c * f x) A (c * a)"
 proof -
   from assms have \<open>(sum f \<longlongrightarrow> a) (finite_subsets_at_top A)\<close>
     using has_sum_def by blast
   then have \<open>((\<lambda>F. c * sum f F) \<longlongrightarrow> c * a) (finite_subsets_at_top A)\<close>
     by (simp add: tendsto_mult_left)
   then have \<open>(sum (\<lambda>x. c * f x) \<longlongrightarrow> c * a) (finite_subsets_at_top A)\<close>
     by (metis (mono_tags, lifting) tendsto_cong eventually_finite_subsets_at_top_weakI sum_distrib_left)
   then show ?thesis
     using infsumI has_sum_def by blast
 qed
 
 lemma infsum_cmult_right:
   fixes f :: "'a \<Rightarrow> 'b :: {t2_space, topological_semigroup_mult, semiring_0}"
   assumes \<open>c \<noteq> 0 \<Longrightarrow> f summable_on A\<close>
   shows \<open>infsum (\<lambda>x. c * f x) A = c * infsum f A\<close>
   using assms has_sum_cmult_right infsumI summable_iff_has_sum_infsum by fastforce
 
 lemma summable_on_cmult_right:
   fixes f :: "'a \<Rightarrow> 'b :: {t2_space, topological_semigroup_mult, semiring_0}"
   assumes \<open>f summable_on A\<close>
   shows "(\<lambda>x. c * f x) summable_on A"
   using assms summable_on_def has_sum_cmult_right by blast
 
 lemma summable_on_cmult_left':
   fixes f :: "'a \<Rightarrow> 'b :: {t2_space, topological_semigroup_mult, division_ring}"
   assumes \<open>c \<noteq> 0\<close>
   shows "(\<lambda>x. f x * c) summable_on A \<longleftrightarrow> f summable_on A"
 proof
   assume \<open>f summable_on A\<close>
   then show \<open>(\<lambda>x. f x * c) summable_on A\<close>
     by (rule summable_on_cmult_left)
 next
   assume \<open>(\<lambda>x. f x * c) summable_on A\<close>
   then have \<open>(\<lambda>x. f x * c * inverse c) summable_on A\<close>
     by (rule summable_on_cmult_left)
   then show \<open>f summable_on A\<close>
     by (metis (no_types, lifting) assms summable_on_cong mult.assoc mult.right_neutral right_inverse)
 qed
 
 lemma summable_on_cmult_right':
   fixes f :: "'a \<Rightarrow> 'b :: {t2_space, topological_semigroup_mult, division_ring}"
   assumes \<open>c \<noteq> 0\<close>
   shows "(\<lambda>x. c * f x) summable_on A \<longleftrightarrow> f summable_on A"
 proof
   assume \<open>f summable_on A\<close>
   then show \<open>(\<lambda>x. c * f x) summable_on A\<close>
     by (rule summable_on_cmult_right)
 next
   assume \<open>(\<lambda>x. c * f x) summable_on A\<close>
   then have \<open>(\<lambda>x. inverse c * (c * f x)) summable_on A\<close>
     by (rule summable_on_cmult_right)
   then show \<open>f summable_on A\<close>
     by (metis (no_types, lifting) assms summable_on_cong left_inverse mult.assoc mult.left_neutral)
 qed
 
 lemma infsum_cmult_left':
   fixes f :: "'a \<Rightarrow> 'b :: {t2_space, topological_semigroup_mult, division_ring}"
   shows "infsum (\<lambda>x. f x * c) A = infsum f A * c"
   by (metis (full_types) infsum_cmult_left infsum_not_exists mult_eq_0_iff summable_on_cmult_left')
 
 lemma infsum_cmult_right':
   fixes f :: "'a \<Rightarrow> 'b :: {t2_space,topological_semigroup_mult,division_ring}"
   shows "infsum (\<lambda>x. c * f x) A = c * infsum f A"
   by (metis (full_types) infsum_cmult_right infsum_not_exists mult_eq_0_iff summable_on_cmult_right')
 
 
 lemma has_sum_constant[simp]:
   assumes \<open>finite F\<close>
   shows \<open>has_sum (\<lambda>_. c) F (of_nat (card F) * c)\<close>
   by (metis assms has_sum_finite sum_constant)
 
 lemma infsum_constant[simp]:
   assumes \<open>finite F\<close>
   shows \<open>infsum (\<lambda>_. c) F = of_nat (card F) * c\<close>
   by (simp add: assms)
 
 lemma infsum_diverge_constant:
   \<comment> \<open>This probably does not really need all of \<^class>\<open>archimedean_field\<close> but Isabelle/HOL
        has no type class such as, e.g., "archimedean ring".\<close>
   fixes c :: \<open>'a::{archimedean_field, comm_monoid_add, linorder_topology, topological_semigroup_mult}\<close>
   assumes \<open>infinite A\<close> and \<open>c \<noteq> 0\<close>
   shows \<open>\<not> (\<lambda>_. c) summable_on A\<close>
 proof (rule notI)
   assume \<open>(\<lambda>_. c) summable_on A\<close>
   then have \<open>(\<lambda>_. inverse c * c) summable_on A\<close>
     by (rule summable_on_cmult_right)
   then have [simp]: \<open>(\<lambda>_. 1::'a) summable_on A\<close>
     using assms by auto
   have \<open>infsum (\<lambda>_. 1) A \<ge> d\<close> for d :: 'a
   proof -
     obtain n :: nat where \<open>of_nat n \<ge> d\<close>
       by (meson real_arch_simple)
     from assms
     obtain F where \<open>F \<subseteq> A\<close> and \<open>finite F\<close> and \<open>card F = n\<close>
       by (meson infinite_arbitrarily_large)
     note \<open>d \<le> of_nat n\<close>
     also have \<open>of_nat n = infsum (\<lambda>_. 1::'a) F\<close>
       by (simp add: \<open>card F = n\<close> \<open>finite F\<close>)
     also have \<open>\<dots> \<le> infsum (\<lambda>_. 1::'a) A\<close>
       apply (rule infsum_mono_neutral)
       using \<open>finite F\<close> \<open>F \<subseteq> A\<close> by auto
     finally show ?thesis .
   qed                                                        
   then show False
     by (meson linordered_field_no_ub not_less)
 qed
 
 lemma has_sum_constant_archimedean[simp]:
   \<comment> \<open>This probably does not really need all of \<^class>\<open>archimedean_field\<close> but Isabelle/HOL
        has no type class such as, e.g., "archimedean ring".\<close>
   fixes c :: \<open>'a::{archimedean_field, comm_monoid_add, linorder_topology, topological_semigroup_mult}\<close>
   shows \<open>infsum (\<lambda>_. c) A = of_nat (card A) * c\<close>
   by (metis infsum_0 infsum_constant infsum_diverge_constant infsum_not_exists sum.infinite sum_constant)
 
 lemma has_sum_uminus:
   fixes f :: \<open>'a \<Rightarrow> 'b::topological_ab_group_add\<close>
   shows \<open>has_sum (\<lambda>x. - f x) A a \<longleftrightarrow> has_sum f A (- a)\<close>
   by (auto simp add: sum_negf[abs_def] tendsto_minus_cancel_left has_sum_def)
 
 lemma summable_on_uminus:
   fixes f :: \<open>'a \<Rightarrow> 'b::topological_ab_group_add\<close>
   shows\<open>(\<lambda>x. - f x) summable_on A \<longleftrightarrow> f summable_on A\<close>
   by (metis summable_on_def has_sum_uminus verit_minus_simplify(4))
 
 lemma infsum_uminus:
   fixes f :: \<open>'a \<Rightarrow> 'b::{topological_ab_group_add, t2_space}\<close>
   shows \<open>infsum (\<lambda>x. - f x) A = - infsum f A\<close>
   by (metis (full_types) add.inverse_inverse add.inverse_neutral infsumI infsum_def has_sum_infsum has_sum_uminus)
 
 lemma has_sum_le_finite_sums:
   fixes a :: \<open>'a::{comm_monoid_add,topological_space,linorder_topology}\<close>
   assumes \<open>has_sum f A a\<close>
   assumes \<open>\<And>F. finite F \<Longrightarrow> F \<subseteq> A \<Longrightarrow> sum f F \<le> b\<close>
   shows \<open>a \<le> b\<close>
   by (metis assms eventually_finite_subsets_at_top_weakI finite_subsets_at_top_neq_bot has_sum_def tendsto_upperbound)
 
 lemma infsum_le_finite_sums:
   fixes b :: \<open>'a::{comm_monoid_add,topological_space,linorder_topology}\<close>
   assumes \<open>f summable_on A\<close>
   assumes \<open>\<And>F. finite F \<Longrightarrow> F \<subseteq> A \<Longrightarrow> sum f F \<le> b\<close>
   shows \<open>infsum f A \<le> b\<close>
   by (meson assms(1) assms(2) has_sum_infsum has_sum_le_finite_sums)
 
 
 lemma summable_on_scaleR_left [intro]:
   fixes c :: \<open>'a :: real_normed_vector\<close>
   assumes "c \<noteq> 0 \<Longrightarrow> f summable_on A"
   shows   "(\<lambda>x. f x *\<^sub>R c) summable_on A"
 proof (cases \<open>c = 0\<close>)
   case False
   then have "(\<lambda>y. y *\<^sub>R c) \<circ> f summable_on A"
     using assms by (auto simp add: scaleR_left.additive_axioms summable_on_comm_additive)
   then show ?thesis
     by (metis (mono_tags, lifting) comp_apply summable_on_cong)
 qed auto
 
 
 lemma summable_on_scaleR_right [intro]:
   fixes f :: \<open>'a \<Rightarrow> 'b :: real_normed_vector\<close>
   assumes "c \<noteq> 0 \<Longrightarrow> f summable_on A"
   shows   "(\<lambda>x. c *\<^sub>R f x) summable_on A"
 proof (cases \<open>c = 0\<close>)
   case False
   then have "(*\<^sub>R) c \<circ> f summable_on A"
   using assms by (auto simp add: scaleR_right.additive_axioms summable_on_comm_additive)
   then show ?thesis
     by (metis (mono_tags, lifting) comp_apply summable_on_cong)
 qed auto
 
 lemma infsum_scaleR_left:
   fixes c :: \<open>'a :: real_normed_vector\<close>
   assumes "c \<noteq> 0 \<Longrightarrow> f summable_on A"
   shows   "infsum (\<lambda>x. f x *\<^sub>R c) A = infsum f A *\<^sub>R c"
 proof (cases \<open>c = 0\<close>)
   case False
   then have "infsum ((\<lambda>y. y *\<^sub>R c) \<circ> f) A = infsum f A *\<^sub>R c"
   using assms by (auto simp add: scaleR_left.additive_axioms infsum_comm_additive)
   then show ?thesis
     by (metis (mono_tags, lifting) comp_apply infsum_cong)
 qed auto
 
 lemma infsum_scaleR_right:
   fixes f :: \<open>'a \<Rightarrow> 'b :: real_normed_vector\<close>
   shows   "infsum (\<lambda>x. c *\<^sub>R f x) A = c *\<^sub>R infsum f A"
 proof -
   consider (summable) \<open>f summable_on A\<close> | (c0) \<open>c = 0\<close> | (not_summable) \<open>\<not> f summable_on A\<close> \<open>c \<noteq> 0\<close>
     by auto
   then show ?thesis
   proof cases
     case summable
     then have "infsum ((*\<^sub>R) c \<circ> f) A = c *\<^sub>R infsum f A"
       by (auto simp add: scaleR_right.additive_axioms infsum_comm_additive)
     then show ?thesis
       by (metis (mono_tags, lifting) comp_apply infsum_cong)
   next
     case c0
     then show ?thesis by auto
   next
     case not_summable
     have \<open>\<not> (\<lambda>x. c *\<^sub>R f x) summable_on A\<close>
     proof (rule notI)
       assume \<open>(\<lambda>x. c *\<^sub>R f x) summable_on A\<close>
       then have \<open>(\<lambda>x. inverse c *\<^sub>R c *\<^sub>R f x) summable_on A\<close>
         using summable_on_scaleR_right by blast
       with not_summable show False
         by simp
     qed
     then show ?thesis
       by (simp add: infsum_not_exists not_summable(1)) 
   qed
 qed
 
 
 lemma infsum_Un_Int:
   fixes f :: "'a \<Rightarrow> 'b::{topological_ab_group_add, t2_space}"
   assumes "f summable_on A - B" "f summable_on B - A" \<open>f summable_on A \<inter> B\<close>
   shows   "infsum f (A \<union> B) = infsum f A + infsum f B - infsum f (A \<inter> B)"
 
 proof -
   have \<open>f summable_on A\<close>
     using assms by (metis Diff_Diff_Int Diff_disjoint Un_Diff_Int summable_on_Un_disjoint)
   have \<open>infsum f (A \<union> B) = infsum f A + infsum f (B - A)\<close>
     by (metis Diff_disjoint Un_Diff_cancel \<open>f summable_on A\<close> assms(2) infsum_Un_disjoint)
   moreover have \<open>infsum f (B - A \<union> A \<inter> B) = infsum f (B - A) + infsum f (A \<inter> B)\<close>
     using assms by (metis Int_Diff_disjoint inf_commute infsum_Un_disjoint)
   ultimately show ?thesis
     by (metis Un_Diff_Int add_diff_cancel_right' add_diff_eq inf_commute)
 qed
 
 lemma inj_combinator':
   assumes "x \<notin> F"
   shows \<open>inj_on (\<lambda>(g, y). g(x := y)) (Pi\<^sub>E F B \<times> B x)\<close>
 proof -
   have "inj_on ((\<lambda>(y, g). g(x := y)) \<circ> prod.swap) (Pi\<^sub>E F B \<times> B x)"
     using inj_combinator[of x F B] assms by (intro comp_inj_on) (auto simp: product_swap)
   thus ?thesis
     by (simp add: o_def)
 qed
 
 lemma infsum_prod_PiE:
   \<comment> \<open>See also \<open>infsum_prod_PiE_abs\<close> below with incomparable premises.\<close>
   fixes f :: "'a \<Rightarrow> 'b \<Rightarrow> 'c :: {comm_monoid_mult, topological_semigroup_mult, division_ring, banach}"
   assumes finite: "finite A"
   assumes "\<And>x. x \<in> A \<Longrightarrow> f x summable_on B x"
   assumes "(\<lambda>g. \<Prod>x\<in>A. f x (g x)) summable_on (PiE A B)"
   shows   "infsum (\<lambda>g. \<Prod>x\<in>A. f x (g x)) (PiE A B) = (\<Prod>x\<in>A. infsum (f x) (B x))"
 proof (use finite assms(2-) in induction)
   case empty
   then show ?case 
     by auto
 next
   case (insert x F)
   have pi: \<open>Pi\<^sub>E (insert x F) B = (\<lambda>(g,y). g(x:=y)) ` (Pi\<^sub>E F B \<times> B x)\<close>
     unfolding PiE_insert_eq 
     by (subst swap_product [symmetric]) (simp add: image_image case_prod_unfold)
   have prod: \<open>(\<Prod>x'\<in>F. f x' ((p(x:=y)) x')) = (\<Prod>x'\<in>F. f x' (p x'))\<close> for p y
     by (rule prod.cong) (use insert.hyps in auto)
   have inj: \<open>inj_on (\<lambda>(g, y). g(x := y)) (Pi\<^sub>E F B \<times> B x)\<close>
     using \<open>x \<notin> F\<close> by (rule inj_combinator')
 
   have summable1: \<open>(\<lambda>g. \<Prod>x\<in>insert x F. f x (g x)) summable_on Pi\<^sub>E (insert x F) B\<close>
     using insert.prems(2) .
   also have \<open>Pi\<^sub>E (insert x F) B = (\<lambda>(g,y). g(x:=y)) ` (Pi\<^sub>E F B \<times> B x)\<close>
     by (simp only: pi)
   also have "(\<lambda>g. \<Prod>x\<in>insert x F. f x (g x)) summable_on \<dots> \<longleftrightarrow>
                ((\<lambda>g. \<Prod>x\<in>insert x F. f x (g x)) \<circ> (\<lambda>(g,y). g(x:=y))) summable_on (Pi\<^sub>E F B \<times> B x)"
     using inj by (rule summable_on_reindex)
   also have "(\<Prod>z\<in>F. f z ((g(x := y)) z)) = (\<Prod>z\<in>F. f z (g z))" for g y
     using insert.hyps by (intro prod.cong) auto
   hence "((\<lambda>g. \<Prod>x\<in>insert x F. f x (g x)) \<circ> (\<lambda>(g,y). g(x:=y))) =
              (\<lambda>(p, y). f x y * (\<Prod>x'\<in>F. f x' (p x')))"
     using insert.hyps by (auto simp: fun_eq_iff cong: prod.cong_simp)
   finally have summable2: \<open>(\<lambda>(p, y). f x y * (\<Prod>x'\<in>F. f x' (p x'))) summable_on Pi\<^sub>E F B \<times> B x\<close> .
 
   then have \<open>(\<lambda>p. \<Sum>\<^sub>\<infinity>y\<in>B x. f x y * (\<Prod>x'\<in>F. f x' (p x'))) summable_on Pi\<^sub>E F B\<close>
     by (rule summable_on_Sigma_banach)
   then have \<open>(\<lambda>p. (\<Sum>\<^sub>\<infinity>y\<in>B x. f x y) * (\<Prod>x'\<in>F. f x' (p x'))) summable_on Pi\<^sub>E F B\<close>
     by (metis (mono_tags, lifting) infsum_cmult_left' infsum_cong summable_on_cong)
   then have summable3: \<open>(\<lambda>p. (\<Prod>x'\<in>F. f x' (p x'))) summable_on Pi\<^sub>E F B\<close> if \<open>(\<Sum>\<^sub>\<infinity>y\<in>B x. f x y) \<noteq> 0\<close>
     using summable_on_cmult_right' that by blast
 
   have \<open>(\<Sum>\<^sub>\<infinity>g\<in>Pi\<^sub>E (insert x F) B. \<Prod>x\<in>insert x F. f x (g x))
      = (\<Sum>\<^sub>\<infinity>(p,y)\<in>Pi\<^sub>E F B \<times> B x. \<Prod>x'\<in>insert x F. f x' ((p(x:=y)) x'))\<close>
     by (smt (verit, ccfv_SIG) comp_apply infsum_cong infsum_reindex inj pi prod.cong split_def)
   also have \<open>\<dots> = (\<Sum>\<^sub>\<infinity>(p, y)\<in>Pi\<^sub>E F B \<times> B x. f x y * (\<Prod>x'\<in>F. f x' ((p(x:=y)) x')))\<close>
     using insert.hyps by auto
   also have \<open>\<dots> = (\<Sum>\<^sub>\<infinity>(p, y)\<in>Pi\<^sub>E F B \<times> B x. f x y * (\<Prod>x'\<in>F. f x' (p x')))\<close>
     using prod by presburger
   also have \<open>\<dots> = (\<Sum>\<^sub>\<infinity>p\<in>Pi\<^sub>E F B. \<Sum>\<^sub>\<infinity>y\<in>B x. f x y * (\<Prod>x'\<in>F. f x' (p x')))\<close>
     using infsum_Sigma'_banach summable2 by force
   also have \<open>\<dots> = (\<Sum>\<^sub>\<infinity>y\<in>B x. f x y) * (\<Sum>\<^sub>\<infinity>p\<in>Pi\<^sub>E F B. \<Prod>x'\<in>F. f x' (p x'))\<close>
     by (smt (verit) infsum_cmult_left' infsum_cmult_right' infsum_cong)
   also have \<open>\<dots> = (\<Prod>x\<in>insert x F. infsum (f x) (B x))\<close>
     using insert summable3 by auto
   finally show ?case
     by simp
 qed
 
 lemma infsum_prod_PiE_abs:
   \<comment> \<open>See also @{thm [source] infsum_prod_PiE} above with incomparable premises.\<close>
   fixes f :: "'a \<Rightarrow> 'b \<Rightarrow> 'c :: {banach, real_normed_div_algebra, comm_semiring_1}"
   assumes finite: "finite A"
   assumes "\<And>x. x \<in> A \<Longrightarrow> f x abs_summable_on B x"
   shows   "infsum (\<lambda>g. \<Prod>x\<in>A. f x (g x)) (PiE A B) = (\<Prod>x\<in>A. infsum (f x) (B x))"
 proof (use finite assms(2) in induction)
   case empty
   then show ?case 
     by auto
 next
   case (insert x A)
   
   have pi: \<open>Pi\<^sub>E (insert x F) B = (\<lambda>(g,y). g(x:=y)) ` (Pi\<^sub>E F B \<times> B x)\<close> for x F and B :: "'a \<Rightarrow> 'b set"
     unfolding PiE_insert_eq 
     by (subst swap_product [symmetric]) (simp add: image_image case_prod_unfold)
   have prod: \<open>(\<Prod>x'\<in>A. f x' ((p(x:=y)) x')) = (\<Prod>x'\<in>A. f x' (p x'))\<close> for p y
     by (rule prod.cong) (use insert.hyps in auto)
   have inj: \<open>inj_on (\<lambda>(g, y). g(x := y)) (Pi\<^sub>E A B \<times> B x)\<close>
     using \<open>x \<notin> A\<close> by (rule inj_combinator')
 
   define s where \<open>s x = infsum (\<lambda>y. norm (f x y)) (B x)\<close> for x
 
   have *: \<open>(\<Sum>p\<in>P. norm (\<Prod>x\<in>F. f x (p x))) \<le> prod s F\<close> 
     if P: \<open>P \<subseteq> Pi\<^sub>E F B\<close> and [simp]: \<open>finite P\<close> \<open>finite F\<close> 
       and sum: \<open>\<And>x. x \<in> F \<Longrightarrow> f x abs_summable_on B x\<close> for P F
   proof -
     define B' where \<open>B' x = {p x| p. p\<in>P}\<close> for x
     have fin_B'[simp]: \<open>finite (B' x)\<close> for x
       using that by (auto simp: B'_def)
     have [simp]: \<open>finite (Pi\<^sub>E F B')\<close>
       by (simp add: finite_PiE)
     have [simp]: \<open>P \<subseteq> Pi\<^sub>E F B'\<close>
       using that by (auto simp: B'_def)
     have B'B: \<open>B' x \<subseteq> B x\<close> if \<open>x \<in> F\<close> for x
       unfolding B'_def using P that 
       by auto
     have s_bound: \<open>(\<Sum>y\<in>B' x. norm (f x y)) \<le> s x\<close> if \<open>x \<in> F\<close> for x
       by (metis B'B fin_B' finite_sum_le_has_sum has_sum_infsum norm_ge_zero s_def sum that)
     have \<open>(\<Sum>p\<in>P. norm (\<Prod>x\<in>F. f x (p x))) \<le> (\<Sum>p\<in>Pi\<^sub>E F B'. norm (\<Prod>x\<in>F. f x (p x)))\<close>
       by (simp add: sum_mono2)
     also have \<open>\<dots> = (\<Sum>p\<in>Pi\<^sub>E F B'. \<Prod>x\<in>F. norm (f x (p x)))\<close>
       by (simp add: prod_norm)
     also have \<open>\<dots> = (\<Prod>x\<in>F. \<Sum>y\<in>B' x. norm (f x y))\<close>
     proof (use \<open>finite F\<close> in induction)
       case empty
       then show ?case by simp
     next
       case (insert x F)
       have aux: \<open>a = b \<Longrightarrow> c * a = c * b\<close> for a b c :: real
         by auto
       have inj: \<open>inj_on (\<lambda>(g, y). g(x := y)) (Pi\<^sub>E F B' \<times> B' x)\<close>
         by (simp add: inj_combinator' insert.hyps)
       then have \<open>(\<Sum>p\<in>Pi\<^sub>E (insert x F) B'. \<Prod>x\<in>insert x F. norm (f x (p x)))
          =  (\<Sum>(p,y)\<in>Pi\<^sub>E F B' \<times> B' x. \<Prod>x'\<in>insert x F. norm (f x' ((p(x := y)) x')))\<close>
         by (simp add: pi sum.reindex case_prod_unfold)
       also have \<open>\<dots> = (\<Sum>(p,y)\<in>Pi\<^sub>E F B' \<times> B' x. norm (f x y) * (\<Prod>x'\<in>F. norm (f x' ((p(x := y)) x'))))\<close>
         using insert.hyps by auto
       also have \<open>\<dots> = (\<Sum>(p, y)\<in>Pi\<^sub>E F B' \<times> B' x. norm (f x y) * (\<Prod>x'\<in>F. norm (f x' (p x'))))\<close>
         by (smt (verit) fun_upd_apply insert.hyps(2) prod.cong split_def sum.cong)
       also have \<open>\<dots> = (\<Sum>y\<in>B' x. norm (f x y)) * (\<Sum>p\<in>Pi\<^sub>E F B'. \<Prod>x'\<in>F. norm (f x' (p x')))\<close>
         by (simp add: sum_product sum.swap [of _ "Pi\<^sub>E F B'"] sum.cartesian_product)
       also have \<open>\<dots> = (\<Sum>y\<in>B' x. norm (f x y)) * (\<Prod>x\<in>F. \<Sum>y\<in>B' x. norm (f x y))\<close>
         by (simp add: insert.IH)
       also have \<open>\<dots> = (\<Prod>x\<in>insert x F. \<Sum>y\<in>B' x. norm (f x y))\<close>
         using insert.hyps(1) insert.hyps(2) by force
       finally show ?case .
     qed
     also have \<open>\<dots> = (\<Prod>x\<in>F. \<Sum>\<^sub>\<infinity>y\<in>B' x. norm (f x y))\<close>
       by auto
     also have \<open>\<dots> \<le> (\<Prod>x\<in>F. s x)\<close>
       using s_bound by (simp add: prod_mono sum_nonneg)
     finally show ?thesis .
   qed
   have "bdd_above
      (sum (\<lambda>g. norm (\<Prod>x\<in>insert x A. f x (g x))) ` {F. F \<subseteq> Pi\<^sub>E (insert x A) B \<and> finite F})"
     apply (rule bdd_aboveI)
     using * insert.hyps insert.prems by blast
   then have \<open>(\<lambda>g. \<Prod>x\<in>insert x A. f x (g x)) abs_summable_on Pi\<^sub>E (insert x A) B\<close>
     using nonneg_bdd_above_summable_on
     by (metis (mono_tags, lifting) Collect_cong norm_ge_zero)
   also have \<open>Pi\<^sub>E (insert x A) B = (\<lambda>(g,y). g(x:=y)) ` (Pi\<^sub>E A B \<times> B x)\<close>
     by (simp only: pi)
   also have "(\<lambda>g. \<Prod>x\<in>insert x A. f x (g x)) abs_summable_on \<dots> \<longleftrightarrow>
                ((\<lambda>g. \<Prod>x\<in>insert x A. f x (g x)) \<circ> (\<lambda>(g,y). g(x:=y))) abs_summable_on (Pi\<^sub>E A B \<times> B x)"
     using inj by (subst summable_on_reindex) (auto simp: o_def)
   also have "(\<Prod>z\<in>A. f z ((g(x := y)) z)) = (\<Prod>z\<in>A. f z (g z))" for g y
     using insert.hyps by (intro prod.cong) auto
   hence "((\<lambda>g. \<Prod>x\<in>insert x A. f x (g x)) \<circ> (\<lambda>(g,y). g(x:=y))) =
              (\<lambda>(p, y). f x y * (\<Prod>x'\<in>A. f x' (p x')))"
     using insert.hyps by (auto simp: fun_eq_iff cong: prod.cong_simp)
   finally have summable2: \<open>(\<lambda>(p, y). f x y * (\<Prod>x'\<in>A. f x' (p x'))) abs_summable_on Pi\<^sub>E A B \<times> B x\<close> .
 
   have \<open>(\<Sum>\<^sub>\<infinity>g\<in>Pi\<^sub>E (insert x A) B. \<Prod>x\<in>insert x A. f x (g x))
      = (\<Sum>\<^sub>\<infinity>(p,y)\<in>Pi\<^sub>E A B \<times> B x. \<Prod>x'\<in>insert x A. f x' ((p(x:=y)) x'))\<close>
     using inj by (simp add: pi infsum_reindex o_def case_prod_unfold)
   also have \<open>\<dots> = (\<Sum>\<^sub>\<infinity>(p,y) \<in> Pi\<^sub>E A B \<times> B x. f x y * (\<Prod>x'\<in>A. f x' ((p(x:=y)) x')))\<close>
     using insert.hyps by auto
   also have \<open>\<dots> = (\<Sum>\<^sub>\<infinity>(p,y) \<in> Pi\<^sub>E A B \<times> B x. f x y * (\<Prod>x'\<in>A. f x' (p x')))\<close>
     using prod by presburger
   also have \<open>\<dots> = (\<Sum>\<^sub>\<infinity>p\<in>Pi\<^sub>E A B. \<Sum>\<^sub>\<infinity>y\<in>B x. f x y * (\<Prod>x'\<in>A. f x' (p x')))\<close>
     using abs_summable_summable infsum_Sigma'_banach summable2 by fastforce
   also have \<open>\<dots> = (\<Sum>\<^sub>\<infinity>y\<in>B x. f x y) * (\<Sum>\<^sub>\<infinity>p\<in>Pi\<^sub>E A B. \<Prod>x'\<in>A. f x' (p x'))\<close>
     by (smt (verit, best) infsum_cmult_left' infsum_cmult_right' infsum_cong)
   also have \<open>\<dots> = (\<Prod>x\<in>insert x A. infsum (f x) (B x))\<close>
     by (simp add: insert)
   finally show ?case
     by simp
 qed
 
 
 
 subsection \<open>Absolute convergence\<close>
 
 lemma abs_summable_countable:
   assumes \<open>f abs_summable_on A\<close>
   shows \<open>countable {x\<in>A. f x \<noteq> 0}\<close>
 proof -
   have fin: \<open>finite {x\<in>A. norm (f x) \<ge> t}\<close> if \<open>t > 0\<close> for t
   proof (rule ccontr)
     assume *: \<open>infinite {x \<in> A. t \<le> norm (f x)}\<close>
     have \<open>infsum (\<lambda>x. norm (f x)) A \<ge> b\<close> for b
     proof -
       obtain b' where b': \<open>of_nat b' \<ge> b / t\<close>
         by (meson real_arch_simple)
       from *
       obtain F where cardF: \<open>card F \<ge> b'\<close> and \<open>finite F\<close> and F: \<open>F \<subseteq> {x \<in> A. t \<le> norm (f x)}\<close>
         by (meson finite_if_finite_subsets_card_bdd nle_le)
       have \<open>b \<le> of_nat b' * t\<close>
         using b' \<open>t > 0\<close> by (simp add: field_simps split: if_splits)
       also have \<open>\<dots> \<le> of_nat (card F) * t\<close>
         by (simp add: cardF that)
       also have \<open>\<dots> = sum (\<lambda>x. t) F\<close>
         by simp
       also have \<open>\<dots> \<le> sum (\<lambda>x. norm (f x)) F\<close>
         by (metis (mono_tags, lifting) F in_mono mem_Collect_eq sum_mono)
       also have \<open>\<dots> = infsum (\<lambda>x. norm (f x)) F\<close>
         using \<open>finite F\<close> by (rule infsum_finite[symmetric])
       also have \<open>\<dots> \<le> infsum (\<lambda>x. norm (f x)) A\<close>
         by (rule infsum_mono_neutral) (use \<open>finite F\<close> assms F in auto)
       finally show ?thesis .
     qed
     then show False
       by (meson gt_ex linorder_not_less)
   qed
   have \<open>countable (\<Union>i\<in>{1..}. {x\<in>A. norm (f x) \<ge> 1/of_nat i})\<close>
     by (rule countable_UN) (use fin in \<open>auto intro!: countable_finite\<close>)
   also have \<open>\<dots> = {x\<in>A. f x \<noteq> 0}\<close>
   proof safe
     fix x assume x: "x \<in> A" "f x \<noteq> 0"
     define i where "i = max 1 (nat (ceiling (1 / norm (f x))))"
     have "i \<ge> 1"
       by (simp add: i_def)
     moreover have "real i \<ge> 1 / norm (f x)"
       unfolding i_def by linarith
     hence "1 / real i \<le> norm (f x)" using \<open>f x \<noteq> 0\<close>
       by (auto simp: divide_simps mult_ac)
     ultimately show "x \<in> (\<Union>i\<in>{1..}. {x \<in> A. 1 / real i \<le> norm (f x)})"
       using \<open>x \<in> A\<close> by auto
   qed auto
   finally show ?thesis .
 qed
 
 (* Logically belongs in the section about reals, but needed as a dependency here *)
 lemma summable_on_iff_abs_summable_on_real:
   fixes f :: \<open>'a \<Rightarrow> real\<close>
   shows \<open>f summable_on A \<longleftrightarrow> f abs_summable_on A\<close>
 proof (rule iffI)
   assume \<open>f summable_on A\<close>
   define n A\<^sub>p A\<^sub>n
     where \<open>n x = norm (f x)\<close> and \<open>A\<^sub>p = {x\<in>A. f x \<ge> 0}\<close> and \<open>A\<^sub>n = {x\<in>A. f x < 0}\<close> for x
   have A: \<open>A\<^sub>p \<union> A\<^sub>n = A\<close> \<open>A\<^sub>p \<inter> A\<^sub>n = {}\<close>
     by (auto simp: A\<^sub>p_def A\<^sub>n_def)
   from \<open>f summable_on A\<close> have \<open>f summable_on A\<^sub>p\<close> \<open>f summable_on A\<^sub>n\<close>
     using A\<^sub>p_def A\<^sub>n_def summable_on_subset_banach by fastforce+
   then have \<open>n summable_on A\<^sub>p\<close>
     by (smt (verit) A\<^sub>p_def n_def mem_Collect_eq real_norm_def summable_on_cong)
   moreover have \<open>n summable_on A\<^sub>n\<close>
     by (smt (verit, best) \<open>f summable_on A\<^sub>n\<close>  summable_on_uminus A\<^sub>n_def n_def summable_on_cong mem_Collect_eq real_norm_def)
   ultimately show \<open>n summable_on A\<close>
     using A summable_on_Un_disjoint by blast
 next
   show \<open>f abs_summable_on A \<Longrightarrow> f summable_on A\<close>
     using abs_summable_summable by blast
 qed
 
 lemma abs_summable_on_Sigma_iff:
   shows   "f abs_summable_on Sigma A B \<longleftrightarrow>
              (\<forall>x\<in>A. (\<lambda>y. f (x, y)) abs_summable_on B x) \<and>
              ((\<lambda>x. infsum (\<lambda>y. norm (f (x, y))) (B x)) abs_summable_on A)"
 proof (intro iffI conjI ballI)
   assume asm: \<open>f abs_summable_on Sigma A B\<close>
   then have \<open>(\<lambda>x. infsum (\<lambda>y. norm (f (x,y))) (B x)) summable_on A\<close>
     by (simp add: cond_case_prod_eta summable_on_Sigma_banach)
   then show \<open>(\<lambda>x. \<Sum>\<^sub>\<infinity>y\<in>B x. norm (f (x, y))) abs_summable_on A\<close>
     using summable_on_iff_abs_summable_on_real by force
 
   show \<open>(\<lambda>y. f (x, y)) abs_summable_on B x\<close> if \<open>x \<in> A\<close> for x
   proof -
     from asm have \<open>f abs_summable_on Pair x ` B x\<close>
       by (simp add: image_subset_iff summable_on_subset_banach that)
     then show ?thesis
       by (metis (mono_tags, lifting) o_def inj_on_def summable_on_reindex prod.inject summable_on_cong)
   qed
 next
   assume asm: \<open>(\<forall>x\<in>A. (\<lambda>xa. f (x, xa)) abs_summable_on B x) \<and>
     (\<lambda>x. \<Sum>\<^sub>\<infinity>y\<in>B x. norm (f (x, y))) abs_summable_on A\<close>
   have \<open>(\<Sum>xy\<in>F. norm (f xy)) \<le> (\<Sum>\<^sub>\<infinity>x\<in>A. \<Sum>\<^sub>\<infinity>y\<in>B x. norm (f (x, y)))\<close>
     if \<open>F \<subseteq> Sigma A B\<close> and [simp]: \<open>finite F\<close> for F
   proof -
     have [simp]: \<open>(SIGMA x:fst ` F. {y. (x, y) \<in> F}) = F\<close>
       by (auto intro!: set_eqI simp add: Domain.DomainI fst_eq_Domain)
     have [simp]: \<open>finite {y. (x, y) \<in> F}\<close> for x
       by (metis \<open>finite F\<close> Range.intros finite_Range finite_subset mem_Collect_eq subsetI)
     have \<open>(\<Sum>xy\<in>F. norm (f xy)) = (\<Sum>x\<in>fst ` F. \<Sum>y\<in>{y. (x,y)\<in>F}. norm (f (x,y)))\<close>
       by (simp add: sum.Sigma)
     also have \<open>\<dots> = (\<Sum>\<^sub>\<infinity>x\<in>fst ` F. \<Sum>\<^sub>\<infinity>y\<in>{y. (x,y)\<in>F}. norm (f (x,y)))\<close>
       by auto
     also have \<open>\<dots> \<le> (\<Sum>\<^sub>\<infinity>x\<in>fst ` F. \<Sum>\<^sub>\<infinity>y\<in>B x. norm (f (x,y)))\<close>
       using asm that(1) by (intro infsum_mono infsum_mono_neutral) auto
     also have \<open>\<dots> \<le> (\<Sum>\<^sub>\<infinity>x\<in>A. \<Sum>\<^sub>\<infinity>y\<in>B x. norm (f (x,y)))\<close>
       by (rule infsum_mono_neutral) (use asm that(1) in \<open>auto simp add: infsum_nonneg\<close>)
     finally show ?thesis .
   qed
   then show \<open>f abs_summable_on Sigma A B\<close>
     by (intro nonneg_bdd_above_summable_on) (auto simp: bdd_above_def)
 qed
 
 lemma abs_summable_on_comparison_test:
   assumes "g abs_summable_on A"
   assumes "\<And>x. x \<in> A \<Longrightarrow> norm (f x) \<le> norm (g x)"
   shows   "f abs_summable_on A"
 proof (rule nonneg_bdd_above_summable_on)
   show "bdd_above (sum (\<lambda>x. norm (f x)) ` {F. F \<subseteq> A \<and> finite F})"
   proof (rule bdd_aboveI2)
     fix F assume F: "F \<in> {F. F \<subseteq> A \<and> finite F}"
     have \<open>sum (\<lambda>x. norm (f x)) F \<le> sum (\<lambda>x. norm (g x)) F\<close>
       using assms F by (intro sum_mono) auto
     also have \<open>\<dots> = infsum (\<lambda>x. norm (g x)) F\<close>
       using F by simp
     also have \<open>\<dots> \<le> infsum (\<lambda>x. norm (g x)) A\<close>
     proof (rule infsum_mono_neutral)
       show "g abs_summable_on F"
         by (rule summable_on_subset_banach[OF assms(1)]) (use F in auto)
     qed (use F assms in auto)
     finally show "(\<Sum>x\<in>F. norm (f x)) \<le> (\<Sum>\<^sub>\<infinity>x\<in>A. norm (g x))" .
   qed
 qed auto
 
 lemma abs_summable_iff_bdd_above:
   fixes f :: \<open>'a \<Rightarrow> 'b::real_normed_vector\<close>
   shows \<open>f abs_summable_on A \<longleftrightarrow> bdd_above (sum (\<lambda>x. norm (f x)) ` {F. F\<subseteq>A \<and> finite F})\<close>
 proof (rule iffI)
   assume \<open>f abs_summable_on A\<close>
   show \<open>bdd_above (sum (\<lambda>x. norm (f x)) ` {F. F \<subseteq> A \<and> finite F})\<close>
   proof (rule bdd_aboveI2)
     fix F assume F: "F \<in> {F. F \<subseteq> A \<and> finite F}"
     show "(\<Sum>x\<in>F. norm (f x)) \<le> (\<Sum>\<^sub>\<infinity>x\<in>A. norm (f x))"
       by (rule finite_sum_le_infsum) (use \<open>f abs_summable_on A\<close> F in auto)
   qed
 next
   assume \<open>bdd_above (sum (\<lambda>x. norm (f x)) ` {F. F\<subseteq>A \<and> finite F})\<close>
   then show \<open>f abs_summable_on A\<close>
     by (simp add: nonneg_bdd_above_summable_on)
 qed
 
 lemma abs_summable_product:
   fixes x :: "'a \<Rightarrow> 'b::{real_normed_div_algebra,banach,second_countable_topology}"
   assumes x2_sum: "(\<lambda>i. (x i) * (x i)) abs_summable_on A"
     and y2_sum: "(\<lambda>i. (y i) * (y i)) abs_summable_on A"
   shows "(\<lambda>i. x i * y i) abs_summable_on A"
 proof (rule nonneg_bdd_above_summable_on)
   show "bdd_above (sum (\<lambda>xa. norm (x xa * y xa)) ` {F. F \<subseteq> A \<and> finite F})"
   proof (rule bdd_aboveI2)
     fix F assume F: \<open>F \<in> {F. F \<subseteq> A \<and> finite F}\<close>
     then have r1: "finite F" and b4: "F \<subseteq> A"
       by auto
   
     have a1: "(\<Sum>\<^sub>\<infinity>i\<in>F. norm (x i * x i)) \<le> (\<Sum>\<^sub>\<infinity>i\<in>A. norm (x i * x i))"
       by (metis (no_types, lifting) b4 infsum_mono2 norm_ge_zero summable_on_subset_banach x2_sum)
 
     have "norm (x i * y i) \<le> norm (x i * x i) + norm (y i * y i)" for i
       unfolding norm_mult by (smt mult_left_mono mult_nonneg_nonneg mult_right_mono norm_ge_zero)
     hence "(\<Sum>i\<in>F. norm (x i * y i)) \<le> (\<Sum>i\<in>F. norm (x i * x i) + norm (y i * y i))"
       by (simp add: sum_mono)
     also have "\<dots> = (\<Sum>i\<in>F. norm (x i * x i)) + (\<Sum>i\<in>F. norm (y i * y i))"
       by (simp add: sum.distrib)
     also have "\<dots> = (\<Sum>\<^sub>\<infinity>i\<in>F. norm (x i * x i)) + (\<Sum>\<^sub>\<infinity>i\<in>F. norm (y i * y i))"
       by (simp add: \<open>finite F\<close>)
     also have "\<dots> \<le> (\<Sum>\<^sub>\<infinity>i\<in>A. norm (x i * x i)) + (\<Sum>\<^sub>\<infinity>i\<in>A. norm (y i * y i))"
       using F assms
       by (intro add_mono infsum_mono2) auto
     finally show \<open>(\<Sum>xa\<in>F. norm (x xa * y xa)) \<le> (\<Sum>\<^sub>\<infinity>i\<in>A. norm (x i * x i)) + (\<Sum>\<^sub>\<infinity>i\<in>A. norm (y i * y i))\<close>
       by simp
   qed
 qed auto
 
 subsection \<open>Extended reals and nats\<close>
 
 lemma summable_on_ennreal[simp]: \<open>(f::_ \<Rightarrow> ennreal) summable_on S\<close>
   by (rule nonneg_summable_on_complete) simp
 
 lemma summable_on_enat[simp]: \<open>(f::_ \<Rightarrow> enat) summable_on S\<close>
   by (rule nonneg_summable_on_complete) simp
 
 lemma has_sum_superconst_infinite_ennreal:
   fixes f :: \<open>'a \<Rightarrow> ennreal\<close>
   assumes geqb: \<open>\<And>x. x \<in> S \<Longrightarrow> f x \<ge> b\<close>
   assumes b: \<open>b > 0\<close>
   assumes \<open>infinite S\<close>
   shows "has_sum f S \<infinity>"
 proof -
   have \<open>(sum f \<longlongrightarrow> \<infinity>) (finite_subsets_at_top S)\<close>
   proof (rule order_tendstoI[rotated], simp)
     fix y :: ennreal assume \<open>y < \<infinity>\<close>
     then have \<open>y / b < \<infinity>\<close>
       by (metis b ennreal_divide_eq_top_iff gr_implies_not_zero infinity_ennreal_def top.not_eq_extremum)
     then obtain F where \<open>finite F\<close> and \<open>F \<subseteq> S\<close> and cardF: \<open>card F > y / b\<close>
       using \<open>infinite S\<close>
       by (metis ennreal_Ex_less_of_nat infinite_arbitrarily_large infinity_ennreal_def)
     moreover have \<open>sum f Y > y\<close> if \<open>finite Y\<close> and \<open>F \<subseteq> Y\<close> and \<open>Y \<subseteq> S\<close> for Y
     proof -
       have \<open>y < b * card F\<close>
         by (metis \<open>y < \<infinity>\<close> b cardF divide_less_ennreal ennreal_mult_eq_top_iff gr_implies_not_zero infinity_ennreal_def mult.commute top.not_eq_extremum)
       also have \<open>\<dots> \<le> b * card Y\<close>
         by (meson b card_mono less_imp_le mult_left_mono of_nat_le_iff that(1) that(2))
       also have \<open>\<dots> = sum (\<lambda>_. b) Y\<close>
         by (simp add: mult.commute)
       also have \<open>\<dots> \<le> sum f Y\<close>
         using geqb by (meson subset_eq sum_mono that(3))
       finally show ?thesis .
     qed
     ultimately show \<open>\<forall>\<^sub>F x in finite_subsets_at_top S. y < sum f x\<close>
       unfolding eventually_finite_subsets_at_top 
       by auto
   qed
   then show ?thesis
     by (simp add: has_sum_def)
 qed
 
 lemma infsum_superconst_infinite_ennreal:
   fixes f :: \<open>'a \<Rightarrow> ennreal\<close>
   assumes \<open>\<And>x. x \<in> S \<Longrightarrow> f x \<ge> b\<close>
   assumes \<open>b > 0\<close>
   assumes \<open>infinite S\<close>
   shows "infsum f S = \<infinity>"
   using assms infsumI has_sum_superconst_infinite_ennreal by blast
 
 lemma infsum_superconst_infinite_ereal:
   fixes f :: \<open>'a \<Rightarrow> ereal\<close>
   assumes geqb: \<open>\<And>x. x \<in> S \<Longrightarrow> f x \<ge> b\<close>
   assumes b: \<open>b > 0\<close>
   assumes \<open>infinite S\<close>
   shows "infsum f S = \<infinity>"
 proof -
   obtain b' where b': \<open>e2ennreal b' = b\<close> and \<open>b' > 0\<close>
     using b by blast
   have "0 < e2ennreal b"
     using b' b
     by (metis dual_order.refl enn2ereal_e2ennreal gr_zeroI order_less_le zero_ennreal.abs_eq)
   hence *: \<open>infsum (e2ennreal \<circ> f) S = \<infinity>\<close>
     using assms b'
     by (intro infsum_superconst_infinite_ennreal[where b=b']) (auto intro!: e2ennreal_mono)
   have \<open>infsum f S = infsum (enn2ereal \<circ> (e2ennreal \<circ> f)) S\<close>
     using geqb b by (intro infsum_cong) (fastforce simp: enn2ereal_e2ennreal)
   also have \<open>\<dots> = enn2ereal \<infinity>\<close>
     using * by (simp add: infsum_comm_additive_general continuous_at_enn2ereal)
   also have \<open>\<dots> = \<infinity>\<close>
     by simp
   finally show ?thesis .
 qed
 
 lemma has_sum_superconst_infinite_ereal:
   fixes f :: \<open>'a \<Rightarrow> ereal\<close>
   assumes \<open>\<And>x. x \<in> S \<Longrightarrow> f x \<ge> b\<close>
   assumes \<open>b > 0\<close>
   assumes \<open>infinite S\<close>
   shows "has_sum f S \<infinity>"
   by (metis Infty_neq_0(1) assms infsum_def has_sum_infsum infsum_superconst_infinite_ereal)
 
 lemma infsum_superconst_infinite_enat:
   fixes f :: \<open>'a \<Rightarrow> enat\<close>
   assumes geqb: \<open>\<And>x. x \<in> S \<Longrightarrow> f x \<ge> b\<close>
   assumes b: \<open>b > 0\<close>
   assumes \<open>infinite S\<close>
   shows "infsum f S = \<infinity>"
 proof -
   have \<open>ennreal_of_enat (infsum f S) = infsum (ennreal_of_enat \<circ> f) S\<close>
     by (simp flip: infsum_comm_additive_general)
   also have \<open>\<dots> = \<infinity>\<close>
     by (metis assms(3) b comp_def ennreal_of_enat_0 ennreal_of_enat_le_iff geqb infsum_superconst_infinite_ennreal leD leI)
   also have \<open>\<dots> = ennreal_of_enat \<infinity>\<close>
     by simp
   finally show ?thesis
     by (rule ennreal_of_enat_inj[THEN iffD1])
 qed
 
 lemma has_sum_superconst_infinite_enat:
   fixes f :: \<open>'a \<Rightarrow> enat\<close>
   assumes \<open>\<And>x. x \<in> S \<Longrightarrow> f x \<ge> b\<close>
   assumes \<open>b > 0\<close>
   assumes \<open>infinite S\<close>
   shows "has_sum f S \<infinity>"
   by (metis assms i0_lb has_sum_infsum infsum_superconst_infinite_enat nonneg_summable_on_complete)
 
 text \<open>This lemma helps to relate a real-valued infsum to a supremum over extended nonnegative reals.\<close>
 
 lemma infsum_nonneg_is_SUPREMUM_ennreal:
   fixes f :: "'a \<Rightarrow> real"
   assumes summable: "f summable_on A"
     and fnn: "\<And>x. x\<in>A \<Longrightarrow> f x \<ge> 0"
   shows "ennreal (infsum f A) = (SUP F\<in>{F. finite F \<and> F \<subseteq> A}. (ennreal (sum f F)))"
 proof -
   have \<section>: "\<And>F. \<lbrakk>finite F; F \<subseteq> A\<rbrakk> \<Longrightarrow> sum (ennreal \<circ> f) F = ennreal (sum f F)"
     by (metis (mono_tags, lifting) comp_def fnn subsetD sum.cong sum_ennreal)
   then have \<open>ennreal (infsum f A) = infsum (ennreal \<circ> f) A\<close>
     by (simp add: infsum_comm_additive_general local.summable)
   also have \<open>\<dots> = (SUP F\<in>{F. finite F \<and> F \<subseteq> A}. (ennreal (sum f F)))\<close>
     by (metis (mono_tags, lifting) \<section> image_cong mem_Collect_eq nonneg_infsum_complete zero_le)
   finally show ?thesis .
 qed
 
 text \<open>This lemma helps to related a real-valued infsum to a supremum over extended reals.\<close>
 
 lemma infsum_nonneg_is_SUPREMUM_ereal:
   fixes f :: "'a \<Rightarrow> real"
   assumes summable: "f summable_on A"
     and fnn: "\<And>x. x\<in>A \<Longrightarrow> f x \<ge> 0"
   shows "ereal (infsum f A) = (SUP F\<in>{F. finite F \<and> F \<subseteq> A}. (ereal (sum f F)))"
 proof -
   have "\<And>F. \<lbrakk>finite F; F \<subseteq> A\<rbrakk> \<Longrightarrow> sum (ereal \<circ> f) F = ereal (sum f F)"
     by auto
   then have \<open>ereal (infsum f A) = infsum (ereal \<circ> f) A\<close>
     by (simp add: infsum_comm_additive_general local.summable)
   also have \<open>\<dots> = (SUP F\<in>{F. finite F \<and> F \<subseteq> A}. (ereal (sum f F)))\<close>
     by (subst nonneg_infsum_complete) (simp_all add: assms)
   finally show ?thesis .
 qed
 
 
 subsection \<open>Real numbers\<close>
 
 text \<open>Most lemmas in the general property section already apply to real numbers.
       A few ones that are specific to reals are given here.\<close>
 
 lemma infsum_nonneg_is_SUPREMUM_real:
   fixes f :: "'a \<Rightarrow> real"
   assumes summable: "f summable_on A"
     and fnn: "\<And>x. x\<in>A \<Longrightarrow> f x \<ge> 0"
   shows "infsum f A = (SUP F\<in>{F. finite F \<and> F \<subseteq> A}. (sum f F))"
 proof -
   have "ereal (infsum f A) = (SUP F\<in>{F. finite F \<and> F \<subseteq> A}. (ereal (sum f F)))"
     using assms by (rule infsum_nonneg_is_SUPREMUM_ereal)
   also have "\<dots> = ereal (SUP F\<in>{F. finite F \<and> F \<subseteq> A}. (sum f F))"
   proof (subst ereal_SUP)
     show "\<bar>SUP a\<in>{F. finite F \<and> F \<subseteq> A}. ereal (sum f a)\<bar> \<noteq> \<infinity>"
       using calculation by fastforce      
     show "(SUP F\<in>{F. finite F \<and> F \<subseteq> A}. ereal (sum f F)) = (SUP a\<in>{F. finite F \<and> F \<subseteq> A}. ereal (sum f a))"
       by simp      
   qed
   finally show ?thesis by simp
 qed
 
 
 lemma has_sum_nonneg_SUPREMUM_real:
   fixes f :: "'a \<Rightarrow> real"
   assumes "f summable_on A" and "\<And>x. x\<in>A \<Longrightarrow> f x \<ge> 0"
   shows "has_sum f A (SUP F\<in>{F. finite F \<and> F \<subseteq> A}. (sum f F))"
   by (metis (mono_tags, lifting) assms has_sum_infsum infsum_nonneg_is_SUPREMUM_real)
 
 lemma summable_countable_real:
   fixes f :: \<open>'a \<Rightarrow> real\<close>
   assumes \<open>f summable_on A\<close>
   shows \<open>countable {x\<in>A. f x \<noteq> 0}\<close>
   using abs_summable_countable assms summable_on_iff_abs_summable_on_real by blast
 
 subsection \<open>Complex numbers\<close>
 
 lemma has_sum_cnj_iff[simp]: 
   fixes f :: \<open>'a \<Rightarrow> complex\<close>
   shows \<open>has_sum (\<lambda>x. cnj (f x)) M (cnj a) \<longleftrightarrow> has_sum f M a\<close>
   by (simp add: has_sum_def lim_cnj del: cnj_sum add: cnj_sum[symmetric, abs_def, of f])
 
 lemma summable_on_cnj_iff[simp]:
   "(\<lambda>i. cnj (f i)) summable_on A \<longleftrightarrow> f summable_on A"
   by (metis complex_cnj_cnj summable_on_def has_sum_cnj_iff)
 
 lemma infsum_cnj[simp]: \<open>infsum (\<lambda>x. cnj (f x)) M = cnj (infsum f M)\<close>
   by (metis complex_cnj_zero infsumI has_sum_cnj_iff infsum_def summable_on_cnj_iff has_sum_infsum)
 
 lemma has_sum_Re:
   assumes "has_sum f M a"
   shows "has_sum (\<lambda>x. Re (f x)) M (Re a)"
   using has_sum_comm_additive[where f=Re]
   using  assms tendsto_Re by (fastforce simp add: o_def additive_def)
 
 lemma infsum_Re:
   assumes "f summable_on M"
   shows "infsum (\<lambda>x. Re (f x)) M = Re (infsum f M)"
   by (simp add: assms has_sum_Re infsumI)
 
 lemma summable_on_Re: 
   assumes "f summable_on M"
   shows "(\<lambda>x. Re (f x)) summable_on M"
   by (metis assms has_sum_Re summable_on_def)
 
 lemma has_sum_Im:
   assumes "has_sum f M a"
   shows "has_sum (\<lambda>x. Im (f x)) M (Im a)"
   using has_sum_comm_additive[where f=Im]
   using  assms tendsto_Im by (fastforce simp add: o_def additive_def)
 
 lemma infsum_Im: 
   assumes "f summable_on M"
   shows "infsum (\<lambda>x. Im (f x)) M = Im (infsum f M)"
   by (simp add: assms has_sum_Im infsumI)
 
 lemma summable_on_Im: 
   assumes "f summable_on M"
   shows "(\<lambda>x. Im (f x)) summable_on M"
   by (metis assms has_sum_Im summable_on_def)
 
 lemma nonneg_infsum_le_0D_complex:
   fixes f :: "'a \<Rightarrow> complex"
   assumes "infsum f A \<le> 0"
     and abs_sum: "f summable_on A"
     and nneg: "\<And>x. x \<in> A \<Longrightarrow> f x \<ge> 0"
     and "x \<in> A"
   shows "f x = 0"
 proof -
   have \<open>Im (f x) = 0\<close>
     using assms(4) less_eq_complex_def nneg by auto
   moreover have \<open>Re (f x) = 0\<close>
     using assms by (auto simp add: summable_on_Re infsum_Re less_eq_complex_def intro: nonneg_infsum_le_0D[where A=A])
   ultimately show ?thesis
     by (simp add: complex_eqI)
 qed
 
 lemma nonneg_has_sum_le_0D_complex:
   fixes f :: "'a \<Rightarrow> complex"
   assumes "has_sum f A a" and \<open>a \<le> 0\<close>
     and "\<And>x. x \<in> A \<Longrightarrow> f x \<ge> 0" and "x \<in> A"
   shows "f x = 0"
   by (metis assms infsumI nonneg_infsum_le_0D_complex summable_on_def)
 
 text \<open>The lemma @{thm [source] infsum_mono_neutral} above applies to various linear ordered monoids such as the reals but not to the complex numbers.
       Thus we have a separate corollary for those:\<close>
 
 lemma infsum_mono_neutral_complex:
   fixes f :: "'a \<Rightarrow> complex"
   assumes [simp]: "f summable_on A"
     and [simp]: "g summable_on B"
   assumes \<open>\<And>x. x \<in> A\<inter>B \<Longrightarrow> f x \<le> g x\<close>
   assumes \<open>\<And>x. x \<in> A-B \<Longrightarrow> f x \<le> 0\<close>
   assumes \<open>\<And>x. x \<in> B-A \<Longrightarrow> g x \<ge> 0\<close>
   shows \<open>infsum f A \<le> infsum g B\<close>
 proof -
   have \<open>infsum (\<lambda>x. Re (f x)) A \<le> infsum (\<lambda>x. Re (g x)) B\<close>
     by (smt (verit) assms infsum_cong infsum_mono_neutral less_eq_complex_def summable_on_Re zero_complex.simps(1))
   then have Re: \<open>Re (infsum f A) \<le> Re (infsum g B)\<close>
     by (metis assms(1-2) infsum_Re)
   have \<open>infsum (\<lambda>x. Im (f x)) A = infsum (\<lambda>x. Im (g x)) B\<close>
     by (smt (verit, best) assms(3-5) infsum_cong_neutral less_eq_complex_def zero_complex.simps(2))
   then have Im: \<open>Im (infsum f A) = Im (infsum g B)\<close>
     by (metis assms(1-2) infsum_Im)
   from Re Im show ?thesis
     by (auto simp: less_eq_complex_def)
 qed
 
 lemma infsum_mono_complex:
   \<comment> \<open>For \<^typ>\<open>real\<close>, @{thm [source] infsum_mono} can be used. 
       But \<^typ>\<open>complex\<close> does not have the right typeclass.\<close>
   fixes f g :: "'a \<Rightarrow> complex"
   assumes f_sum: "f summable_on A" and g_sum: "g summable_on A"
   assumes leq: "\<And>x. x \<in> A \<Longrightarrow> f x \<le> g x"
   shows   "infsum f A \<le> infsum g A"
   by (metis DiffE IntD1 f_sum g_sum infsum_mono_neutral_complex leq)
 
 
 lemma infsum_nonneg_complex:
   fixes f :: "'a \<Rightarrow> complex"
   assumes "f summable_on M"
     and "\<And>x. x \<in> M \<Longrightarrow> 0 \<le> f x"
   shows "infsum f M \<ge> 0" (is "?lhs \<ge> _")
   by (metis assms infsum_0_simp summable_on_0_simp infsum_mono_complex)
 
 lemma infsum_cmod:
   assumes "f summable_on M"
     and fnn: "\<And>x. x \<in> M \<Longrightarrow> 0 \<le> f x"
   shows "infsum (\<lambda>x. cmod (f x)) M = cmod (infsum f M)"
 proof -
   have \<open>complex_of_real (infsum (\<lambda>x. cmod (f x)) M) = infsum (\<lambda>x. complex_of_real (cmod (f x))) M\<close>
   proof (rule infsum_comm_additive[symmetric, unfolded o_def])
     have "(\<lambda>z. Re (f z)) summable_on M"
       using assms summable_on_Re by blast
     also have "?this \<longleftrightarrow> f abs_summable_on M"
       using fnn by (intro summable_on_cong) (auto simp: less_eq_complex_def cmod_def)
     finally show \<dots> .
   qed (auto simp: additive_def)
   also have \<open>\<dots> = infsum f M\<close>
     using fnn cmod_eq_Re complex_is_Real_iff less_eq_complex_def by (force cong: infsum_cong)
   finally show ?thesis
     by (metis abs_of_nonneg infsum_def le_less_trans norm_ge_zero norm_infsum_bound norm_of_real not_le order_refl)
 qed
 
 
 lemma summable_on_iff_abs_summable_on_complex:
   fixes f :: \<open>'a \<Rightarrow> complex\<close>
   shows \<open>f summable_on A \<longleftrightarrow> f abs_summable_on A\<close>
 proof (rule iffI)
   assume \<open>f summable_on A\<close>
   define i r ni nr n where \<open>i x = Im (f x)\<close> and \<open>r x = Re (f x)\<close>
     and \<open>ni x = norm (i x)\<close> and \<open>nr x = norm (r x)\<close> and \<open>n x = norm (f x)\<close> for x
   from \<open>f summable_on A\<close> have \<open>i summable_on A\<close>
     by (simp add: i_def[abs_def] summable_on_Im)
   then have [simp]: \<open>ni summable_on A\<close>
     using ni_def[abs_def] summable_on_iff_abs_summable_on_real by force
 
   from \<open>f summable_on A\<close> have \<open>r summable_on A\<close>
     by (simp add: r_def[abs_def] summable_on_Re)
   then have [simp]: \<open>nr summable_on A\<close>
     by (metis nr_def summable_on_cong summable_on_iff_abs_summable_on_real)
 
   have n_sum: \<open>n x \<le> nr x + ni x\<close> for x
     by (simp add: n_def nr_def ni_def r_def i_def cmod_le)
 
   have *: \<open>(\<lambda>x. nr x + ni x) summable_on A\<close>
     by (simp add: summable_on_add)
   have "bdd_above (sum n ` {F. F \<subseteq> A \<and> finite F})"
     apply (rule bdd_aboveI[where M=\<open>infsum (\<lambda>x. nr x + ni x) A\<close>])
     using * n_sum by (auto simp flip: infsum_finite simp: ni_def nr_def intro!: infsum_mono_neutral)
   then show \<open>n summable_on A\<close>
     by (simp add: n_def nonneg_bdd_above_summable_on)
 next
   show \<open>f abs_summable_on A \<Longrightarrow> f summable_on A\<close>
     using abs_summable_summable by blast
 qed
 
 lemma summable_countable_complex:
   fixes f :: \<open>'a \<Rightarrow> complex\<close>
   assumes \<open>f summable_on A\<close>
   shows \<open>countable {x\<in>A. f x \<noteq> 0}\<close>
   using abs_summable_countable assms summable_on_iff_abs_summable_on_complex by blast
 
 end
 
diff --git a/src/HOL/Analysis/Metric_Arith.thy b/src/HOL/Analysis/Metric_Arith.thy
--- a/src/HOL/Analysis/Metric_Arith.thy
+++ b/src/HOL/Analysis/Metric_Arith.thy
@@ -1,114 +1,114 @@
 (*  Title:      HOL/Analysis/Metric_Arith.thy
     Author:     Maximilian Schäffeler (port from HOL Light)
 *)
 
 chapter \<open>Functional Analysis\<close>
 
 section\<^marker>\<open>tag unimportant\<close> \<open>A decision procedure for metric spaces\<close>
 
 theory Metric_Arith
   imports HOL.Real_Vector_Spaces
 begin
 
 text\<^marker>\<open>tag unimportant\<close> \<open>
 A port of the decision procedure ``Formalization of metric spaces in HOL Light''
-@{cite "DBLP:journals/jar/Maggesi18"} for the type class @{class metric_space},
+\<^cite>\<open>"DBLP:journals/jar/Maggesi18"\<close> for the type class @{class metric_space},
 with the \<open>Argo\<close> solver as backend.
 \<close>
 
 named_theorems metric_prenex
 named_theorems metric_nnf
 named_theorems metric_unfold
 named_theorems metric_pre_arith
 
 lemmas pre_arith_simps =
   max.bounded_iff max_less_iff_conj
   le_max_iff_disj less_max_iff_disj
   simp_thms HOL.eq_commute
 declare pre_arith_simps [metric_pre_arith]
 
 lemmas unfold_simps =
   Un_iff subset_iff disjoint_iff_not_equal
   Ball_def Bex_def
 declare unfold_simps [metric_unfold]
 
 declare HOL.nnf_simps(4) [metric_prenex]
 
 lemma imp_prenex [metric_prenex]:
   "\<And>P Q. (\<exists>x. P x) \<longrightarrow> Q \<equiv> \<forall>x. (P x \<longrightarrow> Q)"
   "\<And>P Q. P \<longrightarrow> (\<exists>x. Q x) \<equiv> \<exists>x. (P \<longrightarrow> Q x)"
   "\<And>P Q. (\<forall>x. P x) \<longrightarrow> Q \<equiv> \<exists>x. (P x \<longrightarrow> Q)"
   "\<And>P Q. P \<longrightarrow> (\<forall>x. Q x) \<equiv> \<forall>x. (P \<longrightarrow> Q x)"
   by simp_all
 
 lemma ex_prenex [metric_prenex]:
   "\<And>P Q. (\<exists>x. P x) \<and> Q \<equiv> \<exists>x. (P x \<and> Q)"
   "\<And>P Q. P \<and> (\<exists>x. Q x) \<equiv> \<exists>x. (P \<and> Q x)"
   "\<And>P Q. (\<exists>x. P x) \<or> Q \<equiv> \<exists>x. (P x \<or> Q)"
   "\<And>P Q. P \<or> (\<exists>x. Q x) \<equiv> \<exists>x. (P \<or> Q x)"
   "\<And>P. \<not>(\<exists>x. P x) \<equiv> \<forall>x. \<not>P x"
   by simp_all
 
 lemma all_prenex [metric_prenex]:
   "\<And>P Q. (\<forall>x. P x) \<and> Q \<equiv> \<forall>x. (P x \<and> Q)"
   "\<And>P Q. P \<and> (\<forall>x. Q x) \<equiv> \<forall>x. (P \<and> Q x)"
   "\<And>P Q. (\<forall>x. P x) \<or> Q \<equiv> \<forall>x. (P x \<or> Q)"
   "\<And>P Q. P \<or> (\<forall>x. Q x) \<equiv> \<forall>x. (P \<or> Q x)"
   "\<And>P. \<not>(\<forall>x. P x) \<equiv> \<exists>x. \<not>P x"
   by simp_all
 
 lemma nnf_thms [metric_nnf]:
   "(\<not> (P \<and> Q)) = (\<not> P \<or> \<not> Q)"
   "(\<not> (P \<or> Q)) = (\<not> P \<and> \<not> Q)"
   "(P \<longrightarrow> Q) = (\<not> P \<or> Q)"
   "(P = Q) \<longleftrightarrow> (P \<or> \<not> Q) \<and> (\<not> P \<or> Q)"
   "(\<not> (P = Q)) \<longleftrightarrow> (\<not> P \<or> \<not> Q) \<and> (P \<or> Q)"
   "(\<not> \<not> P) = P"
   by blast+
 
 lemmas nnf_simps = nnf_thms linorder_not_less linorder_not_le
 declare nnf_simps[metric_nnf]
 
 lemma ball_insert: "(\<forall>x\<in>insert a B. P x) = (P a \<and> (\<forall>x\<in>B. P x))"
   by blast
 
 lemma Sup_insert_insert:
   fixes a::real
   shows "Sup (insert a (insert b s)) = Sup (insert (max a b) s)"
   by (simp add: Sup_real_def)
 
 lemma real_abs_dist: "\<bar>dist x y\<bar> = dist x y"
   by simp
 
 lemma maxdist_thm [THEN HOL.eq_reflection]:
   assumes "finite s" "x \<in> s" "y \<in> s"
   defines "\<And>a. f a \<equiv> \<bar>dist x a - dist a y\<bar>"
   shows "dist x y = Sup (f ` s)"
 proof -
   have "dist x y \<le> Sup (f ` s)"
   proof -
     have "finite (f ` s)"
       by (simp add: \<open>finite s\<close>)
     moreover have "\<bar>dist x y - dist y y\<bar> \<in> f ` s"
       by (metis \<open>y \<in> s\<close> f_def imageI)
     ultimately show ?thesis
       using le_cSup_finite by simp
   qed
   also have "Sup (f ` s) \<le> dist x y"
     using \<open>x \<in> s\<close> cSUP_least[of s f] abs_dist_diff_le
     unfolding f_def
     by blast
   finally show ?thesis .
 qed
 
 theorem metric_eq_thm [THEN HOL.eq_reflection]:
   "x \<in> s \<Longrightarrow> y \<in> s \<Longrightarrow> x = y \<longleftrightarrow> (\<forall>a\<in>s. dist x a = dist y a)"
   by auto
 
 ML_file \<open>metric_arith.ML\<close>
 
 method_setup metric = \<open>
   Scan.succeed (SIMPLE_METHOD' o Metric_Arith.metric_arith_tac)
 \<close> "prove simple linear statements in metric spaces (\<forall>\<exists>\<^sub>p fragment)"
 
 end
diff --git a/src/HOL/Data_Structures/Braun_Tree.thy b/src/HOL/Data_Structures/Braun_Tree.thy
--- a/src/HOL/Data_Structures/Braun_Tree.thy
+++ b/src/HOL/Data_Structures/Braun_Tree.thy
@@ -1,333 +1,333 @@
 (* Author: Tobias Nipkow *)
 
 section \<open>Braun Trees\<close>
 
 theory Braun_Tree
 imports "HOL-Library.Tree_Real"
 begin
 
-text \<open>Braun Trees were studied by Braun and Rem~\cite{BraunRem}
-and later Hoogerwoord~\cite{Hoogerwoord}.\<close>
+text \<open>Braun Trees were studied by Braun and Rem~\<^cite>\<open>"BraunRem"\<close>
+and later Hoogerwoord~\<^cite>\<open>"Hoogerwoord"\<close>.\<close>
 
 fun braun :: "'a tree \<Rightarrow> bool" where
 "braun Leaf = True" |
 "braun (Node l x r) = ((size l = size r \<or> size l = size r + 1) \<and> braun l \<and> braun r)"
 
 lemma braun_Node':
   "braun (Node l x r) = (size r \<le> size l \<and> size l \<le> size r + 1 \<and> braun l \<and> braun r)"
 by auto
 
 text \<open>The shape of a Braun-tree is uniquely determined by its size:\<close>
 
 lemma braun_unique: "\<lbrakk> braun (t1::unit tree); braun t2; size t1 = size t2 \<rbrakk> \<Longrightarrow> t1 = t2"
 proof (induction t1 arbitrary: t2)
   case Leaf thus ?case by simp
 next
   case (Node l1 _ r1)
   from Node.prems(3) have "t2 \<noteq> Leaf" by auto
   then obtain l2 x2 r2 where [simp]: "t2 = Node l2 x2 r2" by (meson neq_Leaf_iff)
   with Node.prems have "size l1 = size l2 \<and> size r1 = size r2" by auto
   thus ?case using Node.prems(1,2) Node.IH by auto
 qed
 
 text \<open>Braun trees are almost complete:\<close>
 
 lemma acomplete_if_braun: "braun t \<Longrightarrow> acomplete t"
 proof(induction t)
   case Leaf show ?case by (simp add: acomplete_def)
 next
   case (Node l x r) thus ?case using acomplete_Node_if_wbal2 by force
 qed
 
 subsection \<open>Numbering Nodes\<close>
 
 text \<open>We show that a tree is a Braun tree iff a parity-based
 numbering (\<open>braun_indices\<close>) of nodes yields an interval of numbers.\<close>
 
 fun braun_indices :: "'a tree \<Rightarrow> nat set" where
 "braun_indices Leaf = {}" |
 "braun_indices (Node l _ r) = {1} \<union> (*) 2 ` braun_indices l \<union> Suc ` (*) 2 ` braun_indices r"
 
 lemma braun_indices1: "0 \<notin> braun_indices t"
 by (induction t) auto
 
 lemma finite_braun_indices: "finite(braun_indices t)"
 by (induction t) auto
 
 text "One direction:"
 
 lemma braun_indices_if_braun: "braun t \<Longrightarrow> braun_indices t = {1..size t}"
 proof(induction t)
   case Leaf thus ?case by simp
 next
   have *: "(*) 2 ` {a..b} \<union> Suc ` (*) 2 ` {a..b} = {2*a..2*b+1}" (is "?l = ?r") for a b
   proof
     show "?l \<subseteq> ?r" by auto
   next
     have "\<exists>x2\<in>{a..b}. x \<in> {Suc (2*x2), 2*x2}" if *: "x \<in> {2*a .. 2*b+1}" for x
     proof -
       have "x div 2 \<in> {a..b}" using * by auto
       moreover have "x \<in> {2 * (x div 2), Suc(2 * (x div 2))}" by auto
       ultimately show ?thesis by blast
     qed
     thus "?r \<subseteq> ?l" by fastforce
   qed
   case (Node l x r)
   hence "size l = size r \<or> size l = size r + 1" (is "?A \<or> ?B") by auto
   thus ?case
   proof
     assume ?A
     with Node show ?thesis by (auto simp: *)
   next
     assume ?B
     with Node show ?thesis by (auto simp: * atLeastAtMostSuc_conv)
   qed
 qed
 
 text "The other direction is more complicated. The following proof is due to Thomas Sewell."
 
 lemma disj_evens_odds: "(*) 2 ` A \<inter> Suc ` (*) 2 ` B = {}"
 using double_not_eq_Suc_double by auto
 
 lemma card_braun_indices: "card (braun_indices t) = size t"
 proof (induction t)
   case Leaf thus ?case by simp
 next
   case Node
   thus ?case
     by(auto simp: UNION_singleton_eq_range finite_braun_indices card_Un_disjoint
                   card_insert_if disj_evens_odds card_image inj_on_def braun_indices1)
 qed
 
 lemma braun_indices_intvl_base_1:
   assumes bi: "braun_indices t = {m..n}"
   shows "{m..n} = {1..size t}"
 proof (cases "t = Leaf")
   case True then show ?thesis using bi by simp
 next
   case False
   note eqs = eqset_imp_iff[OF bi]
   from eqs[of 0] have 0: "0 < m"
     by (simp add: braun_indices1)
   from eqs[of 1] have 1: "m \<le> 1"
     by (cases t; simp add: False)
   from 0 1 have eq1: "m = 1" by simp
   from card_braun_indices[of t] show ?thesis
     by (simp add: bi eq1)
 qed
 
 lemma even_of_intvl_intvl:
   fixes S :: "nat set"
   assumes "S = {m..n} \<inter> {i. even i}"
   shows "\<exists>m' n'. S = (\<lambda>i. i * 2) ` {m'..n'}"
   apply (rule exI[where x="Suc m div 2"], rule exI[where x="n div 2"])
   apply (fastforce simp add: assms mult.commute)
   done
 
 lemma odd_of_intvl_intvl:
   fixes S :: "nat set"
   assumes "S = {m..n} \<inter> {i. odd i}"
   shows "\<exists>m' n'. S = Suc ` (\<lambda>i. i * 2) ` {m'..n'}"
 proof -
   have step1: "\<exists>m'. S = Suc ` ({m'..n - 1} \<inter> {i. even i})"
     apply (rule_tac x="if n = 0 then 1 else m - 1" in exI)
     apply (auto simp: assms image_def elim!: oddE)
     done
   thus ?thesis
     by (metis even_of_intvl_intvl)
 qed
 
 lemma image_int_eq_image:
   "(\<forall>i \<in> S. f i \<in> T) \<Longrightarrow> (f ` S) \<inter> T = f ` S"
   "(\<forall>i \<in> S. f i \<notin> T) \<Longrightarrow> (f ` S) \<inter> T = {}"
   by auto
 
 lemma braun_indices1_le:
   "i \<in> braun_indices t \<Longrightarrow> Suc 0 \<le> i"
   using braun_indices1 not_less_eq_eq by blast
 
 lemma braun_if_braun_indices: "braun_indices t = {1..size t} \<Longrightarrow> braun t"
 proof(induction t)
 case Leaf
   then show ?case by simp
 next
   case (Node l x r)
   obtain t where t: "t = Node l x r" by simp
   from Node.prems have eq: "{2 .. size t} = (\<lambda>i. i * 2) ` braun_indices l \<union> Suc ` (\<lambda>i. i * 2) ` braun_indices r"
     (is "?R = ?S \<union> ?T")
     apply clarsimp
     apply (drule_tac f="\<lambda>S. S \<inter> {2..}" in arg_cong)
     apply (simp add: t mult.commute Int_Un_distrib2 image_int_eq_image braun_indices1_le)
     done
   then have ST: "?S = ?R \<inter> {i. even i}" "?T = ?R \<inter> {i. odd i}"
     by (simp_all add: Int_Un_distrib2 image_int_eq_image)
   from ST have l: "braun_indices l = {1 .. size l}"
     by (fastforce dest: braun_indices_intvl_base_1 dest!: even_of_intvl_intvl
                   simp: mult.commute inj_image_eq_iff[OF inj_onI])
   from ST have r: "braun_indices r = {1 .. size r}"
     by (fastforce dest: braun_indices_intvl_base_1 dest!: odd_of_intvl_intvl
                   simp: mult.commute inj_image_eq_iff[OF inj_onI])
   note STa = ST[THEN eqset_imp_iff, THEN iffD2]
   note STb = STa[of "size t"] STa[of "size t - 1"]
   then have sizes: "size l = size r \<or> size l = size r + 1"
     apply (clarsimp simp: t l r inj_image_mem_iff[OF inj_onI])
     apply (cases "even (size l)"; cases "even (size r)"; clarsimp elim!: oddE; fastforce)
     done
   from l r sizes show ?case
     by (clarsimp simp: Node.IH)
 qed
 
 lemma braun_iff_braun_indices: "braun t \<longleftrightarrow> braun_indices t = {1..size t}"
 using braun_if_braun_indices braun_indices_if_braun by blast
 
 (* An older less appealing proof:
 lemma Suc0_notin_double: "Suc 0 \<notin> ( * ) 2 ` A"
 by(auto)
 
 lemma zero_in_double_iff: "(0::nat) \<in> ( * ) 2 ` A \<longleftrightarrow> 0 \<in> A"
 by(auto)
 
 lemma Suc_in_Suc_image_iff: "Suc n \<in> Suc ` A \<longleftrightarrow> n \<in> A"
 by(auto)
 
 lemmas nat_in_image = Suc0_notin_double zero_in_double_iff Suc_in_Suc_image_iff
 
 lemma disj_union_eq_iff:
   "\<lbrakk> L1 \<inter> R2 = {}; L2 \<inter> R1 = {} \<rbrakk> \<Longrightarrow> L1 \<union> R1 = L2 \<union> R2 \<longleftrightarrow> L1 = L2 \<and> R1 = R2"
 by blast
 
 lemma inj_braun_indices: "braun_indices t1 = braun_indices t2 \<Longrightarrow> t1 = (t2::unit tree)"
 proof(induction t1 arbitrary: t2)
   case Leaf thus ?case using braun_indices.elims by blast
 next
   case (Node l1 x1 r1)
   have "t2 \<noteq> Leaf"
   proof
     assume "t2 = Leaf"
     with Node.prems show False by simp
   qed
   thus ?case using Node
     by (auto simp: neq_Leaf_iff insert_ident nat_in_image braun_indices1
                   disj_union_eq_iff disj_evens_odds inj_image_eq_iff inj_def)
 qed
 
 text \<open>How many even/odd natural numbers are there between m and n?\<close>
 
 lemma card_Icc_even_nat:
   "card {i \<in> {m..n::nat}. even i} = (n+1-m + (m+1) mod 2) div 2" (is "?l m n = ?r m n")
 proof(induction "n+1 - m" arbitrary: n m)
    case 0 thus ?case by simp
 next
   case Suc
   have "m \<le> n" using Suc(2) by arith
   hence "{m..n} = insert m {m+1..n}" by auto
   hence "?l m n = card {i \<in> insert m {m+1..n}. even i}" by simp
   also have "\<dots> = ?r m n" (is "?l = ?r")
   proof (cases)
     assume "even m"
     hence "{i \<in> insert m {m+1..n}. even i} = insert m {i \<in> {m+1..n}. even i}" by auto
     hence "?l = card {i \<in> {m+1..n}. even i} + 1" by simp
     also have "\<dots> = (n-m + (m+2) mod 2) div 2 + 1" using Suc(1)[of n "m+1"] Suc(2) by simp
     also have "\<dots> = ?r" using \<open>even m\<close> \<open>m \<le> n\<close> by auto
     finally show ?thesis .
   next
     assume "odd m"
     hence "{i \<in> insert m {m+1..n}. even i} = {i \<in> {m+1..n}. even i}" by auto
     hence "?l = card ..." by simp
     also have "\<dots> = (n-m + (m+2) mod 2) div 2" using Suc(1)[of n "m+1"] Suc(2) by simp
     also have "\<dots> = ?r" using \<open>odd m\<close> \<open>m \<le> n\<close> even_iff_mod_2_eq_zero[of m] by simp
     finally show ?thesis .
   qed
   finally show ?case .
 qed
 
 lemma card_Icc_odd_nat: "card {i \<in> {m..n::nat}. odd i} = (n+1-m + m mod 2) div 2"
 proof -
   let ?A = "{i \<in> {m..n}. odd i}"
   let ?B = "{i \<in> {m+1..n+1}. even i}"
   have "card ?A = card (Suc ` ?A)" by (simp add: card_image)
   also have "Suc ` ?A = ?B" using Suc_le_D by(force simp: image_iff)
   also have "card ?B = (n+1-m + (m) mod 2) div 2"
     using card_Icc_even_nat[of "m+1" "n+1"] by simp
   finally show ?thesis .
 qed
 
 lemma compact_Icc_even: assumes "A = {i \<in> {m..n}. even i}"
 shows "A = (\<lambda>j. 2*(j-1) + m + m mod 2) ` {1..card A}" (is "_ = ?A")
 proof
   let ?a = "(n+1-m + (m+1) mod 2) div 2"
   have "\<exists>j \<in> {1..?a}. i = 2*(j-1) + m + m mod 2" if *: "i \<in> {m..n}" "even i" for i
   proof -
     let ?j = "(i - (m + m mod 2)) div 2 + 1"
     have "?j \<in> {1..?a} \<and> i = 2*(?j-1) + m + m mod 2" using * by(auto simp: mod2_eq_if) presburger+
     thus ?thesis by blast
   qed
   thus "A \<subseteq> ?A" using assms
     by(auto simp: image_iff card_Icc_even_nat simp del: atLeastAtMost_iff)
 next
   let ?a = "(n+1-m + (m+1) mod 2) div 2"
   have 1: "2 * (j - 1) + m + m mod 2 \<in> {m..n}" if *: "j \<in> {1..?a}" for j
     using * by(auto simp: mod2_eq_if)
   have 2: "even (2 * (j - 1) + m + m mod 2)" for j by presburger
   show "?A \<subseteq> A"
     apply(simp add: assms card_Icc_even_nat del: atLeastAtMost_iff One_nat_def)
     using 1 2 by blast
 qed
 
 lemma compact_Icc_odd:
   assumes "B = {i \<in> {m..n}. odd i}" shows "B = (\<lambda>i. 2*(i-1) + m + (m+1) mod 2) ` {1..card B}"
 proof -
   define A :: " nat set" where "A = Suc ` B"
   have "A = {i \<in> {m+1..n+1}. even i}"
     using Suc_le_D by(force simp add: A_def assms image_iff)
   from compact_Icc_even[OF this]
   have "A = Suc ` (\<lambda>i. 2 * (i - 1) + m + (m + 1) mod 2) ` {1..card A}"
     by (simp add: image_comp o_def)
   hence B: "B = (\<lambda>i. 2 * (i - 1) + m + (m + 1) mod 2) ` {1..card A}"
     using A_def by (simp add: inj_image_eq_iff)
   have "card A = card B" by (metis A_def bij_betw_Suc bij_betw_same_card) 
   with B show ?thesis by simp
 qed
 
 lemma even_odd_decomp: assumes "\<forall>x \<in> A. even x" "\<forall>x \<in> B. odd x"  "A \<union> B = {m..n}"
 shows "(let a = card A; b = card B in
    a + b = n+1-m \<and>
    A = (\<lambda>i. 2*(i-1) + m + m mod 2) ` {1..a} \<and>
    B = (\<lambda>i. 2*(i-1) + m + (m+1) mod 2) ` {1..b} \<and>
    (a = b \<or> a = b+1 \<and> even m \<or> a+1 = b \<and> odd m))"
 proof -
   let ?a = "card A" let ?b = "card B"
   have "finite A \<and> finite B"
     by (metis \<open>A \<union> B = {m..n}\<close> finite_Un finite_atLeastAtMost)
   hence ab: "?a + ?b = Suc n - m"
     by (metis Int_emptyI assms card_Un_disjoint card_atLeastAtMost)
   have A: "A = {i \<in> {m..n}. even i}" using assms by auto
   hence A': "A = (\<lambda>i. 2*(i-1) + m + m mod 2) ` {1..?a}" by(rule compact_Icc_even)
   have B: "B = {i \<in> {m..n}. odd i}" using assms by auto
   hence B': "B = (\<lambda>i. 2*(i-1) + m + (m+1) mod 2) ` {1..?b}" by(rule compact_Icc_odd)
   have "?a = ?b \<or> ?a = ?b+1 \<and> even m \<or> ?a+1 = ?b \<and> odd m"
     apply(simp add: Let_def mod2_eq_if
       card_Icc_even_nat[of m n, simplified A[symmetric]]
       card_Icc_odd_nat[of m n, simplified B[symmetric]] split!: if_splits)
     by linarith
   with ab A' B' show ?thesis by simp
 qed
 
 lemma braun_if_braun_indices: "braun_indices t = {1..size t} \<Longrightarrow> braun t"
 proof(induction t)
 case Leaf
   then show ?case by simp
 next
   case (Node t1 x2 t2)
   have 1: "i > 0 \<Longrightarrow> Suc(Suc(2 * (i - Suc 0))) = 2*i" for i::nat by(simp add: algebra_simps)
   have 2: "i > 0 \<Longrightarrow> 2 * (i - Suc 0) + 3 = 2*i + 1" for i::nat by(simp add: algebra_simps)
   have 3: "( * ) 2 ` braun_indices t1 \<union> Suc ` ( * ) 2 ` braun_indices t2 =
      {2..size t1 + size t2 + 1}" using Node.prems
     by (simp add: insert_ident Icc_eq_insert_lb_nat nat_in_image braun_indices1)
   thus ?case using Node.IH even_odd_decomp[OF _ _ 3]
     by(simp add: card_image inj_on_def card_braun_indices Let_def 1 2 inj_image_eq_iff image_comp
            cong: image_cong_simp)
 qed
 *)
 
 end
\ No newline at end of file
diff --git a/src/HOL/Examples/Cantor.thy b/src/HOL/Examples/Cantor.thy
--- a/src/HOL/Examples/Cantor.thy
+++ b/src/HOL/Examples/Cantor.thy
@@ -1,136 +1,136 @@
 (*  Title:      HOL/Examples/Cantor.thy
     Author:     Makarius
 *)
 
 section \<open>Cantor's Theorem\<close>
 
 theory Cantor
   imports Main
 begin
 
 subsection \<open>Mathematical statement and proof\<close>
 
 text \<open>
   Cantor's Theorem states that there is no surjection from
   a set to its powerset.  The proof works by diagonalization.  E.g.\ see
   \<^item> \<^url>\<open>http://mathworld.wolfram.com/CantorDiagonalMethod.html\<close>
   \<^item> \<^url>\<open>https://en.wikipedia.org/wiki/Cantor's_diagonal_argument\<close>
 \<close>
 
 theorem Cantor: "\<nexists>f :: 'a \<Rightarrow> 'a set. \<forall>A. \<exists>x. A = f x"
 proof
   assume "\<exists>f :: 'a \<Rightarrow> 'a set. \<forall>A. \<exists>x. A = f x"
   then obtain f :: "'a \<Rightarrow> 'a set" where *: "\<forall>A. \<exists>x. A = f x" ..
   let ?D = "{x. x \<notin> f x}"
   from * obtain a where "?D = f a" by blast
   moreover have "a \<in> ?D \<longleftrightarrow> a \<notin> f a" by blast
   ultimately show False by blast
 qed
 
 
 subsection \<open>Automated proofs\<close>
 
 text \<open>
   These automated proofs are much shorter, but lack information why and how it
   works.
 \<close>
 
 theorem "\<nexists>f :: 'a \<Rightarrow> 'a set. \<forall>A. \<exists>x. f x = A"
   by best
 
 theorem "\<nexists>f :: 'a \<Rightarrow> 'a set. \<forall>A. \<exists>x. f x = A"
   by force
 
 
 subsection \<open>Elementary version in higher-order predicate logic\<close>
 
 text \<open>
   The subsequent formulation bypasses set notation of HOL; it uses elementary
   \<open>\<lambda>\<close>-calculus and predicate logic, with standard introduction and elimination
   rules. This also shows that the proof does not require classical reasoning.
 \<close>
 
 lemma iff_contradiction:
   assumes *: "\<not> A \<longleftrightarrow> A"
   shows False
 proof (rule notE)
   show "\<not> A"
   proof
     assume A
     with * have "\<not> A" ..
     from this and \<open>A\<close> show False ..
   qed
   with * show A ..
 qed
 
 theorem Cantor': "\<nexists>f :: 'a \<Rightarrow> 'a \<Rightarrow> bool. \<forall>A. \<exists>x. A = f x"
 proof
   assume "\<exists>f :: 'a \<Rightarrow> 'a \<Rightarrow> bool. \<forall>A. \<exists>x. A = f x"
   then obtain f :: "'a \<Rightarrow> 'a \<Rightarrow> bool" where *: "\<forall>A. \<exists>x. A = f x" ..
   let ?D = "\<lambda>x. \<not> f x x"
   from * have "\<exists>x. ?D = f x" ..
   then obtain a where "?D = f a" ..
   then have "?D a \<longleftrightarrow> f a a" by (rule arg_cong)
   then have "\<not> f a a \<longleftrightarrow> f a a" .
   then show False by (rule iff_contradiction)
 qed
 
 
 subsection \<open>Classic Isabelle/HOL example\<close>
 
 text \<open>
   The following treatment of Cantor's Theorem follows the classic example from
   the early 1990s, e.g.\ see the file \<^verbatim>\<open>92/HOL/ex/set.ML\<close> in
-  Isabelle92 or @{cite \<open>\S18.7\<close> "paulson-isa-book"}. The old tactic scripts
+  Isabelle92 or \<^cite>\<open>\<open>\S18.7\<close> in "paulson-isa-book"\<close>. The old tactic scripts
   synthesize key information of the proof by refinement of schematic goal
   states. In contrast, the Isar proof needs to say explicitly what is proven.
 
   \<^bigskip>
   Cantor's Theorem states that every set has more subsets than it has
   elements. It has become a favourite basic example in pure higher-order logic
   since it is so easily expressed:
 
   @{text [display]
   \<open>\<forall>f::\<alpha> \<Rightarrow> \<alpha> \<Rightarrow> bool. \<exists>S::\<alpha> \<Rightarrow> bool. \<forall>x::\<alpha>. f x \<noteq> S\<close>}
 
   Viewing types as sets, \<open>\<alpha> \<Rightarrow> bool\<close> represents the powerset of \<open>\<alpha>\<close>. This
   version of the theorem states that for every function from \<open>\<alpha>\<close> to its
   powerset, some subset is outside its range. The Isabelle/Isar proofs below
   uses HOL's set theory, with the type \<open>\<alpha> set\<close> and the operator \<open>range :: (\<alpha> \<Rightarrow>
   \<beta>) \<Rightarrow> \<beta> set\<close>.
 \<close>
 
 theorem "\<exists>S. S \<notin> range (f :: 'a \<Rightarrow> 'a set)"
 proof
   let ?S = "{x. x \<notin> f x}"
   show "?S \<notin> range f"
   proof
     assume "?S \<in> range f"
     then obtain y where "?S = f y" ..
     then show False
     proof (rule equalityCE)
       assume "y \<in> f y"
       assume "y \<in> ?S"
       then have "y \<notin> f y" ..
       with \<open>y \<in> f y\<close> show ?thesis by contradiction
     next
       assume "y \<notin> ?S"
       assume "y \<notin> f y"
       then have "y \<in> ?S" ..
       with \<open>y \<notin> ?S\<close> show ?thesis by contradiction
     qed
   qed
 qed
 
 text \<open>
   How much creativity is required? As it happens, Isabelle can prove this
   theorem automatically using best-first search. Depth-first search would
   diverge, but best-first search successfully navigates through the large
   search space. The context of Isabelle's classical prover contains rules for
   the relevant constructs of HOL's set theory.
 \<close>
 
 theorem "\<exists>S. S \<notin> range (f :: 'a \<Rightarrow> 'a set)"
   by best
 
 end
diff --git a/src/HOL/Examples/Knaster_Tarski.thy b/src/HOL/Examples/Knaster_Tarski.thy
--- a/src/HOL/Examples/Knaster_Tarski.thy
+++ b/src/HOL/Examples/Knaster_Tarski.thy
@@ -1,109 +1,109 @@
 (*  Title:      HOL/Examples/Knaster_Tarski.thy
     Author:     Makarius
 
 Typical textbook proof example.
 *)
 
 section \<open>Textbook-style reasoning: the Knaster-Tarski Theorem\<close>
 
 theory Knaster_Tarski
   imports Main
 begin
 
 unbundle lattice_syntax
 
 
 subsection \<open>Prose version\<close>
 
 text \<open>
-  According to the textbook @{cite \<open>pages 93--94\<close> "davey-priestley"}, the
+  According to the textbook \<^cite>\<open>\<open>pages 93--94\<close> in "davey-priestley"\<close>, the
   Knaster-Tarski fixpoint theorem is as follows.\<^footnote>\<open>We have dualized the
   argument, and tuned the notation a little bit.\<close>
 
   \<^bold>\<open>The Knaster-Tarski Fixpoint Theorem.\<close> Let \<open>L\<close> be a complete lattice and
   \<open>f: L \<rightarrow> L\<close> an order-preserving map. Then \<open>\<Sqinter>{x \<in> L | f(x) \<le> x}\<close> is a fixpoint
   of \<open>f\<close>.
 
   \<^bold>\<open>Proof.\<close> Let \<open>H = {x \<in> L | f(x) \<le> x}\<close> and \<open>a = \<Sqinter>H\<close>. For all \<open>x \<in> H\<close> we have
   \<open>a \<le> x\<close>, so \<open>f(a) \<le> f(x) \<le> x\<close>. Thus \<open>f(a)\<close> is a lower bound of \<open>H\<close>, whence
   \<open>f(a) \<le> a\<close>. We now use this inequality to prove the reverse one (!) and
   thereby complete the proof that \<open>a\<close> is a fixpoint. Since \<open>f\<close> is
   order-preserving, \<open>f(f(a)) \<le> f(a)\<close>. This says \<open>f(a) \<in> H\<close>, so \<open>a \<le> f(a)\<close>.\<close>
 
 
 subsection \<open>Formal versions\<close>
 
 text \<open>
   The Isar proof below closely follows the original presentation. Virtually
   all of the prose narration has been rephrased in terms of formal Isar
   language elements. Just as many textbook-style proofs, there is a strong
   bias towards forward proof, and several bends in the course of reasoning.
 \<close>
 
 theorem Knaster_Tarski:
   fixes f :: "'a::complete_lattice \<Rightarrow> 'a"
   assumes "mono f"
   shows "\<exists>a. f a = a"
 proof
   let ?H = "{u. f u \<le> u}"
   let ?a = "\<Sqinter>?H"
   show "f ?a = ?a"
   proof -
     {
       fix x
       assume "x \<in> ?H"
       then have "?a \<le> x" by (rule Inf_lower)
       with \<open>mono f\<close> have "f ?a \<le> f x" ..
       also from \<open>x \<in> ?H\<close> have "\<dots> \<le> x" ..
       finally have "f ?a \<le> x" .
     }
     then have "f ?a \<le> ?a" by (rule Inf_greatest)
     {
       also presume "\<dots> \<le> f ?a"
       finally (order_antisym) show ?thesis .
     }
     from \<open>mono f\<close> and \<open>f ?a \<le> ?a\<close> have "f (f ?a) \<le> f ?a" ..
     then have "f ?a \<in> ?H" ..
     then show "?a \<le> f ?a" by (rule Inf_lower)
   qed
 qed
 
 text \<open>
   Above we have used several advanced Isar language elements, such as explicit
   block structure and weak assumptions. Thus we have mimicked the particular
   way of reasoning of the original text.
 
   In the subsequent version the order of reasoning is changed to achieve
   structured top-down decomposition of the problem at the outer level, while
   only the inner steps of reasoning are done in a forward manner. We are
   certainly more at ease here, requiring only the most basic features of the
   Isar language.
 \<close>
 
 theorem Knaster_Tarski':
   fixes f :: "'a::complete_lattice \<Rightarrow> 'a"
   assumes "mono f"
   shows "\<exists>a. f a = a"
 proof
   let ?H = "{u. f u \<le> u}"
   let ?a = "\<Sqinter>?H"
   show "f ?a = ?a"
   proof (rule order_antisym)
     show "f ?a \<le> ?a"
     proof (rule Inf_greatest)
       fix x
       assume "x \<in> ?H"
       then have "?a \<le> x" by (rule Inf_lower)
       with \<open>mono f\<close> have "f ?a \<le> f x" ..
       also from \<open>x \<in> ?H\<close> have "\<dots> \<le> x" ..
       finally show "f ?a \<le> x" .
     qed
     show "?a \<le> f ?a"
     proof (rule Inf_lower)
       from \<open>mono f\<close> and \<open>f ?a \<le> ?a\<close> have "f (f ?a) \<le> f ?a" ..
       then show "f ?a \<in> ?H" ..
     qed
   qed
 qed
 
 end
diff --git a/src/HOL/HOLCF/IMP/HoareEx.thy b/src/HOL/HOLCF/IMP/HoareEx.thy
--- a/src/HOL/HOLCF/IMP/HoareEx.thy
+++ b/src/HOL/HOLCF/IMP/HoareEx.thy
@@ -1,33 +1,33 @@
 (*  Title:      HOL/HOLCF/IMP/HoareEx.thy
     Author:     Tobias Nipkow, TUM
     Copyright   1997 TUM
 *)
 
 section "Correctness of Hoare by Fixpoint Reasoning"
 
 theory HoareEx imports Denotational begin
 
 text \<open>
   An example from the HOLCF paper by Müller, Nipkow, Oheimb, Slotosch
-  @{cite MuellerNvOS99}.  It demonstrates fixpoint reasoning by showing
+  \<^cite>\<open>MuellerNvOS99\<close>.  It demonstrates fixpoint reasoning by showing
   the correctness of the Hoare rule for while-loops.
 \<close>
 
 type_synonym assn = "state \<Rightarrow> bool"
 
 definition
   hoare_valid :: "[assn, com, assn] \<Rightarrow> bool"  ("|= {(1_)}/ (_)/ {(1_)}" 50) where
   "|= {P} c {Q} = (\<forall>s t. P s \<and> D c\<cdot>(Discr s) = Def t \<longrightarrow> Q t)"
 
 lemma WHILE_rule_sound:
     "|= {A} c {A} \<Longrightarrow> |= {A} WHILE b DO c {\<lambda>s. A s \<and> \<not> bval b s}"
   apply (unfold hoare_valid_def)
   apply (simp (no_asm))
   apply (rule fix_ind)
     apply (simp (no_asm)) \<comment> \<open>simplifier with enhanced \<open>adm\<close>-tactic\<close>
    apply (simp (no_asm))
   apply (simp (no_asm))
   apply blast
   done
 
 end
diff --git a/src/HOL/Hahn_Banach/Hahn_Banach.thy b/src/HOL/Hahn_Banach/Hahn_Banach.thy
--- a/src/HOL/Hahn_Banach/Hahn_Banach.thy
+++ b/src/HOL/Hahn_Banach/Hahn_Banach.thy
@@ -1,493 +1,493 @@
 (*  Title:      HOL/Hahn_Banach/Hahn_Banach.thy
     Author:     Gertrud Bauer, TU Munich
 *)
 
 section \<open>The Hahn-Banach Theorem\<close>
 
 theory Hahn_Banach
 imports Hahn_Banach_Lemmas
 begin
 
 text \<open>
   We present the proof of two different versions of the Hahn-Banach Theorem,
-  closely following @{cite \<open>\S36\<close> "Heuser:1986"}.
+  closely following \<^cite>\<open>\<open>\S36\<close> in "Heuser:1986"\<close>.
 \<close>
 
 
 subsection \<open>The Hahn-Banach Theorem for vector spaces\<close>
 
 paragraph \<open>Hahn-Banach Theorem.\<close>
 text \<open>
   Let \<open>F\<close> be a subspace of a real vector space \<open>E\<close>, let \<open>p\<close> be a semi-norm on
   \<open>E\<close>, and \<open>f\<close> be a linear form defined on \<open>F\<close> such that \<open>f\<close> is bounded by
   \<open>p\<close>, i.e. \<open>\<forall>x \<in> F. f x \<le> p x\<close>. Then \<open>f\<close> can be extended to a linear form \<open>h\<close>
   on \<open>E\<close> such that \<open>h\<close> is norm-preserving, i.e. \<open>h\<close> is also bounded by \<open>p\<close>.
 \<close>
 
 paragraph \<open>Proof Sketch.\<close>
 text \<open>
   \<^enum> Define \<open>M\<close> as the set of norm-preserving extensions of \<open>f\<close> to subspaces of
   \<open>E\<close>. The linear forms in \<open>M\<close> are ordered by domain extension.
 
   \<^enum> We show that every non-empty chain in \<open>M\<close> has an upper bound in \<open>M\<close>.
 
   \<^enum> With Zorn's Lemma we conclude that there is a maximal function \<open>g\<close> in \<open>M\<close>.
 
   \<^enum> The domain \<open>H\<close> of \<open>g\<close> is the whole space \<open>E\<close>, as shown by classical
   contradiction:
 
     \<^item> Assuming \<open>g\<close> is not defined on whole \<open>E\<close>, it can still be extended in a
     norm-preserving way to a super-space \<open>H'\<close> of \<open>H\<close>.
 
     \<^item> Thus \<open>g\<close> can not be maximal. Contradiction!
 \<close>
 
 theorem Hahn_Banach:
   assumes E: "vectorspace E" and "subspace F E"
     and "seminorm E p" and "linearform F f"
   assumes fp: "\<forall>x \<in> F. f x \<le> p x"
   shows "\<exists>h. linearform E h \<and> (\<forall>x \<in> F. h x = f x) \<and> (\<forall>x \<in> E. h x \<le> p x)"
     \<comment> \<open>Let \<open>E\<close> be a vector space, \<open>F\<close> a subspace of \<open>E\<close>, \<open>p\<close> a seminorm on \<open>E\<close>,\<close>
     \<comment> \<open>and \<open>f\<close> a linear form on \<open>F\<close> such that \<open>f\<close> is bounded by \<open>p\<close>,\<close>
     \<comment> \<open>then \<open>f\<close> can be extended to a linear form \<open>h\<close> on \<open>E\<close> in a norm-preserving way. \<^smallskip>\<close>
 proof -
   interpret vectorspace E by fact
   interpret subspace F E by fact
   interpret seminorm E p by fact
   interpret linearform F f by fact
   define M where "M = norm_pres_extensions E p F f"
   then have M: "M = \<dots>" by (simp only:)
   from E have F: "vectorspace F" ..
   note FE = \<open>F \<unlhd> E\<close>
   {
     fix c assume cM: "c \<in> chains M" and ex: "\<exists>x. x \<in> c"
     have "\<Union>c \<in> M"
       \<comment> \<open>Show that every non-empty chain \<open>c\<close> of \<open>M\<close> has an upper bound in \<open>M\<close>:\<close>
       \<comment> \<open>\<open>\<Union>c\<close> is greater than any element of the chain \<open>c\<close>, so it suffices to show \<open>\<Union>c \<in> M\<close>.\<close>
       unfolding M_def
     proof (rule norm_pres_extensionI)
       let ?H = "domain (\<Union>c)"
       let ?h = "funct (\<Union>c)"
 
       have a: "graph ?H ?h = \<Union>c"
       proof (rule graph_domain_funct)
         fix x y z assume "(x, y) \<in> \<Union>c" and "(x, z) \<in> \<Union>c"
         with M_def cM show "z = y" by (rule sup_definite)
       qed
       moreover from M cM a have "linearform ?H ?h"
         by (rule sup_lf)
       moreover from a M cM ex FE E have "?H \<unlhd> E"
         by (rule sup_subE)
       moreover from a M cM ex FE have "F \<unlhd> ?H"
         by (rule sup_supF)
       moreover from a M cM ex have "graph F f \<subseteq> graph ?H ?h"
         by (rule sup_ext)
       moreover from a M cM have "\<forall>x \<in> ?H. ?h x \<le> p x"
         by (rule sup_norm_pres)
       ultimately show "\<exists>H h. \<Union>c = graph H h
           \<and> linearform H h
           \<and> H \<unlhd> E
           \<and> F \<unlhd> H
           \<and> graph F f \<subseteq> graph H h
           \<and> (\<forall>x \<in> H. h x \<le> p x)" by blast
     qed
   }
   then have "\<exists>g \<in> M. \<forall>x \<in> M. g \<subseteq> x \<longrightarrow> x = g"
   \<comment> \<open>With Zorn's Lemma we can conclude that there is a maximal element in \<open>M\<close>. \<^smallskip>\<close>
   proof (rule Zorn's_Lemma)
       \<comment> \<open>We show that \<open>M\<close> is non-empty:\<close>
     show "graph F f \<in> M"
       unfolding M_def
     proof (rule norm_pres_extensionI2)
       show "linearform F f" by fact
       show "F \<unlhd> E" by fact
       from F show "F \<unlhd> F" by (rule vectorspace.subspace_refl)
       show "graph F f \<subseteq> graph F f" ..
       show "\<forall>x\<in>F. f x \<le> p x" by fact
     qed
   qed
   then obtain g where gM: "g \<in> M" and gx: "\<forall>x \<in> M. g \<subseteq> x \<longrightarrow> g = x"
     by blast
   from gM obtain H h where
       g_rep: "g = graph H h"
     and linearform: "linearform H h"
     and HE: "H \<unlhd> E" and FH: "F \<unlhd> H"
     and graphs: "graph F f \<subseteq> graph H h"
     and hp: "\<forall>x \<in> H. h x \<le> p x" unfolding M_def ..
       \<comment> \<open>\<open>g\<close> is a norm-preserving extension of \<open>f\<close>, in other words:\<close>
       \<comment> \<open>\<open>g\<close> is the graph of some linear form \<open>h\<close> defined on a subspace \<open>H\<close> of \<open>E\<close>,\<close>
       \<comment> \<open>and \<open>h\<close> is an extension of \<open>f\<close> that is again bounded by \<open>p\<close>. \<^smallskip>\<close>
   from HE E have H: "vectorspace H"
     by (rule subspace.vectorspace)
 
   have HE_eq: "H = E"
     \<comment> \<open>We show that \<open>h\<close> is defined on whole \<open>E\<close> by classical contradiction. \<^smallskip>\<close>
   proof (rule classical)
     assume neq: "H \<noteq> E"
       \<comment> \<open>Assume \<open>h\<close> is not defined on whole \<open>E\<close>. Then show that \<open>h\<close> can be extended\<close>
       \<comment> \<open>in a norm-preserving way to a function \<open>h'\<close> with the graph \<open>g'\<close>. \<^smallskip>\<close>
     have "\<exists>g' \<in> M. g \<subseteq> g' \<and> g \<noteq> g'"
     proof -
       from HE have "H \<subseteq> E" ..
       with neq obtain x' where x'E: "x' \<in> E" and "x' \<notin> H" by blast
       obtain x': "x' \<noteq> 0"
       proof
         show "x' \<noteq> 0"
         proof
           assume "x' = 0"
           with H have "x' \<in> H" by (simp only: vectorspace.zero)
           with \<open>x' \<notin> H\<close> show False by contradiction
         qed
       qed
 
       define H' where "H' = H + lin x'"
         \<comment> \<open>Define \<open>H'\<close> as the direct sum of \<open>H\<close> and the linear closure of \<open>x'\<close>. \<^smallskip>\<close>
       have HH': "H \<unlhd> H'"
       proof (unfold H'_def)
         from x'E have "vectorspace (lin x')" ..
         with H show "H \<unlhd> H + lin x'" ..
       qed
 
       obtain xi where
         xi: "\<forall>y \<in> H. - p (y + x') - h y \<le> xi
           \<and> xi \<le> p (y + x') - h y"
         \<comment> \<open>Pick a real number \<open>\<xi>\<close> that fulfills certain inequality; this will\<close>
         \<comment> \<open>be used to establish that \<open>h'\<close> is a norm-preserving extension of \<open>h\<close>.
            \label{ex-xi-use}\<^smallskip>\<close>
       proof -
         from H have "\<exists>xi. \<forall>y \<in> H. - p (y + x') - h y \<le> xi
             \<and> xi \<le> p (y + x') - h y"
         proof (rule ex_xi)
           fix u v assume u: "u \<in> H" and v: "v \<in> H"
           with HE have uE: "u \<in> E" and vE: "v \<in> E" by auto
           from H u v linearform have "h v - h u = h (v - u)"
             by (simp add: linearform.diff)
           also from hp and H u v have "\<dots> \<le> p (v - u)"
             by (simp only: vectorspace.diff_closed)
           also from x'E uE vE have "v - u = x' + - x' + v + - u"
             by (simp add: diff_eq1)
           also from x'E uE vE have "\<dots> = v + x' + - (u + x')"
             by (simp add: add_ac)
           also from x'E uE vE have "\<dots> = (v + x') - (u + x')"
             by (simp add: diff_eq1)
           also from x'E uE vE E have "p \<dots> \<le> p (v + x') + p (u + x')"
             by (simp add: diff_subadditive)
           finally have "h v - h u \<le> p (v + x') + p (u + x')" .
           then show "- p (u + x') - h u \<le> p (v + x') - h v" by simp
         qed
         then show thesis by (blast intro: that)
       qed
 
       define h' where "h' x = (let (y, a) =
           SOME (y, a). x = y + a \<cdot> x' \<and> y \<in> H in h y + a * xi)" for x
         \<comment> \<open>Define the extension \<open>h'\<close> of \<open>h\<close> to \<open>H'\<close> using \<open>\<xi>\<close>. \<^smallskip>\<close>
 
       have "g \<subseteq> graph H' h' \<and> g \<noteq> graph H' h'"
         \<comment> \<open>\<open>h'\<close> is an extension of \<open>h\<close> \dots \<^smallskip>\<close>
       proof
         show "g \<subseteq> graph H' h'"
         proof -
           have "graph H h \<subseteq> graph H' h'"
           proof (rule graph_extI)
             fix t assume t: "t \<in> H"
             from E HE t have "(SOME (y, a). t = y + a \<cdot> x' \<and> y \<in> H) = (t, 0)"
               using \<open>x' \<notin> H\<close> \<open>x' \<in> E\<close> \<open>x' \<noteq> 0\<close> by (rule decomp_H'_H)
             with h'_def show "h t = h' t" by (simp add: Let_def)
           next
             from HH' show "H \<subseteq> H'" ..
           qed
           with g_rep show ?thesis by (simp only:)
         qed
 
         show "g \<noteq> graph H' h'"
         proof -
           have "graph H h \<noteq> graph H' h'"
           proof
             assume eq: "graph H h = graph H' h'"
             have "x' \<in> H'"
               unfolding H'_def
             proof
               from H show "0 \<in> H" by (rule vectorspace.zero)
               from x'E show "x' \<in> lin x'" by (rule x_lin_x)
               from x'E show "x' = 0 + x'" by simp
             qed
             then have "(x', h' x') \<in> graph H' h'" ..
             with eq have "(x', h' x') \<in> graph H h" by (simp only:)
             then have "x' \<in> H" ..
             with \<open>x' \<notin> H\<close> show False by contradiction
           qed
           with g_rep show ?thesis by simp
         qed
       qed
       moreover have "graph H' h' \<in> M"
         \<comment> \<open>and \<open>h'\<close> is norm-preserving. \<^smallskip>\<close>
       proof (unfold M_def)
         show "graph H' h' \<in> norm_pres_extensions E p F f"
         proof (rule norm_pres_extensionI2)
           show "linearform H' h'"
             using h'_def H'_def HE linearform \<open>x' \<notin> H\<close> \<open>x' \<in> E\<close> \<open>x' \<noteq> 0\<close> E
             by (rule h'_lf)
           show "H' \<unlhd> E"
           unfolding H'_def
           proof
             show "H \<unlhd> E" by fact
             show "vectorspace E" by fact
             from x'E show "lin x' \<unlhd> E" ..
           qed
           from H \<open>F \<unlhd> H\<close> HH' show FH': "F \<unlhd> H'"
             by (rule vectorspace.subspace_trans)
           show "graph F f \<subseteq> graph H' h'"
           proof (rule graph_extI)
             fix x assume x: "x \<in> F"
             with graphs have "f x = h x" ..
             also have "\<dots> = h x + 0 * xi" by simp
             also have "\<dots> = (let (y, a) = (x, 0) in h y + a * xi)"
               by (simp add: Let_def)
             also have "(x, 0) =
                 (SOME (y, a). x = y + a \<cdot> x' \<and> y \<in> H)"
               using E HE
             proof (rule decomp_H'_H [symmetric])
               from FH x show "x \<in> H" ..
               from x' show "x' \<noteq> 0" .
               show "x' \<notin> H" by fact
               show "x' \<in> E" by fact
             qed
             also have
               "(let (y, a) = (SOME (y, a). x = y + a \<cdot> x' \<and> y \<in> H)
               in h y + a * xi) = h' x" by (simp only: h'_def)
             finally show "f x = h' x" .
           next
             from FH' show "F \<subseteq> H'" ..
           qed
           show "\<forall>x \<in> H'. h' x \<le> p x"
             using h'_def H'_def \<open>x' \<notin> H\<close> \<open>x' \<in> E\<close> \<open>x' \<noteq> 0\<close> E HE
               \<open>seminorm E p\<close> linearform and hp xi
             by (rule h'_norm_pres)
         qed
       qed
       ultimately show ?thesis ..
     qed
     then have "\<not> (\<forall>x \<in> M. g \<subseteq> x \<longrightarrow> g = x)" by simp
       \<comment> \<open>So the graph \<open>g\<close> of \<open>h\<close> cannot be maximal. Contradiction! \<^smallskip>\<close>
     with gx show "H = E" by contradiction
   qed
 
   from HE_eq and linearform have "linearform E h"
     by (simp only:)
   moreover have "\<forall>x \<in> F. h x = f x"
   proof
     fix x assume "x \<in> F"
     with graphs have "f x = h x" ..
     then show "h x = f x" ..
   qed
   moreover from HE_eq and hp have "\<forall>x \<in> E. h x \<le> p x"
     by (simp only:)
   ultimately show ?thesis by blast
 qed
 
 
 subsection \<open>Alternative formulation\<close>
 
 text \<open>
   The following alternative formulation of the Hahn-Banach
   Theorem\label{abs-Hahn-Banach} uses the fact that for a real linear form \<open>f\<close>
   and a seminorm \<open>p\<close> the following inequality are equivalent:\footnote{This
   was shown in lemma @{thm [source] abs_ineq_iff} (see page
   \pageref{abs-ineq-iff}).}
   \begin{center}
   \begin{tabular}{lll}
   \<open>\<forall>x \<in> H. \<bar>h x\<bar> \<le> p x\<close> & and & \<open>\<forall>x \<in> H. h x \<le> p x\<close> \\
   \end{tabular}
   \end{center}
 \<close>
 
 theorem abs_Hahn_Banach:
   assumes E: "vectorspace E" and FE: "subspace F E"
     and lf: "linearform F f" and sn: "seminorm E p"
   assumes fp: "\<forall>x \<in> F. \<bar>f x\<bar> \<le> p x"
   shows "\<exists>g. linearform E g
     \<and> (\<forall>x \<in> F. g x = f x)
     \<and> (\<forall>x \<in> E. \<bar>g x\<bar> \<le> p x)"
 proof -
   interpret vectorspace E by fact
   interpret subspace F E by fact
   interpret linearform F f by fact
   interpret seminorm E p by fact
   have "\<exists>g. linearform E g \<and> (\<forall>x \<in> F. g x = f x) \<and> (\<forall>x \<in> E. g x \<le> p x)"
     using E FE sn lf
   proof (rule Hahn_Banach)
     show "\<forall>x \<in> F. f x \<le> p x"
       using FE E sn lf and fp by (rule abs_ineq_iff [THEN iffD1])
   qed
   then obtain g where lg: "linearform E g" and *: "\<forall>x \<in> F. g x = f x"
       and **: "\<forall>x \<in> E. g x \<le> p x" by blast
   have "\<forall>x \<in> E. \<bar>g x\<bar> \<le> p x"
     using _ E sn lg **
   proof (rule abs_ineq_iff [THEN iffD2])
     show "E \<unlhd> E" ..
   qed
   with lg * show ?thesis by blast
 qed
 
 
 subsection \<open>The Hahn-Banach Theorem for normed spaces\<close>
 
 text \<open>
   Every continuous linear form \<open>f\<close> on a subspace \<open>F\<close> of a norm space \<open>E\<close>, can
   be extended to a continuous linear form \<open>g\<close> on \<open>E\<close> such that \<open>\<parallel>f\<parallel> = \<parallel>g\<parallel>\<close>.
 \<close>
 
 theorem norm_Hahn_Banach:
   fixes V and norm ("\<parallel>_\<parallel>")
   fixes B defines "\<And>V f. B V f \<equiv> {0} \<union> {\<bar>f x\<bar> / \<parallel>x\<parallel> | x. x \<noteq> 0 \<and> x \<in> V}"
   fixes fn_norm ("\<parallel>_\<parallel>\<hyphen>_" [0, 1000] 999)
   defines "\<And>V f. \<parallel>f\<parallel>\<hyphen>V \<equiv> \<Squnion>(B V f)"
   assumes E_norm: "normed_vectorspace E norm" and FE: "subspace F E"
     and linearform: "linearform F f" and "continuous F f norm"
   shows "\<exists>g. linearform E g
      \<and> continuous E g norm
      \<and> (\<forall>x \<in> F. g x = f x)
      \<and> \<parallel>g\<parallel>\<hyphen>E = \<parallel>f\<parallel>\<hyphen>F"
 proof -
   interpret normed_vectorspace E norm by fact
   interpret normed_vectorspace_with_fn_norm E norm B fn_norm
     by (auto simp: B_def fn_norm_def) intro_locales
   interpret subspace F E by fact
   interpret linearform F f by fact
   interpret continuous F f norm by fact
   have E: "vectorspace E" by intro_locales
   have F: "vectorspace F" by rule intro_locales
   have F_norm: "normed_vectorspace F norm"
     using FE E_norm by (rule subspace_normed_vs)
   have ge_zero: "0 \<le> \<parallel>f\<parallel>\<hyphen>F"
     by (rule normed_vectorspace_with_fn_norm.fn_norm_ge_zero
       [OF normed_vectorspace_with_fn_norm.intro,
        OF F_norm \<open>continuous F f norm\<close> , folded B_def fn_norm_def])
   txt \<open>We define a function \<open>p\<close> on \<open>E\<close> as follows:
     \<open>p x = \<parallel>f\<parallel> \<cdot> \<parallel>x\<parallel>\<close>\<close>
   define p where "p x = \<parallel>f\<parallel>\<hyphen>F * \<parallel>x\<parallel>" for x
 
   txt \<open>\<open>p\<close> is a seminorm on \<open>E\<close>:\<close>
   have q: "seminorm E p"
   proof
     fix x y a assume x: "x \<in> E" and y: "y \<in> E"
     
     txt \<open>\<open>p\<close> is positive definite:\<close>
     have "0 \<le> \<parallel>f\<parallel>\<hyphen>F" by (rule ge_zero)
     moreover from x have "0 \<le> \<parallel>x\<parallel>" ..
     ultimately show "0 \<le> p x"  
       by (simp add: p_def zero_le_mult_iff)
 
     txt \<open>\<open>p\<close> is absolutely homogeneous:\<close>
 
     show "p (a \<cdot> x) = \<bar>a\<bar> * p x"
     proof -
       have "p (a \<cdot> x) = \<parallel>f\<parallel>\<hyphen>F * \<parallel>a \<cdot> x\<parallel>" by (simp only: p_def)
       also from x have "\<parallel>a \<cdot> x\<parallel> = \<bar>a\<bar> * \<parallel>x\<parallel>" by (rule abs_homogenous)
       also have "\<parallel>f\<parallel>\<hyphen>F * (\<bar>a\<bar> * \<parallel>x\<parallel>) = \<bar>a\<bar> * (\<parallel>f\<parallel>\<hyphen>F * \<parallel>x\<parallel>)" by simp
       also have "\<dots> = \<bar>a\<bar> * p x" by (simp only: p_def)
       finally show ?thesis .
     qed
 
     txt \<open>Furthermore, \<open>p\<close> is subadditive:\<close>
 
     show "p (x + y) \<le> p x + p y"
     proof -
       have "p (x + y) = \<parallel>f\<parallel>\<hyphen>F * \<parallel>x + y\<parallel>" by (simp only: p_def)
       also have a: "0 \<le> \<parallel>f\<parallel>\<hyphen>F" by (rule ge_zero)
       from x y have "\<parallel>x + y\<parallel> \<le> \<parallel>x\<parallel> + \<parallel>y\<parallel>" ..
       with a have " \<parallel>f\<parallel>\<hyphen>F * \<parallel>x + y\<parallel> \<le> \<parallel>f\<parallel>\<hyphen>F * (\<parallel>x\<parallel> + \<parallel>y\<parallel>)"
         by (simp add: mult_left_mono)
       also have "\<dots> = \<parallel>f\<parallel>\<hyphen>F * \<parallel>x\<parallel> + \<parallel>f\<parallel>\<hyphen>F * \<parallel>y\<parallel>" by (simp only: distrib_left)
       also have "\<dots> = p x + p y" by (simp only: p_def)
       finally show ?thesis .
     qed
   qed
 
   txt \<open>\<open>f\<close> is bounded by \<open>p\<close>.\<close>
 
   have "\<forall>x \<in> F. \<bar>f x\<bar> \<le> p x"
   proof
     fix x assume "x \<in> F"
     with \<open>continuous F f norm\<close> and linearform
     show "\<bar>f x\<bar> \<le> p x"
       unfolding p_def by (rule normed_vectorspace_with_fn_norm.fn_norm_le_cong
         [OF normed_vectorspace_with_fn_norm.intro,
          OF F_norm, folded B_def fn_norm_def])
   qed
 
   txt \<open>Using the fact that \<open>p\<close> is a seminorm and \<open>f\<close> is bounded by \<open>p\<close> we can
     apply the Hahn-Banach Theorem for real vector spaces. So \<open>f\<close> can be
     extended in a norm-preserving way to some function \<open>g\<close> on the whole vector
     space \<open>E\<close>.\<close>
 
   with E FE linearform q obtain g where
       linearformE: "linearform E g"
     and a: "\<forall>x \<in> F. g x = f x"
     and b: "\<forall>x \<in> E. \<bar>g x\<bar> \<le> p x"
     by (rule abs_Hahn_Banach [elim_format]) iprover
 
   txt \<open>We furthermore have to show that \<open>g\<close> is also continuous:\<close>
 
   have g_cont: "continuous E g norm" using linearformE
   proof
     fix x assume "x \<in> E"
     with b show "\<bar>g x\<bar> \<le> \<parallel>f\<parallel>\<hyphen>F * \<parallel>x\<parallel>"
       by (simp only: p_def)
   qed
 
   txt \<open>To complete the proof, we show that \<open>\<parallel>g\<parallel> = \<parallel>f\<parallel>\<close>.\<close>
 
   have "\<parallel>g\<parallel>\<hyphen>E = \<parallel>f\<parallel>\<hyphen>F"
   proof (rule order_antisym)
     txt \<open>
       First we show \<open>\<parallel>g\<parallel> \<le> \<parallel>f\<parallel>\<close>. The function norm \<open>\<parallel>g\<parallel>\<close> is defined as the
       smallest \<open>c \<in> \<real>\<close> such that
       \begin{center}
       \begin{tabular}{l}
       \<open>\<forall>x \<in> E. \<bar>g x\<bar> \<le> c \<cdot> \<parallel>x\<parallel>\<close>
       \end{tabular}
       \end{center}
       \<^noindent> Furthermore holds
       \begin{center}
       \begin{tabular}{l}
       \<open>\<forall>x \<in> E. \<bar>g x\<bar> \<le> \<parallel>f\<parallel> \<cdot> \<parallel>x\<parallel>\<close>
       \end{tabular}
       \end{center}
     \<close>
 
     from g_cont _ ge_zero
     show "\<parallel>g\<parallel>\<hyphen>E \<le> \<parallel>f\<parallel>\<hyphen>F"
     proof
       fix x assume "x \<in> E"
       with b show "\<bar>g x\<bar> \<le> \<parallel>f\<parallel>\<hyphen>F * \<parallel>x\<parallel>"
         by (simp only: p_def)
     qed
 
     txt \<open>The other direction is achieved by a similar argument.\<close>
 
     show "\<parallel>f\<parallel>\<hyphen>F \<le> \<parallel>g\<parallel>\<hyphen>E"
     proof (rule normed_vectorspace_with_fn_norm.fn_norm_least
         [OF normed_vectorspace_with_fn_norm.intro,
          OF F_norm, folded B_def fn_norm_def])
       fix x assume x: "x \<in> F"
       show "\<bar>f x\<bar> \<le> \<parallel>g\<parallel>\<hyphen>E * \<parallel>x\<parallel>"
       proof -
         from a x have "g x = f x" ..
         then have "\<bar>f x\<bar> = \<bar>g x\<bar>" by (simp only:)
         also from g_cont have "\<dots> \<le> \<parallel>g\<parallel>\<hyphen>E * \<parallel>x\<parallel>"
         proof (rule fn_norm_le_cong [OF _ linearformE, folded B_def fn_norm_def])
           from FE x show "x \<in> E" ..
         qed
         finally show ?thesis .
       qed
     next
       show "0 \<le> \<parallel>g\<parallel>\<hyphen>E"
         using g_cont by (rule fn_norm_ge_zero [of g, folded B_def fn_norm_def])
       show "continuous F f norm" by fact
     qed
   qed
   with linearformE a g_cont show ?thesis by blast
 qed
 
 end
diff --git a/src/HOL/Imperative_HOL/Overview.thy b/src/HOL/Imperative_HOL/Overview.thy
--- a/src/HOL/Imperative_HOL/Overview.thy
+++ b/src/HOL/Imperative_HOL/Overview.thy
@@ -1,240 +1,240 @@
 (*  Title:      HOL/Imperative_HOL/Overview.thy
     Author:     Florian Haftmann, TU Muenchen
 *)
 
 (*<*)
 theory Overview
 imports Imperative_HOL "HOL-Library.LaTeXsugar"
 begin
 
 (* type constraints with spacing *)
 no_syntax (output)
   "_constrain" :: "logic => type => logic"  ("_::_" [4, 0] 3)
   "_constrain" :: "prop' => type => prop'"  ("_::_" [4, 0] 3)
 
 syntax (output)
   "_constrain" :: "logic => type => logic"  ("_ :: _" [4, 0] 3)
   "_constrain" :: "prop' => type => prop'"  ("_ :: _" [4, 0] 3)
 (*>*)
 
 text \<open>
   \<open>Imperative HOL\<close> is a lightweight framework for reasoning
   about imperative data structures in \<open>Isabelle/HOL\<close>
-  @{cite "Nipkow-et-al:2002:tutorial"}.  Its basic ideas are described in
-  @{cite "Bulwahn-et-al:2008:imp_HOL"}.  However their concrete
+  \<^cite>\<open>"Nipkow-et-al:2002:tutorial"\<close>.  Its basic ideas are described in
+  \<^cite>\<open>"Bulwahn-et-al:2008:imp_HOL"\<close>.  However their concrete
   realisation has changed since, due to both extensions and
   refinements.  Therefore this overview wants to present the framework
   \qt{as it is} by now.  It focusses on the user-view, less on matters
   of construction.  For details study of the theory sources is
   encouraged.
 \<close>
 
 
 section \<open>A polymorphic heap inside a monad\<close>
 
 text \<open>
   Heaps (\<^type>\<open>heap\<close>) can be populated by values of class \<^class>\<open>heap\<close>; HOL's default types are
   already instantiated to class \<^class>\<open>heap\<close>.  Class \<^class>\<open>heap\<close> is a subclass of \<^class>\<open>countable\<close>;
   see theory \<open>Countable\<close> for ways to instantiate types as \<^class>\<open>countable\<close>.
 
   The heap is wrapped up in a monad \<^typ>\<open>'a Heap\<close> by means of the
   following specification:
 
   \begin{quote}
     \<^datatype>\<open>Heap\<close>
   \end{quote}
 
   Unwrapping of this monad type happens through
 
   \begin{quote}
     \<^term_type>\<open>execute\<close> \\
     @{thm execute.simps [no_vars]}
   \end{quote}
 
   This allows for equational reasoning about monadic expressions; the
   fact collection \<open>execute_simps\<close> contains appropriate rewrites
   for all fundamental operations.
 
   Primitive fine-granular control over heaps is available through rule
   \<open>Heap_cases\<close>:
 
   \begin{quote}
     @{thm [break] Heap_cases [no_vars]}
   \end{quote}
 
   Monadic expression involve the usual combinators:
 
   \begin{quote}
     \<^term_type>\<open>return\<close> \\
     \<^term_type>\<open>bind\<close> \\
     \<^term_type>\<open>raise\<close>
   \end{quote}
 
   This is also associated with nice monad do-syntax.  The \<^typ>\<open>string\<close> argument to \<^const>\<open>raise\<close> is
   just a codified comment.
 
   Among a couple of generic combinators the following is helpful for
   establishing invariants:
 
   \begin{quote}
     \<^term_type>\<open>assert\<close> \\
     @{thm assert_def [no_vars]}
   \end{quote}
 \<close>
 
 
 section \<open>Relational reasoning about \<^type>\<open>Heap\<close> expressions\<close>
 
 text \<open>
   To establish correctness of imperative programs, predicate
 
   \begin{quote}
     \<^term_type>\<open>effect\<close>
   \end{quote}
 
   provides a simple relational calculus.  Primitive rules are \<open>effectI\<close> and \<open>effectE\<close>, rules
   appropriate for reasoning about imperative operations are available in the \<open>effect_intros\<close> and
   \<open>effect_elims\<close> fact collections.
 
   Often non-failure of imperative computations does not depend
   on the heap at all;  reasoning then can be easier using predicate
 
   \begin{quote}
     \<^term_type>\<open>success\<close>
   \end{quote}
 
   Introduction rules for \<^const>\<open>success\<close> are available in the
   \<open>success_intro\<close> fact collection.
 
   \<^const>\<open>execute\<close>, \<^const>\<open>effect\<close>, \<^const>\<open>success\<close> and \<^const>\<open>bind\<close>
   are related by rules \<open>execute_bind_success\<close>, \<open>success_bind_executeI\<close>, \<open>success_bind_effectI\<close>,
   \<open>effect_bindI\<close>, \<open>effect_bindE\<close> and \<open>execute_bind_eq_SomeI\<close>.
 \<close>
 
 
 section \<open>Monadic data structures\<close>
 
 text \<open>
   The operations for monadic data structures (arrays and references)
   come in two flavours:
 
   \begin{itemize}
 
      \item Operations on the bare heap; their number is kept minimal
        to facilitate proving.
 
      \item Operations on the heap wrapped up in a monad; these are designed
        for executing.
 
   \end{itemize}
 
   Provided proof rules are such that they reduce monad operations to
   operations on bare heaps.
 
   Note that HOL equality coincides with reference equality and may be
   used as primitive executable operation.
 \<close>
 
 subsection \<open>Arrays\<close>
 
 text \<open>
   Heap operations:
 
   \begin{quote}
     \<^term_type>\<open>Array.alloc\<close> \\
     \<^term_type>\<open>Array.present\<close> \\
     \<^term_type>\<open>Array.get\<close> \\
     \<^term_type>\<open>Array.set\<close> \\
     \<^term_type>\<open>Array.length\<close> \\
     \<^term_type>\<open>Array.update\<close> \\
     \<^term_type>\<open>Array.noteq\<close>
   \end{quote}
 
   Monad operations:
 
   \begin{quote}
     \<^term_type>\<open>Array.new\<close> \\
     \<^term_type>\<open>Array.of_list\<close> \\
     \<^term_type>\<open>Array.make\<close> \\
     \<^term_type>\<open>Array.len\<close> \\
     \<^term_type>\<open>Array.nth\<close> \\
     \<^term_type>\<open>Array.upd\<close> \\
     \<^term_type>\<open>Array.map_entry\<close> \\
     \<^term_type>\<open>Array.swap\<close> \\
     \<^term_type>\<open>Array.freeze\<close>
   \end{quote}
 \<close>
 
 subsection \<open>References\<close>
 
 text \<open>
   Heap operations:
 
   \begin{quote}
     \<^term_type>\<open>Ref.alloc\<close> \\
     \<^term_type>\<open>Ref.present\<close> \\
     \<^term_type>\<open>Ref.get\<close> \\
     \<^term_type>\<open>Ref.set\<close> \\
     \<^term_type>\<open>Ref.noteq\<close>
   \end{quote}
 
   Monad operations:
 
   \begin{quote}
     \<^term_type>\<open>Ref.ref\<close> \\
     \<^term_type>\<open>Ref.lookup\<close> \\
     \<^term_type>\<open>Ref.update\<close> \\
     \<^term_type>\<open>Ref.change\<close>
   \end{quote}
 \<close>
 
 
 section \<open>Code generation\<close>
 
 text \<open>
   Imperative HOL sets up the code generator in a way that imperative
   operations are mapped to suitable counterparts in the target
   language.  For \<open>Haskell\<close>, a suitable \<open>ST\<close> monad is used;
   for \<open>SML\<close>, \<open>Ocaml\<close> and \<open>Scala\<close> unit values ensure
   that the evaluation order is the same as you would expect from the
   original monadic expressions.  These units may look cumbersome; the
   target language variants \<open>SML_imp\<close>, \<open>Ocaml_imp\<close> and
   \<open>Scala_imp\<close> make some effort to optimize some of them away.
 \<close>
 
 
 section \<open>Some hints for using the framework\<close>
 
 text \<open>
   Of course a framework itself does not by itself indicate how to make
   best use of it.  Here some hints drawn from prior experiences with
   Imperative HOL:
 
   \begin{itemize}
 
     \item Proofs on bare heaps should be strictly separated from those
       for monadic expressions.  The first capture the essence, while the
       latter just describe a certain wrapping-up.
 
     \item A good methodology is to gradually improve an imperative
       program from a functional one.  In the extreme case this means
       that an original functional program is decomposed into suitable
       operations with exactly one corresponding imperative operation.
       Having shown suitable correspondence lemmas between those, the
       correctness prove of the whole imperative program simply
       consists of composing those.
       
     \item Whether one should prefer equational reasoning (fact
       collection \<open>execute_simps\<close> or relational reasoning (fact
       collections \<open>effect_intros\<close> and \<open>effect_elims\<close>) depends
       on the problems to solve.  For complex expressions or
       expressions involving binders, the relation style is usually
       superior but requires more proof text.
 
     \item Note that you can extend the fact collections of Imperative
       HOL yourself whenever appropriate.
 
   \end{itemize}
 \<close>
 
 end
diff --git a/src/HOL/Induct/Comb.thy b/src/HOL/Induct/Comb.thy
--- a/src/HOL/Induct/Comb.thy
+++ b/src/HOL/Induct/Comb.thy
@@ -1,201 +1,201 @@
 (*  Title:      HOL/Induct/Comb.thy
     Author:     Lawrence C Paulson
     Copyright   1996  University of Cambridge
 *)
 
 section \<open>Combinatory Logic example: the Church-Rosser Theorem\<close>
 
 theory Comb
 imports Main
 begin
 
 text \<open>
   Combinator terms do not have free variables.
-  Example taken from @{cite camilleri92}.
+  Example taken from \<^cite>\<open>camilleri92\<close>.
 \<close>
 
 subsection \<open>Definitions\<close>
 
 text \<open>Datatype definition of combinators \<open>S\<close> and \<open>K\<close>.\<close>
 
 datatype comb = K
               | S
               | Ap comb comb (infixl "\<bullet>" 90)
 
 text \<open>
   Inductive definition of contractions, \<open>\<rightarrow>\<^sup>1\<close> and
   (multi-step) reductions, \<open>\<rightarrow>\<close>.
 \<close>
 
 inductive contract1 :: "[comb,comb] \<Rightarrow> bool"  (infixl "\<rightarrow>\<^sup>1" 50)
   where
     K:     "K\<bullet>x\<bullet>y \<rightarrow>\<^sup>1 x"
   | S:     "S\<bullet>x\<bullet>y\<bullet>z \<rightarrow>\<^sup>1 (x\<bullet>z)\<bullet>(y\<bullet>z)"
   | Ap1:   "x \<rightarrow>\<^sup>1 y \<Longrightarrow> x\<bullet>z \<rightarrow>\<^sup>1 y\<bullet>z"
   | Ap2:   "x \<rightarrow>\<^sup>1 y \<Longrightarrow> z\<bullet>x \<rightarrow>\<^sup>1 z\<bullet>y"
 
 abbreviation
   contract :: "[comb,comb] \<Rightarrow> bool"   (infixl "\<rightarrow>" 50) where
   "contract \<equiv> contract1\<^sup>*\<^sup>*"
 
 text \<open>
   Inductive definition of parallel contractions, \<open>\<Rrightarrow>\<^sup>1\<close> and
   (multi-step) parallel reductions, \<open>\<Rrightarrow>\<close>.
 \<close>
 
 inductive parcontract1 :: "[comb,comb] \<Rightarrow> bool"  (infixl "\<Rrightarrow>\<^sup>1" 50)
   where
     refl:  "x \<Rrightarrow>\<^sup>1 x"
   | K:     "K\<bullet>x\<bullet>y \<Rrightarrow>\<^sup>1 x"
   | S:     "S\<bullet>x\<bullet>y\<bullet>z \<Rrightarrow>\<^sup>1 (x\<bullet>z)\<bullet>(y\<bullet>z)"
   | Ap:    "\<lbrakk>x \<Rrightarrow>\<^sup>1 y; z \<Rrightarrow>\<^sup>1 w\<rbrakk> \<Longrightarrow> x\<bullet>z \<Rrightarrow>\<^sup>1 y\<bullet>w"
 
 abbreviation
   parcontract :: "[comb,comb] \<Rightarrow> bool"   (infixl "\<Rrightarrow>" 50) where
   "parcontract \<equiv> parcontract1\<^sup>*\<^sup>*"
 
 text \<open>
   Misc definitions.
 \<close>
 
 definition
   I :: comb where
   "I \<equiv> S\<bullet>K\<bullet>K"
 
 definition
   diamond   :: "([comb,comb] \<Rightarrow> bool) \<Rightarrow> bool" where
     \<comment> \<open>confluence; Lambda/Commutation treats this more abstractly\<close>
   "diamond r \<equiv> \<forall>x y. r x y \<longrightarrow>
                   (\<forall>y'. r x y' \<longrightarrow> 
                     (\<exists>z. r y z \<and> r y' z))"
 
 
 subsection \<open>Reflexive/Transitive closure preserves Church-Rosser property\<close>
 
 text\<open>Remark: So does the Transitive closure, with a similar proof\<close>
 
 text\<open>Strip lemma.  
    The induction hypothesis covers all but the last diamond of the strip.\<close>
 lemma strip_lemma [rule_format]: 
   assumes "diamond r" and r: "r\<^sup>*\<^sup>* x y" "r x y'"
   shows "\<exists>z. r\<^sup>*\<^sup>* y' z \<and> r y z"
   using r
 proof (induction rule: rtranclp_induct)
   case base
   then show ?case
     by blast
 next
   case (step y z)
   then show ?case
     using \<open>diamond r\<close> unfolding diamond_def
     by (metis rtranclp.rtrancl_into_rtrancl)
 qed
 
 proposition diamond_rtrancl:
   assumes "diamond r" 
   shows "diamond(r\<^sup>*\<^sup>*)"
   unfolding diamond_def
 proof (intro strip)
   fix x y y'
   assume "r\<^sup>*\<^sup>* x y" "r\<^sup>*\<^sup>* x y'"
   then show "\<exists>z. r\<^sup>*\<^sup>* y z \<and> r\<^sup>*\<^sup>* y' z"
   proof (induction rule: rtranclp_induct)
     case base
     then show ?case
       by blast
   next
     case (step y z)
     then show ?case
       by (meson assms strip_lemma rtranclp.rtrancl_into_rtrancl)
   qed
 qed
 
 
 subsection \<open>Non-contraction results\<close>
 
 text \<open>Derive a case for each combinator constructor.\<close>
 
 inductive_cases
   K_contractE [elim!]: "K \<rightarrow>\<^sup>1 r"
   and S_contractE [elim!]: "S \<rightarrow>\<^sup>1 r"
   and Ap_contractE [elim!]: "p\<bullet>q \<rightarrow>\<^sup>1 r"
 
 declare contract1.K [intro!] contract1.S [intro!]
 declare contract1.Ap1 [intro] contract1.Ap2 [intro]
 
 lemma I_contract_E [iff]: "\<not> I \<rightarrow>\<^sup>1 z"
   unfolding I_def by blast
 
 lemma K1_contractD [elim!]: "K\<bullet>x \<rightarrow>\<^sup>1 z \<Longrightarrow> (\<exists>x'. z = K\<bullet>x' \<and> x \<rightarrow>\<^sup>1 x')"
   by blast
 
 lemma Ap_reduce1 [intro]: "x \<rightarrow> y \<Longrightarrow> x\<bullet>z \<rightarrow> y\<bullet>z"
   by (induction rule: rtranclp_induct; blast intro: rtranclp_trans)
 
 lemma Ap_reduce2 [intro]: "x \<rightarrow> y \<Longrightarrow> z\<bullet>x \<rightarrow> z\<bullet>y"
   by (induction rule: rtranclp_induct; blast intro: rtranclp_trans)
 
 text \<open>Counterexample to the diamond property for \<^term>\<open>x \<rightarrow>\<^sup>1 y\<close>\<close>
 
 lemma not_diamond_contract: "\<not> diamond(contract1)"
   unfolding diamond_def by (metis S_contractE contract1.K) 
 
 
 subsection \<open>Results about Parallel Contraction\<close>
 
 text \<open>Derive a case for each combinator constructor.\<close>
 
 inductive_cases
       K_parcontractE [elim!]: "K \<Rrightarrow>\<^sup>1 r"
   and S_parcontractE [elim!]: "S \<Rrightarrow>\<^sup>1 r"
   and Ap_parcontractE [elim!]: "p\<bullet>q \<Rrightarrow>\<^sup>1 r"
 
 declare parcontract1.intros [intro]
 
 subsection \<open>Basic properties of parallel contraction\<close>
 text\<open>The rules below are not essential but make proofs much faster\<close>
 
 lemma K1_parcontractD [dest!]: "K\<bullet>x \<Rrightarrow>\<^sup>1 z \<Longrightarrow> (\<exists>x'. z = K\<bullet>x' \<and> x \<Rrightarrow>\<^sup>1 x')"
   by blast
 
 lemma S1_parcontractD [dest!]: "S\<bullet>x \<Rrightarrow>\<^sup>1 z \<Longrightarrow> (\<exists>x'. z = S\<bullet>x' \<and> x \<Rrightarrow>\<^sup>1 x')"
   by blast
 
 lemma S2_parcontractD [dest!]: "S\<bullet>x\<bullet>y \<Rrightarrow>\<^sup>1 z \<Longrightarrow> (\<exists>x' y'. z = S\<bullet>x'\<bullet>y' \<and> x \<Rrightarrow>\<^sup>1 x' \<and> y \<Rrightarrow>\<^sup>1 y')"
   by blast
 
 text\<open>Church-Rosser property for parallel contraction\<close>
 proposition diamond_parcontract: "diamond parcontract1"
 proof -
   have "(\<exists>z. w \<Rrightarrow>\<^sup>1 z \<and> y' \<Rrightarrow>\<^sup>1 z)" if "y \<Rrightarrow>\<^sup>1 w" "y \<Rrightarrow>\<^sup>1 y'" for w y y'
     using that by (induction arbitrary: y' rule: parcontract1.induct) fast+
   then show ?thesis
     by (auto simp: diamond_def)
 qed
 
 subsection \<open>Equivalence of \<^prop>\<open>p \<rightarrow> q\<close> and \<^prop>\<open>p \<Rrightarrow> q\<close>.\<close>
 
 lemma contract_imp_parcontract: "x \<rightarrow>\<^sup>1 y \<Longrightarrow> x \<Rrightarrow>\<^sup>1 y"
   by (induction rule: contract1.induct; blast)
 
 text\<open>Reductions: simply throw together reflexivity, transitivity and
   the one-step reductions\<close>
 
 proposition reduce_I: "I\<bullet>x \<rightarrow> x"
   unfolding I_def
   by (meson contract1.K contract1.S r_into_rtranclp rtranclp.rtrancl_into_rtrancl)
 
 lemma parcontract_imp_reduce: "x \<Rrightarrow>\<^sup>1 y \<Longrightarrow> x \<rightarrow> y"
 proof (induction rule: parcontract1.induct)
   case (Ap x y z w)
   then show ?case
     by (meson Ap_reduce1 Ap_reduce2 rtranclp_trans)
 qed auto
 
 lemma reduce_eq_parreduce: "x \<rightarrow> y  \<longleftrightarrow>  x \<Rrightarrow> y"
   by (metis contract_imp_parcontract parcontract_imp_reduce predicate2I rtranclp_subset)
 
 theorem diamond_reduce: "diamond(contract)"
   using diamond_parcontract diamond_rtrancl reduce_eq_parreduce by presburger
 
 end
diff --git a/src/HOL/Isar_Examples/Basic_Logic.thy b/src/HOL/Isar_Examples/Basic_Logic.thy
--- a/src/HOL/Isar_Examples/Basic_Logic.thy
+++ b/src/HOL/Isar_Examples/Basic_Logic.thy
@@ -1,408 +1,407 @@
 (*  Title:      HOL/Isar_Examples/Basic_Logic.thy
     Author:     Makarius
 
 Basic propositional and quantifier reasoning.
 *)
 
 section \<open>Basic logical reasoning\<close>
 
 theory Basic_Logic
   imports Main
 begin
 
 
 subsection \<open>Pure backward reasoning\<close>
 
 text \<open>
   In order to get a first idea of how Isabelle/Isar proof documents may look
   like, we consider the propositions \<open>I\<close>, \<open>K\<close>, and \<open>S\<close>. The following (rather
   explicit) proofs should require little extra explanations.
 \<close>
 
 lemma I: "A \<longrightarrow> A"
 proof
   assume A
   show A by fact
 qed
 
 lemma K: "A \<longrightarrow> B \<longrightarrow> A"
 proof
   assume A
   show "B \<longrightarrow> A"
   proof
     show A by fact
   qed
 qed
 
 lemma S: "(A \<longrightarrow> B \<longrightarrow> C) \<longrightarrow> (A \<longrightarrow> B) \<longrightarrow> A \<longrightarrow> C"
 proof
   assume "A \<longrightarrow> B \<longrightarrow> C"
   show "(A \<longrightarrow> B) \<longrightarrow> A \<longrightarrow> C"
   proof
     assume "A \<longrightarrow> B"
     show "A \<longrightarrow> C"
     proof
       assume A
       show C
       proof (rule mp)
         show "B \<longrightarrow> C" by (rule mp) fact+
         show B by (rule mp) fact+
       qed
     qed
   qed
 qed
 
 text \<open>
   Isar provides several ways to fine-tune the reasoning, avoiding excessive
   detail. Several abbreviated language elements are available, enabling the
   writer to express proofs in a more concise way, even without referring to
   any automated proof tools yet.
 
   Concluding any (sub-)proof already involves solving any remaining goals by
   assumption\<^footnote>\<open>This is not a completely trivial operation, as proof by
   assumption may involve full higher-order unification.\<close>. Thus we may skip the
   rather vacuous body of the above proof.
 \<close>
 
 lemma "A \<longrightarrow> A"
 proof
 qed
 
 text \<open>
   Note that the \<^theory_text>\<open>proof\<close> command refers to the \<open>rule\<close> method (without
   arguments) by default. Thus it implicitly applies a single rule, as
   determined from the syntactic form of the statements involved. The \<^theory_text>\<open>by\<close>
   command abbreviates any proof with empty body, so the proof may be further
   pruned.
 \<close>
 
 lemma "A \<longrightarrow> A"
   by rule
 
 text \<open>
   Proof by a single rule may be abbreviated as double-dot.
 \<close>
 
 lemma "A \<longrightarrow> A" ..
 
 text \<open>
   Thus we have arrived at an adequate representation of the proof of a
   tautology that holds by a single standard rule.\<^footnote>\<open>Apparently, the
   rule here is implication introduction.\<close>
 
   \<^medskip>
   Let us also reconsider \<open>K\<close>. Its statement is composed of iterated
   connectives. Basic decomposition is by a single rule at a time, which is why
   our first version above was by nesting two proofs.
 
   The \<open>intro\<close> proof method repeatedly decomposes a goal's conclusion.\<^footnote>\<open>The
   dual method is \<open>elim\<close>, acting on a goal's premises.\<close>
 \<close>
 
 lemma "A \<longrightarrow> B \<longrightarrow> A"
 proof (intro impI)
   assume A
   show A by fact
 qed
 
 text \<open>Again, the body may be collapsed.\<close>
 
 lemma "A \<longrightarrow> B \<longrightarrow> A"
   by (intro impI)
 
 text \<open>
   Just like \<open>rule\<close>, the \<open>intro\<close> and \<open>elim\<close> proof methods pick standard
   structural rules, in case no explicit arguments are given. While implicit
   rules are usually just fine for single rule application, this may go too far
   with iteration. Thus in practice, \<open>intro\<close> and \<open>elim\<close> would be typically
   restricted to certain structures by giving a few rules only, e.g.\ \<^theory_text>\<open>proof
   (intro impI allI)\<close> to strip implications and universal quantifiers.
 
   Such well-tuned iterated decomposition of certain structures is the prime
   application of \<open>intro\<close> and \<open>elim\<close>. In contrast, terminal steps that solve a
   goal completely are usually performed by actual automated proof methods
   (such as \<^theory_text>\<open>by blast\<close>.
 \<close>
 
 
 subsection \<open>Variations of backward vs.\ forward reasoning\<close>
 
 text \<open>
   Certainly, any proof may be performed in backward-style only. On the other
   hand, small steps of reasoning are often more naturally expressed in
   forward-style. Isar supports both backward and forward reasoning as a
   first-class concept. In order to demonstrate the difference, we consider
   several proofs of \<open>A \<and> B \<longrightarrow> B \<and> A\<close>.
 
   The first version is purely backward.
 \<close>
 
 lemma "A \<and> B \<longrightarrow> B \<and> A"
 proof
   assume "A \<and> B"
   show "B \<and> A"
   proof
     show B by (rule conjunct2) fact
     show A by (rule conjunct1) fact
   qed
 qed
 
 text \<open>
   Above, the projection rules \<open>conjunct1\<close> / \<open>conjunct2\<close> had to be named
   explicitly, since the goals \<open>B\<close> and \<open>A\<close> did not provide any structural clue.
   This may be avoided using \<^theory_text>\<open>from\<close> to focus on the \<open>A \<and> B\<close> assumption as the
   current facts, enabling the use of double-dot proofs. Note that \<^theory_text>\<open>from\<close>
   already does forward-chaining, involving the \<open>conjE\<close> rule here.
 \<close>
 
 lemma "A \<and> B \<longrightarrow> B \<and> A"
 proof
   assume "A \<and> B"
   show "B \<and> A"
   proof
     from \<open>A \<and> B\<close> show B ..
     from \<open>A \<and> B\<close> show A ..
   qed
 qed
 
 text \<open>
   In the next version, we move the forward step one level upwards.
   Forward-chaining from the most recent facts is indicated by the \<^theory_text>\<open>then\<close>
   command. Thus the proof of \<open>B \<and> A\<close> from \<open>A \<and> B\<close> actually becomes an
   elimination, rather than an introduction. The resulting proof structure
   directly corresponds to that of the \<open>conjE\<close> rule, including the repeated
   goal proposition that is abbreviated as \<open>?thesis\<close> below.
 \<close>
 
 lemma "A \<and> B \<longrightarrow> B \<and> A"
 proof
   assume "A \<and> B"
   then show "B \<and> A"
   proof                    \<comment> \<open>rule \<open>conjE\<close> of \<open>A \<and> B\<close>\<close>
     assume B A
     then show ?thesis ..   \<comment> \<open>rule \<open>conjI\<close> of \<open>B \<and> A\<close>\<close>
   qed
 qed
 
 text \<open>
   In the subsequent version we flatten the structure of the main body by doing
   forward reasoning all the time. Only the outermost decomposition step is
   left as backward.
 \<close>
 
 lemma "A \<and> B \<longrightarrow> B \<and> A"
 proof
   assume "A \<and> B"
   from \<open>A \<and> B\<close> have A ..
   from \<open>A \<and> B\<close> have B ..
   from \<open>B\<close> \<open>A\<close> show "B \<and> A" ..
 qed
 
 text \<open>
   We can still push forward-reasoning a bit further, even at the risk of
   getting ridiculous. Note that we force the initial proof step to do nothing
   here, by referring to the \<open>-\<close> proof method.
 \<close>
 
 lemma "A \<and> B \<longrightarrow> B \<and> A"
 proof -
   {
     assume "A \<and> B"
     from \<open>A \<and> B\<close> have A ..
     from \<open>A \<and> B\<close> have B ..
     from \<open>B\<close> \<open>A\<close> have "B \<and> A" ..
   }
   then show ?thesis ..         \<comment> \<open>rule \<open>impI\<close>\<close>
 qed
 
 text \<open>
   \<^medskip>
   With these examples we have shifted through a whole range from purely
   backward to purely forward reasoning. Apparently, in the extreme ends we get
   slightly ill-structured proofs, which also require much explicit naming of
   either rules (backward) or local facts (forward).
 
   The general lesson learned here is that good proof style would achieve just
   the \<^emph>\<open>right\<close> balance of top-down backward decomposition, and bottom-up
   forward composition. In general, there is no single best way to arrange some
   pieces of formal reasoning, of course. Depending on the actual applications,
   the intended audience etc., rules (and methods) on the one hand vs.\ facts
   on the other hand have to be emphasized in an appropriate way. This requires
   the proof writer to develop good taste, and some practice, of course.
 
   \<^medskip>
   For our example the most appropriate way of reasoning is probably the middle
   one, with conjunction introduction done after elimination.
 \<close>
 
 lemma "A \<and> B \<longrightarrow> B \<and> A"
 proof
   assume "A \<and> B"
   then show "B \<and> A"
   proof
     assume B A
     then show ?thesis ..
   qed
 qed
 
 
 
 subsection \<open>A few examples from ``Introduction to Isabelle''\<close>
 
 text \<open>
-  We rephrase some of the basic reasoning examples of @{cite
-  "isabelle-intro"}, using HOL rather than FOL.
+  We rephrase some of the basic reasoning examples of \<^cite>\<open>"isabelle-intro"\<close>, using HOL rather than FOL.
 \<close>
 
 
 subsubsection \<open>A propositional proof\<close>
 
 text \<open>
   We consider the proposition \<open>P \<or> P \<longrightarrow> P\<close>. The proof below involves
   forward-chaining from \<open>P \<or> P\<close>, followed by an explicit case-analysis on the
   two \<^emph>\<open>identical\<close> cases.
 \<close>
 
 lemma "P \<or> P \<longrightarrow> P"
 proof
   assume "P \<or> P"
   then show P
   proof                    \<comment> \<open>rule \<open>disjE\<close>: \smash{$\infer{\<open>C\<close>}{\<open>A \<or> B\<close> & \infer*{\<open>C\<close>}{[\<open>A\<close>]} & \infer*{\<open>C\<close>}{[\<open>B\<close>]}}$}\<close>
     assume P show P by fact
   next
     assume P show P by fact
   qed
 qed
 
 text \<open>
   Case splits are \<^emph>\<open>not\<close> hardwired into the Isar language as a special
   feature. The \<^theory_text>\<open>next\<close> command used to separate the cases above is just a
   short form of managing block structure.
 
   \<^medskip>
   In general, applying proof methods may split up a goal into separate
   ``cases'', i.e.\ new subgoals with individual local assumptions. The
   corresponding proof text typically mimics this by establishing results in
   appropriate contexts, separated by blocks.
 
   In order to avoid too much explicit parentheses, the Isar system implicitly
   opens an additional block for any new goal, the \<^theory_text>\<open>next\<close> statement then
   closes one block level, opening a new one. The resulting behaviour is what
   one would expect from separating cases, only that it is more flexible. E.g.\
   an induction base case (which does not introduce local assumptions) would
   \<^emph>\<open>not\<close> require \<^theory_text>\<open>next\<close> to separate the subsequent step case.
 
   \<^medskip>
   In our example the situation is even simpler, since the two cases actually
   coincide. Consequently the proof may be rephrased as follows.
 \<close>
 
 lemma "P \<or> P \<longrightarrow> P"
 proof
   assume "P \<or> P"
   then show P
   proof
     assume P
     show P by fact
     show P by fact
   qed
 qed
 
 text \<open>Again, the rather vacuous body of the proof may be collapsed.
   Thus the case analysis degenerates into two assumption steps, which
   are implicitly performed when concluding the single rule step of the
   double-dot proof as follows.\<close>
 
 lemma "P \<or> P \<longrightarrow> P"
 proof
   assume "P \<or> P"
   then show P ..
 qed
 
 
 subsubsection \<open>A quantifier proof\<close>
 
 text \<open>
   To illustrate quantifier reasoning, let us prove
   \<open>(\<exists>x. P (f x)) \<longrightarrow> (\<exists>y. P y)\<close>. Informally, this holds because any \<open>a\<close> with
   \<open>P (f a)\<close> may be taken as a witness for the second existential statement.
 
   The first proof is rather verbose, exhibiting quite a lot of (redundant)
   detail. It gives explicit rules, even with some instantiation. Furthermore,
   we encounter two new language elements: the \<^theory_text>\<open>fix\<close> command augments the
   context by some new ``arbitrary, but fixed'' element; the \<^theory_text>\<open>is\<close> annotation
   binds term abbreviations by higher-order pattern matching.
 \<close>
 
 lemma "(\<exists>x. P (f x)) \<longrightarrow> (\<exists>y. P y)"
 proof
   assume "\<exists>x. P (f x)"
   then show "\<exists>y. P y"
   proof (rule exE)             \<comment> \<open>rule \<open>exE\<close>: \smash{$\infer{\<open>B\<close>}{\<open>\<exists>x. A(x)\<close> & \infer*{\<open>B\<close>}{[\<open>A(x)\<close>]_x}}$}\<close>
     fix a
     assume "P (f a)" (is "P ?witness")
     then show ?thesis by (rule exI [of P ?witness])
   qed
 qed
 
 text \<open>
   While explicit rule instantiation may occasionally improve readability of
   certain aspects of reasoning, it is usually quite redundant. Above, the
   basic proof outline gives already enough structural clues for the system to
   infer both the rules and their instances (by higher-order unification). Thus
   we may as well prune the text as follows.
 \<close>
 
 lemma "(\<exists>x. P (f x)) \<longrightarrow> (\<exists>y. P y)"
 proof
   assume "\<exists>x. P (f x)"
   then show "\<exists>y. P y"
   proof
     fix a
     assume "P (f a)"
     then show ?thesis ..
   qed
 qed
 
 text \<open>
   Explicit \<open>\<exists>\<close>-elimination as seen above can become quite cumbersome in
   practice. The derived Isar language element ``\<^theory_text>\<open>obtain\<close>'' provides a more
   handsome way to do generalized existence reasoning.
 \<close>
 
 lemma "(\<exists>x. P (f x)) \<longrightarrow> (\<exists>y. P y)"
 proof
   assume "\<exists>x. P (f x)"
   then obtain a where "P (f a)" ..
   then show "\<exists>y. P y" ..
 qed
 
 text \<open>
   Technically, \<^theory_text>\<open>obtain\<close> is similar to \<^theory_text>\<open>fix\<close> and \<^theory_text>\<open>assume\<close> together with a
   soundness proof of the elimination involved. Thus it behaves similar to any
   other forward proof element. Also note that due to the nature of general
   existence reasoning involved here, any result exported from the context of
   an \<^theory_text>\<open>obtain\<close> statement may \<^emph>\<open>not\<close> refer to the parameters introduced there.
 \<close>
 
 
 subsubsection \<open>Deriving rules in Isabelle\<close>
 
 text \<open>
   We derive the conjunction elimination rule from the corresponding
   projections. The proof is quite straight-forward, since Isabelle/Isar
   supports non-atomic goals and assumptions fully transparently.
 \<close>
 
 theorem conjE: "A \<and> B \<Longrightarrow> (A \<Longrightarrow> B \<Longrightarrow> C) \<Longrightarrow> C"
 proof -
   assume "A \<and> B"
   assume r: "A \<Longrightarrow> B \<Longrightarrow> C"
   show C
   proof (rule r)
     show A by (rule conjunct1) fact
     show B by (rule conjunct2) fact
   qed
 qed
 
 end
diff --git a/src/HOL/Isar_Examples/Fibonacci.thy b/src/HOL/Isar_Examples/Fibonacci.thy
--- a/src/HOL/Isar_Examples/Fibonacci.thy
+++ b/src/HOL/Isar_Examples/Fibonacci.thy
@@ -1,169 +1,169 @@
 (*  Title:      HOL/Isar_Examples/Fibonacci.thy
     Author:     Gertrud Bauer
     Copyright   1999 Technische Universitaet Muenchen
 
 The Fibonacci function.  Original
 tactic script by Lawrence C Paulson.
 
 Fibonacci numbers: proofs of laws taken from
 
   R. L. Graham, D. E. Knuth, O. Patashnik.
   Concrete Mathematics.
   (Addison-Wesley, 1989)
 *)
 
 section \<open>Fib and Gcd commute\<close>
 
 theory Fibonacci
   imports "HOL-Computational_Algebra.Primes"
 begin
 
 text_raw \<open>\<^footnote>\<open>Isar version by Gertrud Bauer. Original tactic script by Larry
-  Paulson. A few proofs of laws taken from @{cite "Concrete-Math"}.\<close>\<close>
+  Paulson. A few proofs of laws taken from \<^cite>\<open>"Concrete-Math"\<close>.\<close>\<close>
 
 subsection \<open>Fibonacci numbers\<close>
 
 fun fib :: "nat \<Rightarrow> nat"
   where
     "fib 0 = 0"
   | "fib (Suc 0) = 1"
   | "fib (Suc (Suc x)) = fib x + fib (Suc x)"
 
 lemma [simp]: "fib (Suc n) > 0"
   by (induct n rule: fib.induct) simp_all
 
 
 text \<open>Alternative induction rule.\<close>
 
 theorem fib_induct: "P 0 \<Longrightarrow> P 1 \<Longrightarrow> (\<And>n. P (n + 1) \<Longrightarrow> P n \<Longrightarrow> P (n + 2)) \<Longrightarrow> P n"
   for n :: nat
   by (induct rule: fib.induct) simp_all
 
 
 subsection \<open>Fib and gcd commute\<close>
 
-text \<open>A few laws taken from @{cite "Concrete-Math"}.\<close>
+text \<open>A few laws taken from \<^cite>\<open>"Concrete-Math"\<close>.\<close>
 
 lemma fib_add: "fib (n + k + 1) = fib (k + 1) * fib (n + 1) + fib k * fib n"
   (is "?P n")
-  \<comment> \<open>see @{cite \<open>page 280\<close> "Concrete-Math"}\<close>
+  \<comment> \<open>see \<^cite>\<open>\<open>page 280\<close> in "Concrete-Math"\<close>\<close>
 proof (induct n rule: fib_induct)
   show "?P 0" by simp
   show "?P 1" by simp
   fix n
   have "fib (n + 2 + k + 1)
     = fib (n + k + 1) + fib (n + 1 + k + 1)" by simp
   also assume "fib (n + k + 1) = fib (k + 1) * fib (n + 1) + fib k * fib n" (is " _ = ?R1")
   also assume "fib (n + 1 + k + 1) = fib (k + 1) * fib (n + 1 + 1) + fib k * fib (n + 1)"
     (is " _ = ?R2")
   also have "?R1 + ?R2 = fib (k + 1) * fib (n + 2 + 1) + fib k * fib (n + 2)"
     by (simp add: add_mult_distrib2)
   finally show "?P (n + 2)" .
 qed
 
 lemma coprime_fib_Suc: "coprime (fib n) (fib (n + 1))"
   (is "?P n")
 proof (induct n rule: fib_induct)
   show "?P 0" by simp
   show "?P 1" by simp
   fix n
   assume P: "coprime (fib (n + 1)) (fib (n + 1 + 1))"
   have "fib (n + 2 + 1) = fib (n + 1) + fib (n + 2)"
     by simp
   also have "\<dots> = fib (n + 2) + fib (n + 1)"
     by simp
   also have "gcd (fib (n + 2)) \<dots> = gcd (fib (n + 2)) (fib (n + 1))"
     by (rule gcd_add2)
   also have "\<dots> = gcd (fib (n + 1)) (fib (n + 1 + 1))"
     by (simp add: gcd.commute)
   also have "\<dots> = 1"
     using P by simp
   finally show "?P (n + 2)"
     by (simp add: coprime_iff_gcd_eq_1)
 qed
 
 lemma gcd_mult_add: "(0::nat) < n \<Longrightarrow> gcd (n * k + m) n = gcd m n"
 proof -
   assume "0 < n"
   then have "gcd (n * k + m) n = gcd n (m mod n)"
     by (simp add: gcd_non_0_nat add.commute)
   also from \<open>0 < n\<close> have "\<dots> = gcd m n"
     by (simp add: gcd_non_0_nat)
   finally show ?thesis .
 qed
 
 lemma gcd_fib_add: "gcd (fib m) (fib (n + m)) = gcd (fib m) (fib n)"
 proof (cases m)
   case 0
   then show ?thesis by simp
 next
   case (Suc k)
   then have "gcd (fib m) (fib (n + m)) = gcd (fib (n + k + 1)) (fib (k + 1))"
     by (simp add: gcd.commute)
   also have "fib (n + k + 1) = fib (k + 1) * fib (n + 1) + fib k * fib n"
     by (rule fib_add)
   also have "gcd \<dots> (fib (k + 1)) = gcd (fib k * fib n) (fib (k + 1))"
     by (simp add: gcd_mult_add)
   also have "\<dots> = gcd (fib n) (fib (k + 1))"
     using coprime_fib_Suc [of k] gcd_mult_left_right_cancel [of "fib (k + 1)" "fib k" "fib n"]
     by (simp add: ac_simps)
   also have "\<dots> = gcd (fib m) (fib n)"
     using Suc by (simp add: gcd.commute)
   finally show ?thesis .
 qed
 
 lemma gcd_fib_diff: "gcd (fib m) (fib (n - m)) = gcd (fib m) (fib n)" if "m \<le> n"
 proof -
   have "gcd (fib m) (fib (n - m)) = gcd (fib m) (fib (n - m + m))"
     by (simp add: gcd_fib_add)
   also from \<open>m \<le> n\<close> have "n - m + m = n"
     by simp
   finally show ?thesis .
 qed
 
 lemma gcd_fib_mod: "gcd (fib m) (fib (n mod m)) = gcd (fib m) (fib n)" if "0 < m"
 proof (induct n rule: nat_less_induct)
   case hyp: (1 n)
   show ?case
   proof -
     have "n mod m = (if n < m then n else (n - m) mod m)"
       by (rule mod_if)
     also have "gcd (fib m) (fib \<dots>) = gcd (fib m) (fib n)"
     proof (cases "n < m")
       case True
       then show ?thesis by simp
     next
       case False
       then have "m \<le> n" by simp
       from \<open>0 < m\<close> and False have "n - m < n"
         by simp
       with hyp have "gcd (fib m) (fib ((n - m) mod m))
           = gcd (fib m) (fib (n - m))" by simp
       also have "\<dots> = gcd (fib m) (fib n)"
         using \<open>m \<le> n\<close> by (rule gcd_fib_diff)
       finally have "gcd (fib m) (fib ((n - m) mod m)) =
           gcd (fib m) (fib n)" .
       with False show ?thesis by simp
     qed
     finally show ?thesis .
   qed
 qed
 
 theorem fib_gcd: "fib (gcd m n) = gcd (fib m) (fib n)"
   (is "?P m n")
 proof (induct m n rule: gcd_nat_induct)
   fix m n :: nat
   show "fib (gcd m 0) = gcd (fib m) (fib 0)"
     by simp
   assume n: "0 < n"
   then have "gcd m n = gcd n (m mod n)"
     by (simp add: gcd_non_0_nat)
   also assume hyp: "fib \<dots> = gcd (fib n) (fib (m mod n))"
   also from n have "\<dots> = gcd (fib n) (fib m)"
     by (rule gcd_fib_mod)
   also have "\<dots> = gcd (fib m) (fib n)"
     by (rule gcd.commute)
   finally show "fib (gcd m n) = gcd (fib m) (fib n)" .
 qed
 
 end
diff --git a/src/HOL/Isar_Examples/Hoare.thy b/src/HOL/Isar_Examples/Hoare.thy
--- a/src/HOL/Isar_Examples/Hoare.thy
+++ b/src/HOL/Isar_Examples/Hoare.thy
@@ -1,413 +1,412 @@
 (*  Title:      HOL/Isar_Examples/Hoare.thy
     Author:     Makarius
 
 A formulation of Hoare logic suitable for Isar.
 *)
 
 section \<open>Hoare Logic\<close>
 
 theory Hoare
   imports "HOL-Hoare.Hoare_Tac"
 begin
 
 subsection \<open>Abstract syntax and semantics\<close>
 
 text \<open>
   The following abstract syntax and semantics of Hoare Logic over \<^verbatim>\<open>WHILE\<close>
   programs closely follows the existing tradition in Isabelle/HOL of
-  formalizing the presentation given in @{cite \<open>\S6\<close> "Winskel:1993"}. See also
-  \<^dir>\<open>~~/src/HOL/Hoare\<close> and @{cite "Nipkow:1998:Winskel"}.
+  formalizing the presentation given in \<^cite>\<open>\<open>\S6\<close> in "Winskel:1993"\<close>. See also
+  \<^dir>\<open>~~/src/HOL/Hoare\<close> and \<^cite>\<open>"Nipkow:1998:Winskel"\<close>.
 \<close>
 
 type_synonym 'a bexp = "'a set"
 type_synonym 'a assn = "'a set"
 type_synonym 'a var = "'a \<Rightarrow> nat"
 
 datatype 'a com =
     Basic "'a \<Rightarrow> 'a"
   | Seq "'a com" "'a com"    ("(_;/ _)" [60, 61] 60)
   | Cond "'a bexp" "'a com" "'a com"
   | While "'a bexp" "'a assn" "'a var" "'a com"
 
 abbreviation Skip  ("SKIP")
   where "SKIP \<equiv> Basic id"
 
 type_synonym 'a sem = "'a \<Rightarrow> 'a \<Rightarrow> bool"
 
 primrec iter :: "nat \<Rightarrow> 'a bexp \<Rightarrow> 'a sem \<Rightarrow> 'a sem"
   where
     "iter 0 b S s s' \<longleftrightarrow> s \<notin> b \<and> s = s'"
   | "iter (Suc n) b S s s' \<longleftrightarrow> s \<in> b \<and> (\<exists>s''. S s s'' \<and> iter n b S s'' s')"
 
 primrec Sem :: "'a com \<Rightarrow> 'a sem"
   where
     "Sem (Basic f) s s' \<longleftrightarrow> s' = f s"
   | "Sem (c1; c2) s s' \<longleftrightarrow> (\<exists>s''. Sem c1 s s'' \<and> Sem c2 s'' s')"
   | "Sem (Cond b c1 c2) s s' \<longleftrightarrow> (if s \<in> b then Sem c1 s s' else Sem c2 s s')"
   | "Sem (While b x y c) s s' \<longleftrightarrow> (\<exists>n. iter n b (Sem c) s s')"
 
 definition Valid :: "'a bexp \<Rightarrow> 'a com \<Rightarrow> 'a bexp \<Rightarrow> bool"  ("(3\<turnstile> _/ (2_)/ _)" [100, 55, 100] 50)
   where "\<turnstile> P c Q \<longleftrightarrow> (\<forall>s s'. Sem c s s' \<longrightarrow> s \<in> P \<longrightarrow> s' \<in> Q)"
 
 lemma ValidI [intro?]: "(\<And>s s'. Sem c s s' \<Longrightarrow> s \<in> P \<Longrightarrow> s' \<in> Q) \<Longrightarrow> \<turnstile> P c Q"
   by (simp add: Valid_def)
 
 lemma ValidD [dest?]: "\<turnstile> P c Q \<Longrightarrow> Sem c s s' \<Longrightarrow> s \<in> P \<Longrightarrow> s' \<in> Q"
   by (simp add: Valid_def)
 
 
 subsection \<open>Primitive Hoare rules\<close>
 
 text \<open>
   From the semantics defined above, we derive the standard set of primitive
-  Hoare rules; e.g.\ see @{cite \<open>\S6\<close> "Winskel:1993"}. Usually, variant forms
+  Hoare rules; e.g.\ see \<^cite>\<open>\<open>\S6\<close> in "Winskel:1993"\<close>. Usually, variant forms
   of these rules are applied in actual proof, see also \S\ref{sec:hoare-isar}
   and \S\ref{sec:hoare-vcg}.
 
   \<^medskip>
   The \<open>basic\<close> rule represents any kind of atomic access to the state space.
   This subsumes the common rules of \<open>skip\<close> and \<open>assign\<close>, as formulated in
   \S\ref{sec:hoare-isar}.
 \<close>
 
 theorem basic: "\<turnstile> {s. f s \<in> P} (Basic f) P"
 proof
   fix s s'
   assume s: "s \<in> {s. f s \<in> P}"
   assume "Sem (Basic f) s s'"
   then have "s' = f s" by simp
   with s show "s' \<in> P" by simp
 qed
 
 text \<open>
   The rules for sequential commands and semantic consequences are established
   in a straight forward manner as follows.
 \<close>
 
 theorem seq: "\<turnstile> P c1 Q \<Longrightarrow> \<turnstile> Q c2 R \<Longrightarrow> \<turnstile> P (c1; c2) R"
 proof
   assume cmd1: "\<turnstile> P c1 Q" and cmd2: "\<turnstile> Q c2 R"
   fix s s'
   assume s: "s \<in> P"
   assume "Sem (c1; c2) s s'"
   then obtain s'' where sem1: "Sem c1 s s''" and sem2: "Sem c2 s'' s'"
     by auto
   from cmd1 sem1 s have "s'' \<in> Q" ..
   with cmd2 sem2 show "s' \<in> R" ..
 qed
 
 theorem conseq: "P' \<subseteq> P \<Longrightarrow> \<turnstile> P c Q \<Longrightarrow> Q \<subseteq> Q' \<Longrightarrow> \<turnstile> P' c Q'"
 proof
   assume P'P: "P' \<subseteq> P" and QQ': "Q \<subseteq> Q'"
   assume cmd: "\<turnstile> P c Q"
   fix s s' :: 'a
   assume sem: "Sem c s s'"
   assume "s \<in> P'" with P'P have "s \<in> P" ..
   with cmd sem have "s' \<in> Q" ..
   with QQ' show "s' \<in> Q'" ..
 qed
 
 text \<open>
   The rule for conditional commands is directly reflected by the corresponding
   semantics; in the proof we just have to look closely which cases apply.
 \<close>
 
 theorem cond:
   assumes case_b: "\<turnstile> (P \<inter> b) c1 Q"
     and case_nb: "\<turnstile> (P \<inter> -b) c2 Q"
   shows "\<turnstile> P (Cond b c1 c2) Q"
 proof
   fix s s'
   assume s: "s \<in> P"
   assume sem: "Sem (Cond b c1 c2) s s'"
   show "s' \<in> Q"
   proof cases
     assume b: "s \<in> b"
     from case_b show ?thesis
     proof
       from sem b show "Sem c1 s s'" by simp
       from s b show "s \<in> P \<inter> b" by simp
     qed
   next
     assume nb: "s \<notin> b"
     from case_nb show ?thesis
     proof
       from sem nb show "Sem c2 s s'" by simp
       from s nb show "s \<in> P \<inter> -b" by simp
     qed
   qed
 qed
 
 text \<open>
   The \<open>while\<close> rule is slightly less trivial --- it is the only one based on
   recursion, which is expressed in the semantics by a Kleene-style least
   fixed-point construction. The auxiliary statement below, which is by
   induction on the number of iterations is the main point to be proven; the
   rest is by routine application of the semantics of \<^verbatim>\<open>WHILE\<close>.
 \<close>
 
 theorem while:
   assumes body: "\<turnstile> (P \<inter> b) c P"
   shows "\<turnstile> P (While b X Y c) (P \<inter> -b)"
 proof
   fix s s' assume s: "s \<in> P"
   assume "Sem (While b X Y c) s s'"
   then obtain n where "iter n b (Sem c) s s'" by auto
   from this and s show "s' \<in> P \<inter> -b"
   proof (induct n arbitrary: s)
     case 0
     then show ?case by auto
   next
     case (Suc n)
     then obtain s'' where b: "s \<in> b" and sem: "Sem c s s''"
       and iter: "iter n b (Sem c) s'' s'" by auto
     from Suc and b have "s \<in> P \<inter> b" by simp
     with body sem have "s'' \<in> P" ..
     with iter show ?case by (rule Suc)
   qed
 qed
 
 
 subsection \<open>Concrete syntax for assertions\<close>
 
 text \<open>
   We now introduce concrete syntax for describing commands (with embedded
   expressions) and assertions. The basic technique is that of semantic
   ``quote-antiquote''. A \<^emph>\<open>quotation\<close> is a syntactic entity delimited by an
   implicit abstraction, say over the state space. An \<^emph>\<open>antiquotation\<close> is a
   marked expression within a quotation that refers the implicit argument; a
   typical antiquotation would select (or even update) components from the
   state.
 
   We will see some examples later in the concrete rules and applications.
 
   \<^medskip>
   The following specification of syntax and translations is for Isabelle
   experts only; feel free to ignore it.
 
   While the first part is still a somewhat intelligible specification of the
   concrete syntactic representation of our Hoare language, the actual ``ML
   drivers'' is quite involved. Just note that the we re-use the basic
   quote/antiquote translations as already defined in Isabelle/Pure (see \<^ML>\<open>Syntax_Trans.quote_tr\<close>, and \<^ML>\<open>Syntax_Trans.quote_tr'\<close>,).
 \<close>
 
 syntax
   "_quote" :: "'b \<Rightarrow> ('a \<Rightarrow> 'b)"
   "_antiquote" :: "('a \<Rightarrow> 'b) \<Rightarrow> 'b"  ("\<acute>_" [1000] 1000)
   "_Subst" :: "'a bexp \<Rightarrow> 'b \<Rightarrow> idt \<Rightarrow> 'a bexp"  ("_[_'/\<acute>_]" [1000] 999)
   "_Assert" :: "'a \<Rightarrow> 'a set"  ("(\<lbrace>_\<rbrace>)" [0] 1000)
   "_Assign" :: "idt \<Rightarrow> 'b \<Rightarrow> 'a com"  ("(\<acute>_ :=/ _)" [70, 65] 61)
   "_Cond" :: "'a bexp \<Rightarrow> 'a com \<Rightarrow> 'a com \<Rightarrow> 'a com"
     ("(0IF _/ THEN _/ ELSE _/ FI)" [0, 0, 0] 61)
   "_While_inv" :: "'a bexp \<Rightarrow> 'a assn \<Rightarrow> 'a com \<Rightarrow> 'a com"
     ("(0WHILE _/ INV _ //DO _ /OD)"  [0, 0, 0] 61)
   "_While" :: "'a bexp \<Rightarrow> 'a com \<Rightarrow> 'a com"  ("(0WHILE _ //DO _ /OD)"  [0, 0] 61)
 
 translations
   "\<lbrace>b\<rbrace>" \<rightharpoonup> "CONST Collect (_quote b)"
   "B [a/\<acute>x]" \<rightharpoonup> "\<lbrace>\<acute>(_update_name x (\<lambda>_. a)) \<in> B\<rbrace>"
   "\<acute>x := a" \<rightharpoonup> "CONST Basic (_quote (\<acute>(_update_name x (\<lambda>_. a))))"
   "IF b THEN c1 ELSE c2 FI" \<rightharpoonup> "CONST Cond \<lbrace>b\<rbrace> c1 c2"
   "WHILE b INV i DO c OD" \<rightharpoonup> "CONST While \<lbrace>b\<rbrace> i (\<lambda>_. 0) c"
   "WHILE b DO c OD" \<rightleftharpoons> "WHILE b INV CONST undefined DO c OD"
 
 parse_translation \<open>
   let
     fun quote_tr [t] = Syntax_Trans.quote_tr \<^syntax_const>\<open>_antiquote\<close> t
       | quote_tr ts = raise TERM ("quote_tr", ts);
   in [(\<^syntax_const>\<open>_quote\<close>, K quote_tr)] end
 \<close>
 
 text \<open>
   As usual in Isabelle syntax translations, the part for printing is more
   complicated --- we cannot express parts as macro rules as above. Don't look
   here, unless you have to do similar things for yourself.
 \<close>
 
 print_translation \<open>
   let
     fun quote_tr' f (t :: ts) =
           Term.list_comb (f $ Syntax_Trans.quote_tr' \<^syntax_const>\<open>_antiquote\<close> t, ts)
       | quote_tr' _ _ = raise Match;
 
     val assert_tr' = quote_tr' (Syntax.const \<^syntax_const>\<open>_Assert\<close>);
 
     fun bexp_tr' name ((Const (\<^const_syntax>\<open>Collect\<close>, _) $ t) :: ts) =
           quote_tr' (Syntax.const name) (t :: ts)
       | bexp_tr' _ _ = raise Match;
 
     fun assign_tr' (Abs (x, _, f $ k $ Bound 0) :: ts) =
           quote_tr' (Syntax.const \<^syntax_const>\<open>_Assign\<close> $ Syntax_Trans.update_name_tr' f)
             (Abs (x, dummyT, Syntax_Trans.const_abs_tr' k) :: ts)
       | assign_tr' _ = raise Match;
   in
    [(\<^const_syntax>\<open>Collect\<close>, K assert_tr'),
     (\<^const_syntax>\<open>Basic\<close>, K assign_tr'),
     (\<^const_syntax>\<open>Cond\<close>, K (bexp_tr' \<^syntax_const>\<open>_Cond\<close>)),
     (\<^const_syntax>\<open>While\<close>, K (bexp_tr' \<^syntax_const>\<open>_While_inv\<close>))]
   end
 \<close>
 
 
 subsection \<open>Rules for single-step proof \label{sec:hoare-isar}\<close>
 
 text \<open>
   We are now ready to introduce a set of Hoare rules to be used in single-step
   structured proofs in Isabelle/Isar. We refer to the concrete syntax
   introduce above.
 
   \<^medskip>
   Assertions of Hoare Logic may be manipulated in calculational proofs, with
   the inclusion expressed in terms of sets or predicates. Reversed order is
   supported as well.
 \<close>
 
 lemma [trans]: "\<turnstile> P c Q \<Longrightarrow> P' \<subseteq> P \<Longrightarrow> \<turnstile> P' c Q"
   by (unfold Valid_def) blast
 lemma [trans] : "P' \<subseteq> P \<Longrightarrow> \<turnstile> P c Q \<Longrightarrow> \<turnstile> P' c Q"
   by (unfold Valid_def) blast
 
 lemma [trans]: "Q \<subseteq> Q' \<Longrightarrow> \<turnstile> P c Q \<Longrightarrow> \<turnstile> P c Q'"
   by (unfold Valid_def) blast
 lemma [trans]: "\<turnstile> P c Q \<Longrightarrow> Q \<subseteq> Q' \<Longrightarrow> \<turnstile> P c Q'"
   by (unfold Valid_def) blast
 
 lemma [trans]:
     "\<turnstile> \<lbrace>\<acute>P\<rbrace> c Q \<Longrightarrow> (\<And>s. P' s \<longrightarrow> P s) \<Longrightarrow> \<turnstile> \<lbrace>\<acute>P'\<rbrace> c Q"
   by (simp add: Valid_def)
 lemma [trans]:
     "(\<And>s. P' s \<longrightarrow> P s) \<Longrightarrow> \<turnstile> \<lbrace>\<acute>P\<rbrace> c Q \<Longrightarrow> \<turnstile> \<lbrace>\<acute>P'\<rbrace> c Q"
   by (simp add: Valid_def)
 
 lemma [trans]:
     "\<turnstile> P c \<lbrace>\<acute>Q\<rbrace> \<Longrightarrow> (\<And>s. Q s \<longrightarrow> Q' s) \<Longrightarrow> \<turnstile> P c \<lbrace>\<acute>Q'\<rbrace>"
   by (simp add: Valid_def)
 lemma [trans]:
     "(\<And>s. Q s \<longrightarrow> Q' s) \<Longrightarrow> \<turnstile> P c \<lbrace>\<acute>Q\<rbrace> \<Longrightarrow> \<turnstile> P c \<lbrace>\<acute>Q'\<rbrace>"
   by (simp add: Valid_def)
 
 
 text \<open>
   Identity and basic assignments.\<^footnote>\<open>The \<open>hoare\<close> method introduced in
   \S\ref{sec:hoare-vcg} is able to provide proper instances for any number of
   basic assignments, without producing additional verification conditions.\<close>
 \<close>
 
 lemma skip [intro?]: "\<turnstile> P SKIP P"
 proof -
   have "\<turnstile> {s. id s \<in> P} SKIP P" by (rule basic)
   then show ?thesis by simp
 qed
 
 lemma assign: "\<turnstile> P [\<acute>a/\<acute>x::'a] \<acute>x := \<acute>a P"
   by (rule basic)
 
 text \<open>
   Note that above formulation of assignment corresponds to our preferred way
-  to model state spaces, using (extensible) record types in HOL @{cite
-  "Naraschewski-Wenzel:1998:HOOL"}. For any record field \<open>x\<close>, Isabelle/HOL
+  to model state spaces, using (extensible) record types in HOL \<^cite>\<open>"Naraschewski-Wenzel:1998:HOOL"\<close>. For any record field \<open>x\<close>, Isabelle/HOL
   provides a functions \<open>x\<close> (selector) and \<open>x_update\<close> (update). Above, there is
   only a place-holder appearing for the latter kind of function: due to
   concrete syntax \<open>\<acute>x := \<acute>a\<close> also contains \<open>x_update\<close>.\<^footnote>\<open>Note that due to the
   external nature of HOL record fields, we could not even state a general
   theorem relating selector and update functions (if this were required here);
   this would only work for any particular instance of record fields introduced
   so far.\<close>
 
   \<^medskip>
   Sequential composition --- normalizing with associativity achieves proper of
   chunks of code verified separately.
 \<close>
 
 lemmas [trans, intro?] = seq
 
 lemma seq_assoc [simp]: "\<turnstile> P c1;(c2;c3) Q \<longleftrightarrow> \<turnstile> P (c1;c2);c3 Q"
   by (auto simp add: Valid_def)
 
 text \<open>Conditional statements.\<close>
 
 lemmas [trans, intro?] = cond
 
 lemma [trans, intro?]:
   "\<turnstile> \<lbrace>\<acute>P \<and> \<acute>b\<rbrace> c1 Q
       \<Longrightarrow> \<turnstile> \<lbrace>\<acute>P \<and> \<not> \<acute>b\<rbrace> c2 Q
       \<Longrightarrow> \<turnstile> \<lbrace>\<acute>P\<rbrace> IF \<acute>b THEN c1 ELSE c2 FI Q"
     by (rule cond) (simp_all add: Valid_def)
 
 text \<open>While statements --- with optional invariant.\<close>
 
 lemma [intro?]: "\<turnstile> (P \<inter> b) c P \<Longrightarrow> \<turnstile> P (While b P V c) (P \<inter> -b)"
   by (rule while)
 
 lemma [intro?]: "\<turnstile> (P \<inter> b) c P \<Longrightarrow> \<turnstile> P (While b undefined V c) (P \<inter> -b)"
   by (rule while)
 
 
 lemma [intro?]:
   "\<turnstile> \<lbrace>\<acute>P \<and> \<acute>b\<rbrace> c \<lbrace>\<acute>P\<rbrace>
     \<Longrightarrow> \<turnstile> \<lbrace>\<acute>P\<rbrace> WHILE \<acute>b INV \<lbrace>\<acute>P\<rbrace> DO c OD \<lbrace>\<acute>P \<and> \<not> \<acute>b\<rbrace>"
   by (simp add: while Collect_conj_eq Collect_neg_eq)
 
 lemma [intro?]:
   "\<turnstile> \<lbrace>\<acute>P \<and> \<acute>b\<rbrace> c \<lbrace>\<acute>P\<rbrace>
     \<Longrightarrow> \<turnstile> \<lbrace>\<acute>P\<rbrace> WHILE \<acute>b DO c OD \<lbrace>\<acute>P \<and> \<not> \<acute>b\<rbrace>"
   by (simp add: while Collect_conj_eq Collect_neg_eq)
 
 
 subsection \<open>Verification conditions \label{sec:hoare-vcg}\<close>
 
 text \<open>
   We now load the \<^emph>\<open>original\<close> ML file for proof scripts and tactic definition
   for the Hoare Verification Condition Generator (see \<^dir>\<open>~~/src/HOL/Hoare\<close>).
   As far as we are concerned here, the result is a proof method \<open>hoare\<close>, which
   may be applied to a Hoare Logic assertion to extract purely logical
   verification conditions. It is important to note that the method requires
   \<^verbatim>\<open>WHILE\<close> loops to be fully annotated with invariants beforehand.
   Furthermore, only \<^emph>\<open>concrete\<close> pieces of code are handled --- the underlying
   tactic fails ungracefully if supplied with meta-variables or parameters, for
   example.
 \<close>
 
 lemma SkipRule: "p \<subseteq> q \<Longrightarrow> Valid p (Basic id) q"
   by (auto simp add: Valid_def)
 
 lemma BasicRule: "p \<subseteq> {s. f s \<in> q} \<Longrightarrow> Valid p (Basic f) q"
   by (auto simp: Valid_def)
 
 lemma SeqRule: "Valid P c1 Q \<Longrightarrow> Valid Q c2 R \<Longrightarrow> Valid P (c1;c2) R"
   by (auto simp: Valid_def)
 
 lemma CondRule:
   "p \<subseteq> {s. (s \<in> b \<longrightarrow> s \<in> w) \<and> (s \<notin> b \<longrightarrow> s \<in> w')}
     \<Longrightarrow> Valid w c1 q \<Longrightarrow> Valid w' c2 q \<Longrightarrow> Valid p (Cond b c1 c2) q"
   by (auto simp: Valid_def)
 
 lemma iter_aux:
   "\<forall>s s'. Sem c s s' \<longrightarrow> s \<in> I \<and> s \<in> b \<longrightarrow> s' \<in> I \<Longrightarrow>
        (\<And>s s'. s \<in> I \<Longrightarrow> iter n b (Sem c) s s' \<Longrightarrow> s' \<in> I \<and> s' \<notin> b)"
   by (induct n) auto
 
 lemma WhileRule:
     "p \<subseteq> i \<Longrightarrow> Valid (i \<inter> b) c i \<Longrightarrow> i \<inter> (-b) \<subseteq> q \<Longrightarrow> Valid p (While b i v c) q"
   apply (clarsimp simp: Valid_def)
   apply (drule iter_aux)
     prefer 2
     apply assumption
    apply blast
   apply blast
   done
 
 declare BasicRule [Hoare_Tac.BasicRule]
   and SkipRule [Hoare_Tac.SkipRule]
   and SeqRule [Hoare_Tac.SeqRule]
   and CondRule [Hoare_Tac.CondRule]
   and WhileRule [Hoare_Tac.WhileRule]
 
 method_setup hoare =
   \<open>Scan.succeed (fn ctxt =>
     (SIMPLE_METHOD'
       (Hoare_Tac.hoare_tac ctxt
         (simp_tac (put_simpset HOL_basic_ss ctxt addsimps [@{thm "Record.K_record_comp"}] )))))\<close>
   "verification condition generator for Hoare logic"
 
 end
diff --git a/src/HOL/Isar_Examples/Mutilated_Checkerboard.thy b/src/HOL/Isar_Examples/Mutilated_Checkerboard.thy
--- a/src/HOL/Isar_Examples/Mutilated_Checkerboard.thy
+++ b/src/HOL/Isar_Examples/Mutilated_Checkerboard.thy
@@ -1,291 +1,290 @@
 (*  Title:      HOL/Isar_Examples/Mutilated_Checkerboard.thy
     Author:     Markus Wenzel, TU Muenchen (Isar document)
     Author:     Lawrence C Paulson, Cambridge University Computer Laboratory (original scripts)
 *)
 
 section \<open>The Mutilated Checker Board Problem\<close>
 
 theory Mutilated_Checkerboard
   imports Main
 begin
 
 text \<open>
-  The Mutilated Checker Board Problem, formalized inductively. See @{cite
-  "paulson-mutilated-board"} for the original tactic script version.
+  The Mutilated Checker Board Problem, formalized inductively. See \<^cite>\<open>"paulson-mutilated-board"\<close> for the original tactic script version.
 \<close>
 
 subsection \<open>Tilings\<close>
 
 inductive_set tiling :: "'a set set \<Rightarrow> 'a set set" for A :: "'a set set"
   where
     empty: "{} \<in> tiling A"
   | Un: "a \<union> t \<in> tiling A" if "a \<in> A" and "t \<in> tiling A" and "a \<subseteq> - t"
 
 
 text \<open>The union of two disjoint tilings is a tiling.\<close>
 
 lemma tiling_Un:
   assumes "t \<in> tiling A"
     and "u \<in> tiling A"
     and "t \<inter> u = {}"
   shows "t \<union> u \<in> tiling A"
 proof -
   let ?T = "tiling A"
   from \<open>t \<in> ?T\<close> and \<open>t \<inter> u = {}\<close>
   show "t \<union> u \<in> ?T"
   proof (induct t)
     case empty
     with \<open>u \<in> ?T\<close> show "{} \<union> u \<in> ?T" by simp
   next
     case (Un a t)
     show "(a \<union> t) \<union> u \<in> ?T"
     proof -
       have "a \<union> (t \<union> u) \<in> ?T"
         using \<open>a \<in> A\<close>
       proof (rule tiling.Un)
         from \<open>(a \<union> t) \<inter> u = {}\<close> have "t \<inter> u = {}" by blast
         then show "t \<union> u \<in> ?T" by (rule Un)
         from \<open>a \<subseteq> - t\<close> and \<open>(a \<union> t) \<inter> u = {}\<close>
         show "a \<subseteq> - (t \<union> u)" by blast
       qed
       also have "a \<union> (t \<union> u) = (a \<union> t) \<union> u"
         by (simp only: Un_assoc)
       finally show ?thesis .
     qed
   qed
 qed
 
 
 subsection \<open>Basic properties of ``below''\<close>
 
 definition below :: "nat \<Rightarrow> nat set"
   where "below n = {i. i < n}"
 
 lemma below_less_iff [iff]: "i \<in> below k \<longleftrightarrow> i < k"
   by (simp add: below_def)
 
 lemma below_0: "below 0 = {}"
   by (simp add: below_def)
 
 lemma Sigma_Suc1: "m = n + 1 \<Longrightarrow> below m \<times> B = ({n} \<times> B) \<union> (below n \<times> B)"
   by (simp add: below_def less_Suc_eq) blast
 
 lemma Sigma_Suc2:
   "m = n + 2 \<Longrightarrow>
     A \<times> below m = (A \<times> {n}) \<union> (A \<times> {n + 1}) \<union> (A \<times> below n)"
   by (auto simp add: below_def)
 
 lemmas Sigma_Suc = Sigma_Suc1 Sigma_Suc2
 
 
 subsection \<open>Basic properties of ``evnodd''\<close>
 
 definition evnodd :: "(nat \<times> nat) set \<Rightarrow> nat \<Rightarrow> (nat \<times> nat) set"
   where "evnodd A b = A \<inter> {(i, j). (i + j) mod 2 = b}"
 
 lemma evnodd_iff: "(i, j) \<in> evnodd A b \<longleftrightarrow> (i, j) \<in> A  \<and> (i + j) mod 2 = b"
   by (simp add: evnodd_def)
 
 lemma evnodd_subset: "evnodd A b \<subseteq> A"
   unfolding evnodd_def by (rule Int_lower1)
 
 lemma evnoddD: "x \<in> evnodd A b \<Longrightarrow> x \<in> A"
   by (rule subsetD) (rule evnodd_subset)
 
 lemma evnodd_finite: "finite A \<Longrightarrow> finite (evnodd A b)"
   by (rule finite_subset) (rule evnodd_subset)
 
 lemma evnodd_Un: "evnodd (A \<union> B) b = evnodd A b \<union> evnodd B b"
   unfolding evnodd_def by blast
 
 lemma evnodd_Diff: "evnodd (A - B) b = evnodd A b - evnodd B b"
   unfolding evnodd_def by blast
 
 lemma evnodd_empty: "evnodd {} b = {}"
   by (simp add: evnodd_def)
 
 lemma evnodd_insert: "evnodd (insert (i, j) C) b =
     (if (i + j) mod 2 = b
       then insert (i, j) (evnodd C b) else evnodd C b)"
   by (simp add: evnodd_def)
 
 
 subsection \<open>Dominoes\<close>
 
 inductive_set domino :: "(nat \<times> nat) set set"
   where
     horiz: "{(i, j), (i, j + 1)} \<in> domino"
   | vertl: "{(i, j), (i + 1, j)} \<in> domino"
 
 lemma dominoes_tile_row:
   "{i} \<times> below (2 * n) \<in> tiling domino"
   (is "?B n \<in> ?T")
 proof (induct n)
   case 0
   show ?case by (simp add: below_0 tiling.empty)
 next
   case (Suc n)
   let ?a = "{i} \<times> {2 * n + 1} \<union> {i} \<times> {2 * n}"
   have "?B (Suc n) = ?a \<union> ?B n"
     by (auto simp add: Sigma_Suc Un_assoc)
   also have "\<dots> \<in> ?T"
   proof (rule tiling.Un)
     have "{(i, 2 * n), (i, 2 * n + 1)} \<in> domino"
       by (rule domino.horiz)
     also have "{(i, 2 * n), (i, 2 * n + 1)} = ?a" by blast
     finally show "\<dots> \<in> domino" .
     show "?B n \<in> ?T" by (rule Suc)
     show "?a \<subseteq> - ?B n" by blast
   qed
   finally show ?case .
 qed
 
 lemma dominoes_tile_matrix:
   "below m \<times> below (2 * n) \<in> tiling domino"
   (is "?B m \<in> ?T")
 proof (induct m)
   case 0
   show ?case by (simp add: below_0 tiling.empty)
 next
   case (Suc m)
   let ?t = "{m} \<times> below (2 * n)"
   have "?B (Suc m) = ?t \<union> ?B m" by (simp add: Sigma_Suc)
   also have "\<dots> \<in> ?T"
   proof (rule tiling_Un)
     show "?t \<in> ?T" by (rule dominoes_tile_row)
     show "?B m \<in> ?T" by (rule Suc)
     show "?t \<inter> ?B m = {}" by blast
   qed
   finally show ?case .
 qed
 
 lemma domino_singleton:
   assumes "d \<in> domino"
     and "b < 2"
   shows "\<exists>i j. evnodd d b = {(i, j)}"  (is "?P d")
   using assms
 proof induct
   from \<open>b < 2\<close> have b_cases: "b = 0 \<or> b = 1" by arith
   fix i j
   note [simp] = evnodd_empty evnodd_insert mod_Suc
   from b_cases show "?P {(i, j), (i, j + 1)}" by rule auto
   from b_cases show "?P {(i, j), (i + 1, j)}" by rule auto
 qed
 
 lemma domino_finite:
   assumes "d \<in> domino"
   shows "finite d"
   using assms
 proof induct
   fix i j :: nat
   show "finite {(i, j), (i, j + 1)}" by (intro finite.intros)
   show "finite {(i, j), (i + 1, j)}" by (intro finite.intros)
 qed
 
 
 subsection \<open>Tilings of dominoes\<close>
 
 lemma tiling_domino_finite:
   assumes t: "t \<in> tiling domino"  (is "t \<in> ?T")
   shows "finite t"  (is "?F t")
   using t
 proof induct
   show "?F {}" by (rule finite.emptyI)
   fix a t assume "?F t"
   assume "a \<in> domino"
   then have "?F a" by (rule domino_finite)
   from this and \<open>?F t\<close> show "?F (a \<union> t)" by (rule finite_UnI)
 qed
 
 lemma tiling_domino_01:
   assumes t: "t \<in> tiling domino"  (is "t \<in> ?T")
   shows "card (evnodd t 0) = card (evnodd t 1)"
   using t
 proof induct
   case empty
   show ?case by (simp add: evnodd_def)
 next
   case (Un a t)
   let ?e = evnodd
   note hyp = \<open>card (?e t 0) = card (?e t 1)\<close>
     and at = \<open>a \<subseteq> - t\<close>
   have card_suc: "card (?e (a \<union> t) b) = Suc (card (?e t b))" if "b < 2" for b :: nat
   proof -
     have "?e (a \<union> t) b = ?e a b \<union> ?e t b" by (rule evnodd_Un)
     also obtain i j where e: "?e a b = {(i, j)}"
     proof -
       from \<open>a \<in> domino\<close> and \<open>b < 2\<close>
       have "\<exists>i j. ?e a b = {(i, j)}" by (rule domino_singleton)
       then show ?thesis by (blast intro: that)
     qed
     also have "\<dots> \<union> ?e t b = insert (i, j) (?e t b)" by simp
     also have "card \<dots> = Suc (card (?e t b))"
     proof (rule card_insert_disjoint)
       from \<open>t \<in> tiling domino\<close> have "finite t"
         by (rule tiling_domino_finite)
       then show "finite (?e t b)"
         by (rule evnodd_finite)
       from e have "(i, j) \<in> ?e a b" by simp
       with at show "(i, j) \<notin> ?e t b" by (blast dest: evnoddD)
     qed
     finally show ?thesis .
   qed
   then have "card (?e (a \<union> t) 0) = Suc (card (?e t 0))" by simp
   also from hyp have "card (?e t 0) = card (?e t 1)" .
   also from card_suc have "Suc \<dots> = card (?e (a \<union> t) 1)"
     by simp
   finally show ?case .
 qed
 
 
 subsection \<open>Main theorem\<close>
 
 definition mutilated_board :: "nat \<Rightarrow> nat \<Rightarrow> (nat \<times> nat) set"
   where "mutilated_board m n =
     below (2 * (m + 1)) \<times> below (2 * (n + 1)) - {(0, 0)} - {(2 * m + 1, 2 * n + 1)}"
 
 theorem mutil_not_tiling: "mutilated_board m n \<notin> tiling domino"
 proof (unfold mutilated_board_def)
   let ?T = "tiling domino"
   let ?t = "below (2 * (m + 1)) \<times> below (2 * (n + 1))"
   let ?t' = "?t - {(0, 0)}"
   let ?t'' = "?t' - {(2 * m + 1, 2 * n + 1)}"
 
   show "?t'' \<notin> ?T"
   proof
     have t: "?t \<in> ?T" by (rule dominoes_tile_matrix)
     assume t'': "?t'' \<in> ?T"
 
     let ?e = evnodd
     have fin: "finite (?e ?t 0)"
       by (rule evnodd_finite, rule tiling_domino_finite, rule t)
 
     note [simp] = evnodd_iff evnodd_empty evnodd_insert evnodd_Diff
     have "card (?e ?t'' 0) < card (?e ?t' 0)"
     proof -
       have "card (?e ?t' 0 - {(2 * m + 1, 2 * n + 1)})
         < card (?e ?t' 0)"
       proof (rule card_Diff1_less)
         from _ fin show "finite (?e ?t' 0)"
           by (rule finite_subset) auto
         show "(2 * m + 1, 2 * n + 1) \<in> ?e ?t' 0" by simp
       qed
       then show ?thesis by simp
     qed
     also have "\<dots> < card (?e ?t 0)"
     proof -
       have "(0, 0) \<in> ?e ?t 0" by simp
       with fin have "card (?e ?t 0 - {(0, 0)}) < card (?e ?t 0)"
         by (rule card_Diff1_less)
       then show ?thesis by simp
     qed
     also from t have "\<dots> = card (?e ?t 1)"
       by (rule tiling_domino_01)
     also have "?e ?t 1 = ?e ?t'' 1" by simp
     also from t'' have "card \<dots> = card (?e ?t'' 0)"
       by (rule tiling_domino_01 [symmetric])
     finally have "\<dots> < \<dots>" . then show False ..
   qed
 qed
 
 end
diff --git a/src/HOL/Lattice/CompleteLattice.thy b/src/HOL/Lattice/CompleteLattice.thy
--- a/src/HOL/Lattice/CompleteLattice.thy
+++ b/src/HOL/Lattice/CompleteLattice.thy
@@ -1,452 +1,452 @@
 (*  Title:      HOL/Lattice/CompleteLattice.thy
     Author:     Markus Wenzel, TU Muenchen
 *)
 
 section \<open>Complete lattices\<close>
 
 theory CompleteLattice imports Lattice begin
 
 subsection \<open>Complete lattice operations\<close>
 
 text \<open>
   A \emph{complete lattice} is a partial order with general
   (infinitary) infimum of any set of elements.  General supremum
   exists as well, as a consequence of the connection of infinitary
   bounds (see \S\ref{sec:connect-bounds}).
 \<close>
 
 class complete_lattice =
   assumes ex_Inf: "\<exists>inf. is_Inf A inf"
 
 theorem ex_Sup: "\<exists>sup::'a::complete_lattice. is_Sup A sup"
 proof -
   from ex_Inf obtain sup where "is_Inf {b. \<forall>a\<in>A. a \<sqsubseteq> b} sup" by blast
   then have "is_Sup A sup" by (rule Inf_Sup)
   then show ?thesis ..
 qed
 
 text \<open>
   The general \<open>\<Sqinter>\<close> (meet) and \<open>\<Squnion>\<close> (join) operations select
   such infimum and supremum elements.
 \<close>
 
 definition
   Meet :: "'a::complete_lattice set \<Rightarrow> 'a"  ("\<Sqinter>_" [90] 90) where
   "\<Sqinter>A = (THE inf. is_Inf A inf)"
 definition
   Join :: "'a::complete_lattice set \<Rightarrow> 'a"  ("\<Squnion>_" [90] 90) where
   "\<Squnion>A = (THE sup. is_Sup A sup)"
 
 text \<open>
   Due to unique existence of bounds, the complete lattice operations
   may be exhibited as follows.
 \<close>
 
 lemma Meet_equality [elim?]: "is_Inf A inf \<Longrightarrow> \<Sqinter>A = inf"
 proof (unfold Meet_def)
   assume "is_Inf A inf"
   then show "(THE inf. is_Inf A inf) = inf"
     by (rule the_equality) (rule is_Inf_uniq [OF _ \<open>is_Inf A inf\<close>])
 qed
 
 lemma MeetI [intro?]:
   "(\<And>a. a \<in> A \<Longrightarrow> inf \<sqsubseteq> a) \<Longrightarrow>
     (\<And>b. \<forall>a \<in> A. b \<sqsubseteq> a \<Longrightarrow> b \<sqsubseteq> inf) \<Longrightarrow>
     \<Sqinter>A = inf"
   by (rule Meet_equality, rule is_InfI) blast+
 
 lemma Join_equality [elim?]: "is_Sup A sup \<Longrightarrow> \<Squnion>A = sup"
 proof (unfold Join_def)
   assume "is_Sup A sup"
   then show "(THE sup. is_Sup A sup) = sup"
     by (rule the_equality) (rule is_Sup_uniq [OF _ \<open>is_Sup A sup\<close>])
 qed
 
 lemma JoinI [intro?]:
   "(\<And>a. a \<in> A \<Longrightarrow> a \<sqsubseteq> sup) \<Longrightarrow>
     (\<And>b. \<forall>a \<in> A. a \<sqsubseteq> b \<Longrightarrow> sup \<sqsubseteq> b) \<Longrightarrow>
     \<Squnion>A = sup"
   by (rule Join_equality, rule is_SupI) blast+
 
 
 text \<open>
   \medskip The \<open>\<Sqinter>\<close> and \<open>\<Squnion>\<close> operations indeed determine
   bounds on a complete lattice structure.
 \<close>
 
 lemma is_Inf_Meet [intro?]: "is_Inf A (\<Sqinter>A)"
 proof (unfold Meet_def)
   from ex_Inf obtain inf where "is_Inf A inf" ..
   then show "is_Inf A (THE inf. is_Inf A inf)"
     by (rule theI) (rule is_Inf_uniq [OF _ \<open>is_Inf A inf\<close>])
 qed
 
 lemma Meet_greatest [intro?]: "(\<And>a. a \<in> A \<Longrightarrow> x \<sqsubseteq> a) \<Longrightarrow> x \<sqsubseteq> \<Sqinter>A"
   by (rule is_Inf_greatest, rule is_Inf_Meet) blast
 
 lemma Meet_lower [intro?]: "a \<in> A \<Longrightarrow> \<Sqinter>A \<sqsubseteq> a"
   by (rule is_Inf_lower) (rule is_Inf_Meet)
 
 
 lemma is_Sup_Join [intro?]: "is_Sup A (\<Squnion>A)"
 proof (unfold Join_def)
   from ex_Sup obtain sup where "is_Sup A sup" ..
   then show "is_Sup A (THE sup. is_Sup A sup)"
     by (rule theI) (rule is_Sup_uniq [OF _ \<open>is_Sup A sup\<close>])
 qed
 
 lemma Join_least [intro?]: "(\<And>a. a \<in> A \<Longrightarrow> a \<sqsubseteq> x) \<Longrightarrow> \<Squnion>A \<sqsubseteq> x"
   by (rule is_Sup_least, rule is_Sup_Join) blast
 lemma Join_lower [intro?]: "a \<in> A \<Longrightarrow> a \<sqsubseteq> \<Squnion>A"
   by (rule is_Sup_upper) (rule is_Sup_Join)
 
 
 subsection \<open>The Knaster-Tarski Theorem\<close>
 
 text \<open>
   The Knaster-Tarski Theorem (in its simplest formulation) states that
   any monotone function on a complete lattice has a least fixed-point
-  (see @{cite \<open>pages 93--94\<close> "Davey-Priestley:1990"} for example).  This
+  (see \<^cite>\<open>\<open>pages 93--94\<close> in "Davey-Priestley:1990"\<close> for example).  This
   is a consequence of the basic boundary properties of the complete
   lattice operations.
 \<close>
 
 theorem Knaster_Tarski:
   assumes mono: "\<And>x y. x \<sqsubseteq> y \<Longrightarrow> f x \<sqsubseteq> f y"
   obtains a :: "'a::complete_lattice" where
     "f a = a" and "\<And>a'. f a' = a' \<Longrightarrow> a \<sqsubseteq> a'"
 proof
   let ?H = "{u. f u \<sqsubseteq> u}"
   let ?a = "\<Sqinter>?H"
   show "f ?a = ?a"
   proof -
     have ge: "f ?a \<sqsubseteq> ?a"
     proof
       fix x assume x: "x \<in> ?H"
       then have "?a \<sqsubseteq> x" ..
       then have "f ?a \<sqsubseteq> f x" by (rule mono)
       also from x have "... \<sqsubseteq> x" ..
       finally show "f ?a \<sqsubseteq> x" .
     qed
     also have "?a \<sqsubseteq> f ?a"
     proof
       from ge have "f (f ?a) \<sqsubseteq> f ?a" by (rule mono)
       then show "f ?a \<in> ?H" ..
     qed
     finally show ?thesis .
   qed
 
   fix a'
   assume "f a' = a'"
   then have "f a' \<sqsubseteq> a'" by (simp only: leq_refl)
   then have "a' \<in> ?H" ..
   then show "?a \<sqsubseteq> a'" ..
 qed
 
 theorem Knaster_Tarski_dual:
   assumes mono: "\<And>x y. x \<sqsubseteq> y \<Longrightarrow> f x \<sqsubseteq> f y"
   obtains a :: "'a::complete_lattice" where
     "f a = a" and "\<And>a'. f a' = a' \<Longrightarrow> a' \<sqsubseteq> a"
 proof
   let ?H = "{u. u \<sqsubseteq> f u}"
   let ?a = "\<Squnion>?H"
   show "f ?a = ?a"
   proof -
     have le: "?a \<sqsubseteq> f ?a"
     proof
       fix x assume x: "x \<in> ?H"
       then have "x \<sqsubseteq> f x" ..
       also from x have "x \<sqsubseteq> ?a" ..
       then have "f x \<sqsubseteq> f ?a" by (rule mono)
       finally show "x \<sqsubseteq> f ?a" .
     qed
     have "f ?a \<sqsubseteq> ?a"
     proof
       from le have "f ?a \<sqsubseteq> f (f ?a)" by (rule mono)
       then show "f ?a \<in> ?H" ..
     qed
     from this and le show ?thesis by (rule leq_antisym)
   qed
 
   fix a'
   assume "f a' = a'"
   then have "a' \<sqsubseteq> f a'" by (simp only: leq_refl)
   then have "a' \<in> ?H" ..
   then show "a' \<sqsubseteq> ?a" ..
 qed
 
 
 subsection \<open>Bottom and top elements\<close>
 
 text \<open>
   With general bounds available, complete lattices also have least and
   greatest elements.
 \<close>
 
 definition
   bottom :: "'a::complete_lattice"  ("\<bottom>") where
   "\<bottom> = \<Sqinter>UNIV"
 
 definition
   top :: "'a::complete_lattice"  ("\<top>") where
   "\<top> = \<Squnion>UNIV"
 
 lemma bottom_least [intro?]: "\<bottom> \<sqsubseteq> x"
 proof (unfold bottom_def)
   have "x \<in> UNIV" ..
   then show "\<Sqinter>UNIV \<sqsubseteq> x" ..
 qed
 
 lemma bottomI [intro?]: "(\<And>a. x \<sqsubseteq> a) \<Longrightarrow> \<bottom> = x"
 proof (unfold bottom_def)
   assume "\<And>a. x \<sqsubseteq> a"
   show "\<Sqinter>UNIV = x"
   proof
     fix a show "x \<sqsubseteq> a" by fact
   next
     fix b :: "'a::complete_lattice"
     assume b: "\<forall>a \<in> UNIV. b \<sqsubseteq> a"
     have "x \<in> UNIV" ..
     with b show "b \<sqsubseteq> x" ..
   qed
 qed
 
 lemma top_greatest [intro?]: "x \<sqsubseteq> \<top>"
 proof (unfold top_def)
   have "x \<in> UNIV" ..
   then show "x \<sqsubseteq> \<Squnion>UNIV" ..
 qed
 
 lemma topI [intro?]: "(\<And>a. a \<sqsubseteq> x) \<Longrightarrow> \<top> = x"
 proof (unfold top_def)
   assume "\<And>a. a \<sqsubseteq> x"
   show "\<Squnion>UNIV = x"
   proof
     fix a show "a \<sqsubseteq> x" by fact
   next
     fix b :: "'a::complete_lattice"
     assume b: "\<forall>a \<in> UNIV. a \<sqsubseteq> b"
     have "x \<in> UNIV" ..
     with b show "x \<sqsubseteq> b" ..
   qed
 qed
 
 
 subsection \<open>Duality\<close>
 
 text \<open>
   The class of complete lattices is closed under formation of dual
   structures.
 \<close>
 
 instance dual :: (complete_lattice) complete_lattice
 proof
   fix A' :: "'a::complete_lattice dual set"
   show "\<exists>inf'. is_Inf A' inf'"
   proof -
     have "\<exists>sup. is_Sup (undual ` A') sup" by (rule ex_Sup)
     then have "\<exists>sup. is_Inf (dual ` undual ` A') (dual sup)" by (simp only: dual_Inf)
     then show ?thesis by (simp add: dual_ex [symmetric] image_comp)
   qed
 qed
 
 text \<open>
   Apparently, the \<open>\<Sqinter>\<close> and \<open>\<Squnion>\<close> operations are dual to each
   other.
 \<close>
 
 theorem dual_Meet [intro?]: "dual (\<Sqinter>A) = \<Squnion>(dual ` A)"
 proof -
   from is_Inf_Meet have "is_Sup (dual ` A) (dual (\<Sqinter>A))" ..
   then have "\<Squnion>(dual ` A) = dual (\<Sqinter>A)" ..
   then show ?thesis ..
 qed
 
 theorem dual_Join [intro?]: "dual (\<Squnion>A) = \<Sqinter>(dual ` A)"
 proof -
   from is_Sup_Join have "is_Inf (dual ` A) (dual (\<Squnion>A))" ..
   then have "\<Sqinter>(dual ` A) = dual (\<Squnion>A)" ..
   then show ?thesis ..
 qed
 
 text \<open>
   Likewise are \<open>\<bottom>\<close> and \<open>\<top>\<close> duals of each other.
 \<close>
 
 theorem dual_bottom [intro?]: "dual \<bottom> = \<top>"
 proof -
   have "\<top> = dual \<bottom>"
   proof
     fix a' have "\<bottom> \<sqsubseteq> undual a'" ..
     then have "dual (undual a') \<sqsubseteq> dual \<bottom>" ..
     then show "a' \<sqsubseteq> dual \<bottom>" by simp
   qed
   then show ?thesis ..
 qed
 
 theorem dual_top [intro?]: "dual \<top> = \<bottom>"
 proof -
   have "\<bottom> = dual \<top>"
   proof
     fix a' have "undual a' \<sqsubseteq> \<top>" ..
     then have "dual \<top> \<sqsubseteq> dual (undual a')" ..
     then show "dual \<top> \<sqsubseteq> a'" by simp
   qed
   then show ?thesis ..
 qed
 
 
 subsection \<open>Complete lattices are lattices\<close>
 
 text \<open>
   Complete lattices (with general bounds available) are indeed plain
   lattices as well.  This holds due to the connection of general
   versus binary bounds that has been formally established in
   \S\ref{sec:gen-bin-bounds}.
 \<close>
 
 lemma is_inf_binary: "is_inf x y (\<Sqinter>{x, y})"
 proof -
   have "is_Inf {x, y} (\<Sqinter>{x, y})" ..
   then show ?thesis by (simp only: is_Inf_binary)
 qed
 
 lemma is_sup_binary: "is_sup x y (\<Squnion>{x, y})"
 proof -
   have "is_Sup {x, y} (\<Squnion>{x, y})" ..
   then show ?thesis by (simp only: is_Sup_binary)
 qed
 
 instance complete_lattice \<subseteq> lattice
 proof
   fix x y :: "'a::complete_lattice"
   from is_inf_binary show "\<exists>inf. is_inf x y inf" ..
   from is_sup_binary show "\<exists>sup. is_sup x y sup" ..
 qed
 
 theorem meet_binary: "x \<sqinter> y = \<Sqinter>{x, y}"
   by (rule meet_equality) (rule is_inf_binary)
 
 theorem join_binary: "x \<squnion> y = \<Squnion>{x, y}"
   by (rule join_equality) (rule is_sup_binary)
 
 
 subsection \<open>Complete lattices and set-theory operations\<close>
 
 text \<open>
   The complete lattice operations are (anti) monotone wrt.\ set
   inclusion.
 \<close>
 
 theorem Meet_subset_antimono: "A \<subseteq> B \<Longrightarrow> \<Sqinter>B \<sqsubseteq> \<Sqinter>A"
 proof (rule Meet_greatest)
   fix a assume "a \<in> A"
   also assume "A \<subseteq> B"
   finally have "a \<in> B" .
   then show "\<Sqinter>B \<sqsubseteq> a" ..
 qed
 
 theorem Join_subset_mono: "A \<subseteq> B \<Longrightarrow> \<Squnion>A \<sqsubseteq> \<Squnion>B"
 proof -
   assume "A \<subseteq> B"
   then have "dual ` A \<subseteq> dual ` B" by blast
   then have "\<Sqinter>(dual ` B) \<sqsubseteq> \<Sqinter>(dual ` A)" by (rule Meet_subset_antimono)
   then have "dual (\<Squnion>B) \<sqsubseteq> dual (\<Squnion>A)" by (simp only: dual_Join)
   then show ?thesis by (simp only: dual_leq)
 qed
 
 text \<open>
   Bounds over unions of sets may be obtained separately.
 \<close>
 
 theorem Meet_Un: "\<Sqinter>(A \<union> B) = \<Sqinter>A \<sqinter> \<Sqinter>B"
 proof
   fix a assume "a \<in> A \<union> B"
   then show "\<Sqinter>A \<sqinter> \<Sqinter>B \<sqsubseteq> a"
   proof
     assume a: "a \<in> A"
     have "\<Sqinter>A \<sqinter> \<Sqinter>B \<sqsubseteq> \<Sqinter>A" ..
     also from a have "\<dots> \<sqsubseteq> a" ..
     finally show ?thesis .
   next
     assume a: "a \<in> B"
     have "\<Sqinter>A \<sqinter> \<Sqinter>B \<sqsubseteq> \<Sqinter>B" ..
     also from a have "\<dots> \<sqsubseteq> a" ..
     finally show ?thesis .
   qed
 next
   fix b assume b: "\<forall>a \<in> A \<union> B. b \<sqsubseteq> a"
   show "b \<sqsubseteq> \<Sqinter>A \<sqinter> \<Sqinter>B"
   proof
     show "b \<sqsubseteq> \<Sqinter>A"
     proof
       fix a assume "a \<in> A"
       then have "a \<in>  A \<union> B" ..
       with b show "b \<sqsubseteq> a" ..
     qed
     show "b \<sqsubseteq> \<Sqinter>B"
     proof
       fix a assume "a \<in> B"
       then have "a \<in>  A \<union> B" ..
       with b show "b \<sqsubseteq> a" ..
     qed
   qed
 qed
 
 theorem Join_Un: "\<Squnion>(A \<union> B) = \<Squnion>A \<squnion> \<Squnion>B"
 proof -
   have "dual (\<Squnion>(A \<union> B)) = \<Sqinter>(dual ` A \<union> dual ` B)"
     by (simp only: dual_Join image_Un)
   also have "\<dots> = \<Sqinter>(dual ` A) \<sqinter> \<Sqinter>(dual ` B)"
     by (rule Meet_Un)
   also have "\<dots> = dual (\<Squnion>A \<squnion> \<Squnion>B)"
     by (simp only: dual_join dual_Join)
   finally show ?thesis ..
 qed
 
 text \<open>
   Bounds over singleton sets are trivial.
 \<close>
 
 theorem Meet_singleton: "\<Sqinter>{x} = x"
 proof
   fix a assume "a \<in> {x}"
   then have "a = x" by simp
   then show "x \<sqsubseteq> a" by (simp only: leq_refl)
 next
   fix b assume "\<forall>a \<in> {x}. b \<sqsubseteq> a"
   then show "b \<sqsubseteq> x" by simp
 qed
 
 theorem Join_singleton: "\<Squnion>{x} = x"
 proof -
   have "dual (\<Squnion>{x}) = \<Sqinter>{dual x}" by (simp add: dual_Join)
   also have "\<dots> = dual x" by (rule Meet_singleton)
   finally show ?thesis ..
 qed
 
 text \<open>
   Bounds over the empty and universal set correspond to each other.
 \<close>
 
 theorem Meet_empty: "\<Sqinter>{} = \<Squnion>UNIV"
 proof
   fix a :: "'a::complete_lattice"
   assume "a \<in> {}"
   then have False by simp
   then show "\<Squnion>UNIV \<sqsubseteq> a" ..
 next
   fix b :: "'a::complete_lattice"
   have "b \<in> UNIV" ..
   then show "b \<sqsubseteq> \<Squnion>UNIV" ..
 qed
 
 theorem Join_empty: "\<Squnion>{} = \<Sqinter>UNIV"
 proof -
   have "dual (\<Squnion>{}) = \<Sqinter>{}" by (simp add: dual_Join)
   also have "\<dots> = \<Squnion>UNIV" by (rule Meet_empty)
   also have "\<dots> = dual (\<Sqinter>UNIV)" by (simp add: dual_Meet)
   finally show ?thesis ..
 qed
 
 end
diff --git a/src/HOL/Library/BigO.thy b/src/HOL/Library/BigO.thy
--- a/src/HOL/Library/BigO.thy
+++ b/src/HOL/Library/BigO.thy
@@ -1,797 +1,796 @@
 (*  Title:      HOL/Library/BigO.thy
     Authors:    Jeremy Avigad and Kevin Donnelly
 *)
 
 section \<open>Big O notation\<close>
 
 theory BigO
   imports
     Complex_Main
     Function_Algebras
     Set_Algebras
 begin
 
 text \<open>
   This library is designed to support asymptotic ``big O'' calculations,
   i.e.~reasoning with expressions of the form \<open>f = O(g)\<close> and \<open>f = g + O(h)\<close>.
-  An earlier version of this library is described in detail in @{cite
-  "Avigad-Donnelly"}.
+  An earlier version of this library is described in detail in \<^cite>\<open>"Avigad-Donnelly"\<close>.
 
   The main changes in this version are as follows:
 
     \<^item> We have eliminated the \<open>O\<close> operator on sets. (Most uses of this seem
       to be inessential.)
     \<^item> We no longer use \<open>+\<close> as output syntax for \<open>+o\<close>
     \<^item> Lemmas involving \<open>sumr\<close> have been replaced by more general lemmas
       involving `\<open>sum\<close>.
     \<^item> The library has been expanded, with e.g.~support for expressions of
       the form \<open>f < g + O(h)\<close>.
 
   Note also since the Big O library includes rules that demonstrate set
   inclusion, to use the automated reasoners effectively with the library one
   should redeclare the theorem \<open>subsetI\<close> as an intro rule, rather than as an
   \<open>intro!\<close> rule, for example, using \<^theory_text>\<open>declare subsetI [del, intro]\<close>.
 \<close>
 
 
 subsection \<open>Definitions\<close>
 
 definition bigo :: "('a \<Rightarrow> 'b::linordered_idom) \<Rightarrow> ('a \<Rightarrow> 'b) set"  ("(1O'(_'))")
   where "O(f:: 'a \<Rightarrow> 'b) = {h. \<exists>c. \<forall>x. \<bar>h x\<bar> \<le> c * \<bar>f x\<bar>}"
 
 lemma bigo_pos_const:
   "(\<exists>c::'a::linordered_idom. \<forall>x. \<bar>h x\<bar> \<le> c * \<bar>f x\<bar>) \<longleftrightarrow>
     (\<exists>c. 0 < c \<and> (\<forall>x. \<bar>h x\<bar> \<le> c * \<bar>f x\<bar>))"
   by (metis (no_types, opaque_lifting) abs_ge_zero abs_not_less_zero abs_of_nonneg dual_order.trans 
         mult_1 zero_less_abs_iff zero_less_mult_iff zero_less_one)
 
 lemma bigo_alt_def: "O(f) = {h. \<exists>c. 0 < c \<and> (\<forall>x. \<bar>h x\<bar> \<le> c * \<bar>f x\<bar>)}"
   by (auto simp add: bigo_def bigo_pos_const)
 
 lemma bigo_elt_subset [intro]: "f \<in> O(g) \<Longrightarrow> O(f) \<le> O(g)"
   apply (auto simp add: bigo_alt_def)
   by (metis (no_types, opaque_lifting) mult.assoc mult_le_cancel_iff2 order.trans 
       zero_less_mult_iff)
 
 lemma bigo_refl [intro]: "f \<in> O(f)"
   using bigo_def comm_monoid_mult_class.mult_1 dual_order.eq_iff by blast
 
 lemma bigo_zero: "0 \<in> O(g)"
   using bigo_def mult_le_cancel_left1 by fastforce
 
 lemma bigo_zero2: "O(\<lambda>x. 0) = {\<lambda>x. 0}"
   by (auto simp add: bigo_def)
 
 lemma bigo_plus_self_subset [intro]: "O(f) + O(f) \<subseteq> O(f)"
   apply (auto simp add: bigo_alt_def set_plus_def)
   apply (rule_tac x = "c + ca" in exI)
   by (smt (verit, best) abs_triangle_ineq add_mono add_pos_pos comm_semiring_class.distrib dual_order.trans)
 
 lemma bigo_plus_idemp [simp]: "O(f) + O(f) = O(f)"
   by (simp add: antisym bigo_plus_self_subset bigo_zero set_zero_plus2)
 
 lemma bigo_plus_subset [intro]: "O(f + g) \<subseteq> O(f) + O(g)"
   apply (rule subsetI)
   apply (auto simp add: bigo_def bigo_pos_const func_plus set_plus_def)
   apply (subst bigo_pos_const [symmetric])+
   apply (rule_tac x = "\<lambda>n. if \<bar>g n\<bar> \<le> \<bar>f n\<bar> then x n else 0" in exI)
   apply (rule conjI)
    apply (rule_tac x = "c + c" in exI)
    apply (clarsimp)
    apply (subgoal_tac "c * \<bar>f xa + g xa\<bar> \<le> (c + c) * \<bar>f xa\<bar>")
     apply (metis mult_2 order_trans)
    apply (subgoal_tac "c * \<bar>f xa + g xa\<bar> \<le> c * (\<bar>f xa\<bar> + \<bar>g xa\<bar>)")
     apply auto[1]
   using abs_triangle_ineq mult_le_cancel_iff2 apply blast
   apply (simp add: order_less_le)
   apply (rule_tac x = "\<lambda>n. if \<bar>f n\<bar> < \<bar>g n\<bar> then x n else 0" in exI)
   apply (rule conjI)
    apply (rule_tac x = "c + c" in exI)
    apply auto
   apply (subgoal_tac "c * \<bar>f xa + g xa\<bar> \<le> (c + c) * \<bar>g xa\<bar>")
    apply (metis mult_2 order.trans)
   apply simp
   done
 
 lemma bigo_plus_subset2 [intro]: "A \<subseteq> O(f) \<Longrightarrow> B \<subseteq> O(f) \<Longrightarrow> A + B \<subseteq> O(f)"
   using bigo_plus_idemp set_plus_mono2 by blast
 
 lemma bigo_plus_eq: "\<forall>x. 0 \<le> f x \<Longrightarrow> \<forall>x. 0 \<le> g x \<Longrightarrow> O(f + g) = O(f) + O(g)"
   apply (rule equalityI)
    apply (rule bigo_plus_subset)
   apply (simp add: bigo_alt_def set_plus_def func_plus)
   apply clarify
   apply (rule_tac x = "max c ca" in exI)
   apply (rule conjI)
    apply (subgoal_tac "c \<le> max c ca")
     apply linarith
    apply (rule max.cobounded1)
   apply clarify
   apply (drule_tac x = "xa" in spec)+
   apply (subgoal_tac "0 \<le> f xa + g xa")
    apply (simp add: ring_distribs)
    apply (subgoal_tac "\<bar>a xa + b xa\<bar> \<le> \<bar>a xa\<bar> + \<bar>b xa\<bar>")
     apply (subgoal_tac "\<bar>a xa\<bar> + \<bar>b xa\<bar> \<le> max c ca * f xa + max c ca * g xa")
      apply force
     apply (metis add_mono le_max_iff_disj max_mult_distrib_right)
   using abs_triangle_ineq apply blast
   using add_nonneg_nonneg by blast
 
 lemma bigo_bounded_alt: "\<forall>x. 0 \<le> f x \<Longrightarrow> \<forall>x. f x \<le> c * g x \<Longrightarrow> f \<in> O(g)"
   apply (auto simp add: bigo_def)
   apply (rule_tac x = "\<bar>c\<bar>" in exI)
   apply auto
   apply (drule_tac x = x in spec)+
   apply (simp flip: abs_mult)
   done
 
 lemma bigo_bounded: "\<forall>x. 0 \<le> f x \<Longrightarrow> \<forall>x. f x \<le> g x \<Longrightarrow> f \<in> O(g)"
   apply (erule bigo_bounded_alt [of f 1 g])
   apply simp
   done
 
 lemma bigo_bounded2: "\<forall>x. lb x \<le> f x \<Longrightarrow> \<forall>x. f x \<le> lb x + g x \<Longrightarrow> f \<in> lb +o O(g)"
   apply (rule set_minus_imp_plus)
   apply (rule bigo_bounded)
    apply (auto simp add: fun_Compl_def func_plus)
   apply (drule_tac x = x in spec)+
   apply force
   done
 
 lemma bigo_abs: "(\<lambda>x. \<bar>f x\<bar>) =o O(f)"
   apply (unfold bigo_def)
   apply auto
   apply (rule_tac x = 1 in exI)
   apply auto
   done
 
 lemma bigo_abs2: "f =o O(\<lambda>x. \<bar>f x\<bar>)"
   apply (unfold bigo_def)
   apply auto
   apply (rule_tac x = 1 in exI)
   apply auto
   done
 
 lemma bigo_abs3: "O(f) = O(\<lambda>x. \<bar>f x\<bar>)"
   apply (rule equalityI)
    apply (rule bigo_elt_subset)
    apply (rule bigo_abs2)
   apply (rule bigo_elt_subset)
   apply (rule bigo_abs)
   done
 
 lemma bigo_abs4: "f =o g +o O(h) \<Longrightarrow> (\<lambda>x. \<bar>f x\<bar>) =o (\<lambda>x. \<bar>g x\<bar>) +o O(h)"
   apply (drule set_plus_imp_minus)
   apply (rule set_minus_imp_plus)
   apply (subst fun_diff_def)
 proof -
   assume *: "f - g \<in> O(h)"
   have "(\<lambda>x. \<bar>f x\<bar> - \<bar>g x\<bar>) =o O(\<lambda>x. \<bar>\<bar>f x\<bar> - \<bar>g x\<bar>\<bar>)"
     by (rule bigo_abs2)
   also have "\<dots> \<subseteq> O(\<lambda>x. \<bar>f x - g x\<bar>)"
     apply (rule bigo_elt_subset)
     apply (rule bigo_bounded)
      apply force
     apply (rule allI)
     apply (rule abs_triangle_ineq3)
     done
   also have "\<dots> \<subseteq> O(f - g)"
     apply (rule bigo_elt_subset)
     apply (subst fun_diff_def)
     apply (rule bigo_abs)
     done
   also from * have "\<dots> \<subseteq> O(h)"
     by (rule bigo_elt_subset)
   finally show "(\<lambda>x. \<bar>f x\<bar> - \<bar>g x\<bar>) \<in> O(h)".
 qed
 
 lemma bigo_abs5: "f =o O(g) \<Longrightarrow> (\<lambda>x. \<bar>f x\<bar>) =o O(g)"
   by (auto simp: bigo_def)
 
 lemma bigo_elt_subset2 [intro]:
   assumes *: "f \<in> g +o O(h)"
   shows "O(f) \<subseteq> O(g) + O(h)"
 proof -
   note *
   also have "g +o O(h) \<subseteq> O(g) + O(h)"
     by (auto del: subsetI)
   also have "\<dots> = O(\<lambda>x. \<bar>g x\<bar>) + O(\<lambda>x. \<bar>h x\<bar>)"
     by (subst bigo_abs3 [symmetric])+ (rule refl)
   also have "\<dots> = O((\<lambda>x. \<bar>g x\<bar>) + (\<lambda>x. \<bar>h x\<bar>))"
     by (rule bigo_plus_eq [symmetric]) auto
   finally have "f \<in> \<dots>" .
   then have "O(f) \<subseteq> \<dots>"
     by (elim bigo_elt_subset)
   also have "\<dots> = O(\<lambda>x. \<bar>g x\<bar>) + O(\<lambda>x. \<bar>h x\<bar>)"
     by (rule bigo_plus_eq, auto)
   finally show ?thesis
     by (simp flip: bigo_abs3)
 qed
 
 lemma bigo_mult [intro]: "O(f)*O(g) \<subseteq> O(f * g)"
   apply (rule subsetI)
   apply (subst bigo_def)
   apply (auto simp add: bigo_alt_def set_times_def func_times)
   apply (rule_tac x = "c * ca" in exI)
   apply (rule allI)
   apply (erule_tac x = x in allE)+
   apply (subgoal_tac "c * ca * \<bar>f x * g x\<bar> = (c * \<bar>f x\<bar>) * (ca * \<bar>g x\<bar>)")
    apply (erule ssubst)
    apply (subst abs_mult)
    apply (rule mult_mono)
       apply assumption+
     apply auto
   apply (simp add: ac_simps abs_mult)
   done
 
 lemma bigo_mult2 [intro]: "f *o O(g) \<subseteq> O(f * g)"
   apply (auto simp add: bigo_def elt_set_times_def func_times abs_mult)
   apply (rule_tac x = c in exI)
   apply auto
   apply (drule_tac x = x in spec)
   apply (subgoal_tac "\<bar>f x\<bar> * \<bar>b x\<bar> \<le> \<bar>f x\<bar> * (c * \<bar>g x\<bar>)")
    apply (force simp add: ac_simps)
   apply (rule mult_left_mono, assumption)
   apply (rule abs_ge_zero)
   done
 
 lemma bigo_mult3: "f \<in> O(h) \<Longrightarrow> g \<in> O(j) \<Longrightarrow> f * g \<in> O(h * j)"
   apply (rule subsetD)
    apply (rule bigo_mult)
   apply (erule set_times_intro, assumption)
   done
 
 lemma bigo_mult4 [intro]: "f \<in> k +o O(h) \<Longrightarrow> g * f \<in> (g * k) +o O(g * h)"
   apply (drule set_plus_imp_minus)
   apply (rule set_minus_imp_plus)
   apply (drule bigo_mult3 [where g = g and j = g])
    apply (auto simp add: algebra_simps)
   done
 
 lemma bigo_mult5:
   fixes f :: "'a \<Rightarrow> 'b::linordered_field"
   assumes "\<forall>x. f x \<noteq> 0"
   shows "O(f * g) \<subseteq> f *o O(g)"
 proof
   fix h
   assume "h \<in> O(f * g)"
   then have "(\<lambda>x. 1 / (f x)) * h \<in> (\<lambda>x. 1 / f x) *o O(f * g)"
     by auto
   also have "\<dots> \<subseteq> O((\<lambda>x. 1 / f x) * (f * g))"
     by (rule bigo_mult2)
   also have "(\<lambda>x. 1 / f x) * (f * g) = g"
     apply (simp add: func_times)
     apply (rule ext)
     apply (simp add: assms nonzero_divide_eq_eq ac_simps)
     done
   finally have "(\<lambda>x. (1::'b) / f x) * h \<in> O(g)" .
   then have "f * ((\<lambda>x. (1::'b) / f x) * h) \<in> f *o O(g)"
     by auto
   also have "f * ((\<lambda>x. (1::'b) / f x) * h) = h"
     apply (simp add: func_times)
     apply (rule ext)
     apply (simp add: assms nonzero_divide_eq_eq ac_simps)
     done
   finally show "h \<in> f *o O(g)" .
 qed
 
 lemma bigo_mult6: "\<forall>x. f x \<noteq> 0 \<Longrightarrow> O(f * g) = f *o O(g)"
   for f :: "'a \<Rightarrow> 'b::linordered_field"
   apply (rule equalityI)
    apply (erule bigo_mult5)
   apply (rule bigo_mult2)
   done
 
 lemma bigo_mult7: "\<forall>x. f x \<noteq> 0 \<Longrightarrow> O(f * g) \<subseteq> O(f) * O(g)"
   for f :: "'a \<Rightarrow> 'b::linordered_field"
   apply (subst bigo_mult6)
    apply assumption
   apply (rule set_times_mono3)
   apply (rule bigo_refl)
   done
 
 lemma bigo_mult8: "\<forall>x. f x \<noteq> 0 \<Longrightarrow> O(f * g) = O(f) * O(g)"
   for f :: "'a \<Rightarrow> 'b::linordered_field"
   apply (rule equalityI)
    apply (erule bigo_mult7)
   apply (rule bigo_mult)
   done
 
 lemma bigo_minus [intro]: "f \<in> O(g) \<Longrightarrow> - f \<in> O(g)"
   by (auto simp add: bigo_def fun_Compl_def)
 
 lemma bigo_minus2: "f \<in> g +o O(h) \<Longrightarrow> - f \<in> -g +o O(h)"
   apply (rule set_minus_imp_plus)
   apply (drule set_plus_imp_minus)
   apply (drule bigo_minus)
   apply simp
   done
 
 lemma bigo_minus3: "O(- f) = O(f)"
   by (auto simp add: bigo_def fun_Compl_def)
 
 lemma bigo_plus_absorb_lemma1:
   assumes *: "f \<in> O(g)"
   shows "f +o O(g) \<subseteq> O(g)"
 proof -
   have "f \<in> O(f)" by auto
   then have "f +o O(g) \<subseteq> O(f) + O(g)"
     by (auto del: subsetI)
   also have "\<dots> \<subseteq> O(g) + O(g)"
   proof -
     from * have "O(f) \<subseteq> O(g)"
       by (auto del: subsetI)
     then show ?thesis
       by (auto del: subsetI)
   qed
   also have "\<dots> \<subseteq> O(g)" by simp
   finally show ?thesis .
 qed
 
 lemma bigo_plus_absorb_lemma2:
   assumes *: "f \<in> O(g)"
   shows "O(g) \<subseteq> f +o O(g)"
 proof -
   from * have "- f \<in> O(g)"
     by auto
   then have "- f +o O(g) \<subseteq> O(g)"
     by (elim bigo_plus_absorb_lemma1)
   then have "f +o (- f +o O(g)) \<subseteq> f +o O(g)"
     by auto
   also have "f +o (- f +o O(g)) = O(g)"
     by (simp add: set_plus_rearranges)
   finally show ?thesis .
 qed
 
 lemma bigo_plus_absorb [simp]: "f \<in> O(g) \<Longrightarrow> f +o O(g) = O(g)"
   apply (rule equalityI)
    apply (erule bigo_plus_absorb_lemma1)
   apply (erule bigo_plus_absorb_lemma2)
   done
 
 lemma bigo_plus_absorb2 [intro]: "f \<in> O(g) \<Longrightarrow> A \<subseteq> O(g) \<Longrightarrow> f +o A \<subseteq> O(g)"
   apply (subgoal_tac "f +o A \<subseteq> f +o O(g)")
    apply force+
   done
 
 lemma bigo_add_commute_imp: "f \<in> g +o O(h) \<Longrightarrow> g \<in> f +o O(h)"
   apply (subst set_minus_plus [symmetric])
   apply (subgoal_tac "g - f = - (f - g)")
    apply (erule ssubst)
    apply (rule bigo_minus)
    apply (subst set_minus_plus)
    apply assumption
   apply (simp add: ac_simps)
   done
 
 lemma bigo_add_commute: "f \<in> g +o O(h) \<longleftrightarrow> g \<in> f +o O(h)"
   apply (rule iffI)
    apply (erule bigo_add_commute_imp)+
   done
 
 lemma bigo_const1: "(\<lambda>x. c) \<in> O(\<lambda>x. 1)"
   by (auto simp add: bigo_def ac_simps)
 
 lemma bigo_const2 [intro]: "O(\<lambda>x. c) \<subseteq> O(\<lambda>x. 1)"
   apply (rule bigo_elt_subset)
   apply (rule bigo_const1)
   done
 
 lemma bigo_const3: "c \<noteq> 0 \<Longrightarrow> (\<lambda>x. 1) \<in> O(\<lambda>x. c)"
   for c :: "'a::linordered_field"
   apply (simp add: bigo_def)
   apply (rule_tac x = "\<bar>inverse c\<bar>" in exI)
   apply (simp flip: abs_mult)
   done
 
 lemma bigo_const4: "c \<noteq> 0 \<Longrightarrow> O(\<lambda>x. 1) \<subseteq> O(\<lambda>x. c)"
   for c :: "'a::linordered_field"
   apply (rule bigo_elt_subset)
   apply (rule bigo_const3)
   apply assumption
   done
 
 lemma bigo_const [simp]: "c \<noteq> 0 \<Longrightarrow> O(\<lambda>x. c) = O(\<lambda>x. 1)"
   for c :: "'a::linordered_field"
   apply (rule equalityI)
    apply (rule bigo_const2)
   apply (rule bigo_const4)
   apply assumption
   done
 
 lemma bigo_const_mult1: "(\<lambda>x. c * f x) \<in> O(f)"
   apply (simp add: bigo_def)
   apply (rule_tac x = "\<bar>c\<bar>" in exI)
   apply (auto simp flip: abs_mult)
   done
 
 lemma bigo_const_mult2: "O(\<lambda>x. c * f x) \<subseteq> O(f)"
   apply (rule bigo_elt_subset)
   apply (rule bigo_const_mult1)
   done
 
 lemma bigo_const_mult3: "c \<noteq> 0 \<Longrightarrow> f \<in> O(\<lambda>x. c * f x)"
   for c :: "'a::linordered_field"
   apply (simp add: bigo_def)
   apply (rule_tac x = "\<bar>inverse c\<bar>" in exI)
   apply (simp add: abs_mult mult.assoc [symmetric])
   done
 
 lemma bigo_const_mult4: "c \<noteq> 0 \<Longrightarrow> O(f) \<subseteq> O(\<lambda>x. c * f x)"
   for c :: "'a::linordered_field"
   apply (rule bigo_elt_subset)
   apply (rule bigo_const_mult3)
   apply assumption
   done
 
 lemma bigo_const_mult [simp]: "c \<noteq> 0 \<Longrightarrow> O(\<lambda>x. c * f x) = O(f)"
   for c :: "'a::linordered_field"
   apply (rule equalityI)
    apply (rule bigo_const_mult2)
   apply (erule bigo_const_mult4)
   done
 
 lemma bigo_const_mult5 [simp]: "c \<noteq> 0 \<Longrightarrow> (\<lambda>x. c) *o O(f) = O(f)"
   for c :: "'a::linordered_field"
   apply (auto del: subsetI)
    apply (rule order_trans)
     apply (rule bigo_mult2)
    apply (simp add: func_times)
   apply (auto intro!: simp add: bigo_def elt_set_times_def func_times)
   apply (rule_tac x = "\<lambda>y. inverse c * x y" in exI)
   apply (simp add: mult.assoc [symmetric] abs_mult)
   apply (rule_tac x = "\<bar>inverse c\<bar> * ca" in exI)
   apply auto
   done
 
 lemma bigo_const_mult6 [intro]: "(\<lambda>x. c) *o O(f) \<subseteq> O(f)"
   apply (auto intro!: simp add: bigo_def elt_set_times_def func_times)
   apply (rule_tac x = "ca * \<bar>c\<bar>" in exI)
   apply (rule allI)
   apply (subgoal_tac "ca * \<bar>c\<bar> * \<bar>f x\<bar> = \<bar>c\<bar> * (ca * \<bar>f x\<bar>)")
    apply (erule ssubst)
    apply (subst abs_mult)
    apply (rule mult_left_mono)
     apply (erule spec)
    apply simp
   apply (simp add: ac_simps)
   done
 
 lemma bigo_const_mult7 [intro]:
   assumes *: "f =o O(g)"
   shows "(\<lambda>x. c * f x) =o O(g)"
 proof -
   from * have "(\<lambda>x. c) * f =o (\<lambda>x. c) *o O(g)"
     by auto
   also have "(\<lambda>x. c) * f = (\<lambda>x. c * f x)"
     by (simp add: func_times)
   also have "(\<lambda>x. c) *o O(g) \<subseteq> O(g)"
     by (auto del: subsetI)
   finally show ?thesis .
 qed
 
 lemma bigo_compose1: "f =o O(g) \<Longrightarrow> (\<lambda>x. f (k x)) =o O(\<lambda>x. g (k x))"
   by (auto simp: bigo_def)
 
 lemma bigo_compose2: "f =o g +o O(h) \<Longrightarrow> (\<lambda>x. f (k x)) =o (\<lambda>x. g (k x)) +o O(\<lambda>x. h(k x))"
   apply (simp only: set_minus_plus [symmetric] fun_Compl_def func_plus)
   apply (drule bigo_compose1)
   apply (simp add: fun_diff_def)
   done
 
 
 subsection \<open>Sum\<close>
 
 lemma bigo_sum_main: "\<forall>x. \<forall>y \<in> A x. 0 \<le> h x y \<Longrightarrow>
     \<exists>c. \<forall>x. \<forall>y \<in> A x. \<bar>f x y\<bar> \<le> c * h x y \<Longrightarrow>
       (\<lambda>x. \<Sum>y \<in> A x. f x y) =o O(\<lambda>x. \<Sum>y \<in> A x. h x y)"
   apply (auto simp add: bigo_def)
   apply (rule_tac x = "\<bar>c\<bar>" in exI)
   apply (subst abs_of_nonneg) back back
    apply (rule sum_nonneg)
    apply force
   apply (subst sum_distrib_left)
   apply (rule allI)
   apply (rule order_trans)
    apply (rule sum_abs)
   apply (rule sum_mono)
   apply (rule order_trans)
    apply (drule spec)+
    apply (drule bspec)+
      apply assumption+
    apply (drule bspec)
     apply assumption+
   apply (rule mult_right_mono)
    apply (rule abs_ge_self)
   apply force
   done
 
 lemma bigo_sum1: "\<forall>x y. 0 \<le> h x y \<Longrightarrow>
     \<exists>c. \<forall>x y. \<bar>f x y\<bar> \<le> c * h x y \<Longrightarrow>
       (\<lambda>x. \<Sum>y \<in> A x. f x y) =o O(\<lambda>x. \<Sum>y \<in> A x. h x y)"
   apply (rule bigo_sum_main)
    apply force
   apply clarsimp
   apply (rule_tac x = c in exI)
   apply force
   done
 
 lemma bigo_sum2: "\<forall>y. 0 \<le> h y \<Longrightarrow>
     \<exists>c. \<forall>y. \<bar>f y\<bar> \<le> c * (h y) \<Longrightarrow>
       (\<lambda>x. \<Sum>y \<in> A x. f y) =o O(\<lambda>x. \<Sum>y \<in> A x. h y)"
   by (rule bigo_sum1) auto
 
 lemma bigo_sum3: "f =o O(h) \<Longrightarrow>
     (\<lambda>x. \<Sum>y \<in> A x. l x y * f (k x y)) =o O(\<lambda>x. \<Sum>y \<in> A x. \<bar>l x y * h (k x y)\<bar>)"
   apply (rule bigo_sum1)
    apply (rule allI)+
    apply (rule abs_ge_zero)
   apply (unfold bigo_def)
   apply auto
   apply (rule_tac x = c in exI)
   apply (rule allI)+
   apply (subst abs_mult)+
   apply (subst mult.left_commute)
   apply (rule mult_left_mono)
    apply (erule spec)
   apply (rule abs_ge_zero)
   done
 
 lemma bigo_sum4: "f =o g +o O(h) \<Longrightarrow>
     (\<lambda>x. \<Sum>y \<in> A x. l x y * f (k x y)) =o
       (\<lambda>x. \<Sum>y \<in> A x. l x y * g (k x y)) +o
         O(\<lambda>x. \<Sum>y \<in> A x. \<bar>l x y * h (k x y)\<bar>)"
   apply (rule set_minus_imp_plus)
   apply (subst fun_diff_def)
   apply (subst sum_subtractf [symmetric])
   apply (subst right_diff_distrib [symmetric])
   apply (rule bigo_sum3)
   apply (subst fun_diff_def [symmetric])
   apply (erule set_plus_imp_minus)
   done
 
 lemma bigo_sum5: "f =o O(h) \<Longrightarrow> \<forall>x y. 0 \<le> l x y \<Longrightarrow>
     \<forall>x. 0 \<le> h x \<Longrightarrow>
       (\<lambda>x. \<Sum>y \<in> A x. l x y * f (k x y)) =o
         O(\<lambda>x. \<Sum>y \<in> A x. l x y * h (k x y))"
   apply (subgoal_tac "(\<lambda>x. \<Sum>y \<in> A x. l x y * h (k x y)) =
       (\<lambda>x. \<Sum>y \<in> A x. \<bar>l x y * h (k x y)\<bar>)")
    apply (erule ssubst)
    apply (erule bigo_sum3)
   apply (rule ext)
   apply (rule sum.cong)
    apply (rule refl)
   apply (subst abs_of_nonneg)
    apply auto
   done
 
 lemma bigo_sum6: "f =o g +o O(h) \<Longrightarrow> \<forall>x y. 0 \<le> l x y \<Longrightarrow>
     \<forall>x. 0 \<le> h x \<Longrightarrow>
       (\<lambda>x. \<Sum>y \<in> A x. l x y * f (k x y)) =o
         (\<lambda>x. \<Sum>y \<in> A x. l x y * g (k x y)) +o
           O(\<lambda>x. \<Sum>y \<in> A x. l x y * h (k x y))"
   apply (rule set_minus_imp_plus)
   apply (subst fun_diff_def)
   apply (subst sum_subtractf [symmetric])
   apply (subst right_diff_distrib [symmetric])
   apply (rule bigo_sum5)
     apply (subst fun_diff_def [symmetric])
     apply (drule set_plus_imp_minus)
     apply auto
   done
 
 
 subsection \<open>Misc useful stuff\<close>
 
 lemma bigo_useful_intro: "A \<subseteq> O(f) \<Longrightarrow> B \<subseteq> O(f) \<Longrightarrow> A + B \<subseteq> O(f)"
   apply (subst bigo_plus_idemp [symmetric])
   apply (rule set_plus_mono2)
    apply assumption+
   done
 
 lemma bigo_useful_add: "f =o O(h) \<Longrightarrow> g =o O(h) \<Longrightarrow> f + g =o O(h)"
   apply (subst bigo_plus_idemp [symmetric])
   apply (rule set_plus_intro)
    apply assumption+
   done
 
 lemma bigo_useful_const_mult: "c \<noteq> 0 \<Longrightarrow> (\<lambda>x. c) * f =o O(h) \<Longrightarrow> f =o O(h)"
   for c :: "'a::linordered_field"
   apply (rule subsetD)
    apply (subgoal_tac "(\<lambda>x. 1 / c) *o O(h) \<subseteq> O(h)")
     apply assumption
    apply (rule bigo_const_mult6)
   apply (subgoal_tac "f = (\<lambda>x. 1 / c) * ((\<lambda>x. c) * f)")
    apply (erule ssubst)
    apply (erule set_times_intro2)
   apply (simp add: func_times)
   done
 
 lemma bigo_fix: "(\<lambda>x::nat. f (x + 1)) =o O(\<lambda>x. h (x + 1)) \<Longrightarrow> f 0 = 0 \<Longrightarrow> f =o O(h)"
   apply (simp add: bigo_alt_def)
   apply auto
   apply (rule_tac x = c in exI)
   apply auto
   apply (case_tac "x = 0")
    apply simp
   apply (subgoal_tac "x = Suc (x - 1)")
    apply (erule ssubst) back
    apply (erule spec)
   apply simp
   done
 
 lemma bigo_fix2:
     "(\<lambda>x. f ((x::nat) + 1)) =o (\<lambda>x. g(x + 1)) +o O(\<lambda>x. h(x + 1)) \<Longrightarrow>
        f 0 = g 0 \<Longrightarrow> f =o g +o O(h)"
   apply (rule set_minus_imp_plus)
   apply (rule bigo_fix)
    apply (subst fun_diff_def)
    apply (subst fun_diff_def [symmetric])
    apply (rule set_plus_imp_minus)
    apply simp
   apply (simp add: fun_diff_def)
   done
 
 
 subsection \<open>Less than or equal to\<close>
 
 definition lesso :: "('a \<Rightarrow> 'b::linordered_idom) \<Rightarrow> ('a \<Rightarrow> 'b) \<Rightarrow> 'a \<Rightarrow> 'b"  (infixl "<o" 70)
   where "f <o g = (\<lambda>x. max (f x - g x) 0)"
 
 lemma bigo_lesseq1: "f =o O(h) \<Longrightarrow> \<forall>x. \<bar>g x\<bar> \<le> \<bar>f x\<bar> \<Longrightarrow> g =o O(h)"
   apply (unfold bigo_def)
   apply clarsimp
   apply (rule_tac x = c in exI)
   apply (rule allI)
   apply (rule order_trans)
    apply (erule spec)+
   done
 
 lemma bigo_lesseq2: "f =o O(h) \<Longrightarrow> \<forall>x. \<bar>g x\<bar> \<le> f x \<Longrightarrow> g =o O(h)"
   apply (erule bigo_lesseq1)
   apply (rule allI)
   apply (drule_tac x = x in spec)
   apply (rule order_trans)
    apply assumption
   apply (rule abs_ge_self)
   done
 
 lemma bigo_lesseq3: "f =o O(h) \<Longrightarrow> \<forall>x. 0 \<le> g x \<Longrightarrow> \<forall>x. g x \<le> f x \<Longrightarrow> g =o O(h)"
   apply (erule bigo_lesseq2)
   apply (rule allI)
   apply (subst abs_of_nonneg)
    apply (erule spec)+
   done
 
 lemma bigo_lesseq4: "f =o O(h) \<Longrightarrow>
     \<forall>x. 0 \<le> g x \<Longrightarrow> \<forall>x. g x \<le> \<bar>f x\<bar> \<Longrightarrow> g =o O(h)"
   apply (erule bigo_lesseq1)
   apply (rule allI)
   apply (subst abs_of_nonneg)
    apply (erule spec)+
   done
 
 lemma bigo_lesso1: "\<forall>x. f x \<le> g x \<Longrightarrow> f <o g =o O(h)"
   apply (unfold lesso_def)
   apply (subgoal_tac "(\<lambda>x. max (f x - g x) 0) = 0")
    apply (erule ssubst)
    apply (rule bigo_zero)
   apply (unfold func_zero)
   apply (rule ext)
   apply (simp split: split_max)
   done
 
 lemma bigo_lesso2: "f =o g +o O(h) \<Longrightarrow> \<forall>x. 0 \<le> k x \<Longrightarrow> \<forall>x. k x \<le> f x \<Longrightarrow> k <o g =o O(h)"
   apply (unfold lesso_def)
   apply (rule bigo_lesseq4)
     apply (erule set_plus_imp_minus)
    apply (rule allI)
    apply (rule max.cobounded2)
   apply (rule allI)
   apply (subst fun_diff_def)
   apply (case_tac "0 \<le> k x - g x")
    apply simp
    apply (subst abs_of_nonneg)
     apply (drule_tac x = x in spec) back
     apply (simp add: algebra_simps)
    apply (subst diff_conv_add_uminus)+
    apply (rule add_right_mono)
    apply (erule spec)
   apply (rule order_trans)
    prefer 2
    apply (rule abs_ge_zero)
   apply (simp add: algebra_simps)
   done
 
 lemma bigo_lesso3: "f =o g +o O(h) \<Longrightarrow> \<forall>x. 0 \<le> k x \<Longrightarrow> \<forall>x. g x \<le> k x \<Longrightarrow> f <o k =o O(h)"
   apply (unfold lesso_def)
   apply (rule bigo_lesseq4)
     apply (erule set_plus_imp_minus)
    apply (rule allI)
    apply (rule max.cobounded2)
   apply (rule allI)
   apply (subst fun_diff_def)
   apply (case_tac "0 \<le> f x - k x")
    apply simp
    apply (subst abs_of_nonneg)
     apply (drule_tac x = x in spec) back
     apply (simp add: algebra_simps)
    apply (subst diff_conv_add_uminus)+
    apply (rule add_left_mono)
    apply (rule le_imp_neg_le)
    apply (erule spec)
   apply (rule order_trans)
    prefer 2
    apply (rule abs_ge_zero)
   apply (simp add: algebra_simps)
   done
 
 lemma bigo_lesso4: "f <o g =o O(k) \<Longrightarrow> g =o h +o O(k) \<Longrightarrow> f <o h =o O(k)"
   for k :: "'a \<Rightarrow> 'b::linordered_field"
   apply (unfold lesso_def)
   apply (drule set_plus_imp_minus)
   apply (drule bigo_abs5) back
   apply (simp add: fun_diff_def)
   apply (drule bigo_useful_add)
    apply assumption
   apply (erule bigo_lesseq2) back
   apply (rule allI)
   apply (auto simp add: func_plus fun_diff_def algebra_simps split: split_max abs_split)
   done
 
 lemma bigo_lesso5: "f <o g =o O(h) \<Longrightarrow> \<exists>C. \<forall>x. f x \<le> g x + C * \<bar>h x\<bar>"
   apply (simp only: lesso_def bigo_alt_def)
   apply clarsimp
   apply (rule_tac x = c in exI)
   apply (rule allI)
   apply (drule_tac x = x in spec)
   apply (subgoal_tac "\<bar>max (f x - g x) 0\<bar> = max (f x - g x) 0")
    apply (clarsimp simp add: algebra_simps)
   apply (rule abs_of_nonneg)
   apply (rule max.cobounded2)
   done
 
 lemma lesso_add: "f <o g =o O(h) \<Longrightarrow> k <o l =o O(h) \<Longrightarrow> (f + k) <o (g + l) =o O(h)"
   apply (unfold lesso_def)
   apply (rule bigo_lesseq3)
     apply (erule bigo_useful_add)
     apply assumption
    apply (force split: split_max)
   apply (auto split: split_max simp add: func_plus)
   done
 
 lemma bigo_LIMSEQ1: "f =o O(g) \<Longrightarrow> g \<longlonglongrightarrow> 0 \<Longrightarrow> f \<longlonglongrightarrow> 0"
   for f g :: "nat \<Rightarrow> real"
   apply (simp add: LIMSEQ_iff bigo_alt_def)
   apply clarify
   apply (drule_tac x = "r / c" in spec)
   apply (drule mp)
    apply simp
   apply clarify
   apply (rule_tac x = no in exI)
   apply (rule allI)
   apply (drule_tac x = n in spec)+
   apply (rule impI)
   apply (drule mp)
    apply assumption
   apply (rule order_le_less_trans)
    apply assumption
   apply (rule order_less_le_trans)
    apply (subgoal_tac "c * \<bar>g n\<bar> < c * (r / c)")
     apply assumption
    apply (erule mult_strict_left_mono)
    apply assumption
   apply simp
   done
 
 lemma bigo_LIMSEQ2: "f =o g +o O(h) \<Longrightarrow> h \<longlonglongrightarrow> 0 \<Longrightarrow> f \<longlonglongrightarrow> a \<Longrightarrow> g \<longlonglongrightarrow> a"
   for f g h :: "nat \<Rightarrow> real"
   apply (drule set_plus_imp_minus)
   apply (drule bigo_LIMSEQ1)
    apply assumption
   apply (simp only: fun_diff_def)
   apply (erule Lim_transform2)
   apply assumption
   done
 
 end
diff --git a/src/HOL/Library/Code_Lazy.thy b/src/HOL/Library/Code_Lazy.thy
--- a/src/HOL/Library/Code_Lazy.thy
+++ b/src/HOL/Library/Code_Lazy.thy
@@ -1,238 +1,238 @@
 (* Author: Pascal Stoop, ETH Zurich
    Author: Andreas Lochbihler, Digital Asset *)
 
 section \<open>Lazy types in generated code\<close>
 
 theory Code_Lazy
 imports Case_Converter
 keywords
   "code_lazy_type"
   "activate_lazy_type"
   "deactivate_lazy_type"
   "activate_lazy_types"
   "deactivate_lazy_types"
   "print_lazy_types" :: thy_decl
 begin
 
 text \<open>
-  This theory and the CodeLazy tool described in @{cite "LochbihlerStoop2018"}.
+  This theory and the CodeLazy tool described in \<^cite>\<open>"LochbihlerStoop2018"\<close>.
 
   It hooks into Isabelle's code generator such that the generated code evaluates a user-specified
   set of type constructors lazily, even in target languages with eager evaluation.
   The lazy type must be algebraic, i.e., values must be built from constructors and a
   corresponding case operator decomposes them. Every datatype and codatatype is algebraic
   and thus eligible for lazification.
 \<close>
 
 subsection \<open>The type \<open>lazy\<close>\<close>
 
 typedef 'a lazy = "UNIV :: 'a set" ..
 setup_lifting type_definition_lazy
 lift_definition delay :: "(unit \<Rightarrow> 'a) \<Rightarrow> 'a lazy"  is "\<lambda>f. f ()" .
 lift_definition force :: "'a lazy \<Rightarrow> 'a" is "\<lambda>x. x" .
 
 code_datatype delay
 lemma force_delay [code]: "force (delay f) = f ()" by transfer (rule refl)
 lemma delay_force: "delay (\<lambda>_. force s) = s" by transfer (rule refl)
 
 definition termify_lazy2 :: "'a :: typerep lazy \<Rightarrow> term"
   where "termify_lazy2 x =
   Code_Evaluation.App (Code_Evaluation.Const (STR ''Code_Lazy.delay'') (TYPEREP((unit \<Rightarrow> 'a) \<Rightarrow> 'a lazy)))
     (Code_Evaluation.Const (STR ''Pure.dummy_pattern'') (TYPEREP((unit \<Rightarrow> 'a))))"
 
 definition termify_lazy ::
   "(String.literal \<Rightarrow> 'typerep \<Rightarrow> 'term) \<Rightarrow>
    ('term \<Rightarrow> 'term \<Rightarrow> 'term) \<Rightarrow>
    (String.literal \<Rightarrow> 'typerep \<Rightarrow> 'term \<Rightarrow> 'term) \<Rightarrow>
    'typerep \<Rightarrow> ('typerep \<Rightarrow> 'typerep \<Rightarrow> 'typerep) \<Rightarrow> ('typerep \<Rightarrow> 'typerep) \<Rightarrow>
    ('a \<Rightarrow> 'term) \<Rightarrow> 'typerep \<Rightarrow> 'a :: typerep lazy \<Rightarrow> 'term \<Rightarrow> term"
   where "termify_lazy _ _ _ _ _ _ _ _ x _ = termify_lazy2 x"
 
 declare [[code drop: "Code_Evaluation.term_of :: _ lazy \<Rightarrow> _"]]
 
 lemma term_of_lazy_code [code]:
   "Code_Evaluation.term_of x \<equiv>
    termify_lazy
      Code_Evaluation.Const Code_Evaluation.App Code_Evaluation.Abs
      TYPEREP(unit) (\<lambda>T U. typerep.Typerep (STR ''fun'') [T, U]) (\<lambda>T. typerep.Typerep (STR ''Code_Lazy.lazy'') [T])
      Code_Evaluation.term_of TYPEREP('a) x (Code_Evaluation.Const (STR '''') (TYPEREP(unit)))"
   for x :: "'a :: {typerep, term_of} lazy"
   by (rule term_of_anything)
 
 text \<open>
   The implementations of \<^typ>\<open>_ lazy\<close> using language primitives cache forced values.
 
   Term reconstruction for lazy looks into the lazy value and reconstructs it to the depth it has been evaluated.
   This is not done for Haskell as we do not know of any portable way to inspect whether a lazy value
   has been evaluated to or not.
 \<close>
 
 code_printing code_module Lazy \<rightharpoonup> (SML)
 \<open>signature LAZY =
 sig
   type 'a lazy;
   val lazy : (unit -> 'a) -> 'a lazy;
   val force : 'a lazy -> 'a;
   val peek : 'a lazy -> 'a option
   val termify_lazy : 
    (string -> 'typerep -> 'term) -> 
    ('term -> 'term -> 'term) -> 
    (string -> 'typerep -> 'term -> 'term) ->
    'typerep -> ('typerep -> 'typerep -> 'typerep) -> ('typerep -> 'typerep) ->
    ('a -> 'term) -> 'typerep -> 'a lazy -> 'term -> 'term;
 end;
 
 structure Lazy : LAZY = 
 struct
 
 datatype 'a content =
    Delay of unit -> 'a
  | Value of 'a 
  | Exn of exn;
 
 datatype 'a lazy = Lazy of 'a content ref;
 
 fun lazy f = Lazy (ref (Delay f));
 
 fun force (Lazy x) = case !x of
    Delay f => (
      let val res = f (); val _ = x := Value res; in res end
      handle exn => (x := Exn exn; raise exn))
   | Value x => x
   | Exn exn => raise exn;
 
 fun peek (Lazy x) = case !x of
     Value x => SOME x
   | _ => NONE;
 
 fun termify_lazy const app abs unitT funT lazyT term_of T x _ =
   app (const "Code_Lazy.delay" (funT (funT unitT T) (lazyT T))) 
     (case peek x of SOME y => abs "_" unitT (term_of y)
      | _ => const "Pure.dummy_pattern" (funT unitT T));
 
 end;\<close> for type_constructor lazy constant delay force termify_lazy
 | type_constructor lazy \<rightharpoonup> (SML) "_ Lazy.lazy"
 | constant delay \<rightharpoonup> (SML) "Lazy.lazy"
 | constant force \<rightharpoonup> (SML) "Lazy.force"
 | constant termify_lazy \<rightharpoonup> (SML) "Lazy.termify'_lazy"
 
 code_reserved SML Lazy
 
 code_printing \<comment> \<open>For code generation within the Isabelle environment, we reuse the thread-safe
   implementation of lazy from \<^file>\<open>~~/src/Pure/Concurrent/lazy.ML\<close>\<close>
   code_module Lazy \<rightharpoonup> (Eval) \<open>\<close> for constant undefined
 | type_constructor lazy \<rightharpoonup> (Eval) "_ Lazy.lazy"
 | constant delay \<rightharpoonup> (Eval) "Lazy.lazy"
 | constant force \<rightharpoonup> (Eval) "Lazy.force"
 | code_module Termify_Lazy \<rightharpoonup> (Eval)
 \<open>structure Termify_Lazy = struct
 fun termify_lazy
   (_: string -> typ -> term) (_: term -> term -> term)  (_: string -> typ -> term -> term)
   (_: typ) (_: typ -> typ -> typ) (_: typ -> typ)
   (term_of: 'a -> term) (T: typ) (x: 'a Lazy.lazy) (_: term) =
   Const ("Code_Lazy.delay", (HOLogic.unitT --> T) --> Type ("Code_Lazy.lazy", [T])) $
   (case Lazy.peek x of
     SOME (Exn.Res x) => absdummy HOLogic.unitT (term_of x)
   | _ => Const ("Pure.dummy_pattern", HOLogic.unitT --> T));
 end;\<close> for constant termify_lazy
 | constant termify_lazy \<rightharpoonup> (Eval) "Termify'_Lazy.termify'_lazy"
 
 code_reserved Eval Termify_Lazy
 
 code_printing
   type_constructor lazy \<rightharpoonup> (OCaml) "_ Lazy.t"
 | constant delay \<rightharpoonup> (OCaml) "Lazy.from'_fun"
 | constant force \<rightharpoonup> (OCaml) "Lazy.force"
 | code_module Termify_Lazy \<rightharpoonup> (OCaml)
 \<open>module Termify_Lazy : sig
   val termify_lazy :
    (string -> 'typerep -> 'term) ->
    ('term -> 'term -> 'term) ->
    (string -> 'typerep -> 'term -> 'term) ->
    'typerep -> ('typerep -> 'typerep -> 'typerep) -> ('typerep -> 'typerep) ->
    ('a -> 'term) -> 'typerep -> 'a Lazy.t -> 'term -> 'term
 end = struct
 
 let termify_lazy const app abs unitT funT lazyT term_of ty x _ =
   app (const "Code_Lazy.delay" (funT (funT unitT ty) (lazyT ty)))
     (if Lazy.is_val x then abs "_" unitT (term_of (Lazy.force x))
      else const "Pure.dummy_pattern" (funT unitT ty));;
 
 end;;\<close> for constant termify_lazy
 | constant termify_lazy \<rightharpoonup> (OCaml) "Termify'_Lazy.termify'_lazy"
 
 code_reserved OCaml Lazy Termify_Lazy
 
 
 code_printing
   code_module Lazy \<rightharpoonup> (Haskell) \<open>
 module Lazy(Lazy, delay, force) where
 
 newtype Lazy a = Lazy a
 delay f = Lazy (f ())
 force (Lazy x) = x\<close> for type_constructor lazy constant delay force
 | type_constructor lazy \<rightharpoonup> (Haskell) "Lazy.Lazy _"
 | constant delay \<rightharpoonup> (Haskell) "Lazy.delay"
 | constant force \<rightharpoonup> (Haskell) "Lazy.force"
 
 code_reserved Haskell Lazy
 
 code_printing
   code_module Lazy \<rightharpoonup> (Scala) 
 \<open>object Lazy {
   final class Lazy[A] (f: Unit => A) {
     var evaluated = false;
     lazy val x: A = f(())
 
     def get() : A = {
       evaluated = true;
       return x
     }
   }
 
   def force[A] (x: Lazy[A]) : A = {
     return x.get()
   }
 
   def delay[A] (f: Unit => A) : Lazy[A] = {
     return new Lazy[A] (f)
   }
 
   def termify_lazy[Typerep, Term, A] (
     const: String => Typerep => Term,
     app: Term => Term => Term,
     abs: String => Typerep => Term => Term,
     unitT: Typerep,
     funT: Typerep => Typerep => Typerep,
     lazyT: Typerep => Typerep,
     term_of: A => Term,
     ty: Typerep,
     x: Lazy[A],
     dummy: Term) : Term = {
     if (x.evaluated)
       app(const("Code_Lazy.delay")(funT(funT(unitT)(ty))(lazyT(ty))))(abs("_")(unitT)(term_of(x.get())))
     else
       app(const("Code_Lazy.delay")(funT(funT(unitT)(ty))(lazyT(ty))))(const("Pure.dummy_pattern")(funT(unitT)(ty)))
   }
 }\<close> for type_constructor lazy constant delay force termify_lazy
 | type_constructor lazy \<rightharpoonup> (Scala) "Lazy.Lazy[_]"
 | constant delay \<rightharpoonup> (Scala) "Lazy.delay"
 | constant force \<rightharpoonup> (Scala) "Lazy.force"
 | constant termify_lazy \<rightharpoonup> (Scala) "Lazy.termify'_lazy"
 
 code_reserved Scala Lazy
 
 text \<open>Make evaluation with the simplifier respect \<^term>\<open>delay\<close>s.\<close>
 
 lemma delay_lazy_cong: "delay f = delay f" by simp
 setup \<open>Code_Simp.map_ss (Simplifier.add_cong @{thm delay_lazy_cong})\<close>        
 
 subsection \<open>Implementation\<close>
 
 ML_file \<open>code_lazy.ML\<close>
 
 setup \<open>
   Code_Preproc.add_functrans ("lazy_datatype", Code_Lazy.transform_code_eqs)
 \<close>
 
 end
diff --git a/src/HOL/Library/Poly_Mapping.thy b/src/HOL/Library/Poly_Mapping.thy
--- a/src/HOL/Library/Poly_Mapping.thy
+++ b/src/HOL/Library/Poly_Mapping.thy
@@ -1,1878 +1,1878 @@
 (* Author: Andreas Lochbihler, ETH Zurich
    Author: Florian Haftmann, TU Muenchen
    with some material ported from HOL Light by LCP
 *)
 
 section \<open>Polynomial mapping: combination of almost everywhere zero functions with an algebraic view\<close>
 
 theory Poly_Mapping
 imports Groups_Big_Fun Fun_Lexorder More_List
 begin
 
 subsection \<open>Preliminary: auxiliary operations for \emph{almost everywhere zero}\<close>
 
 text \<open>
   A central notion for polynomials are functions being \emph{almost everywhere zero}.
   For these we provide some auxiliary definitions and lemmas.
 \<close>
 
 lemma finite_mult_not_eq_zero_leftI:
   fixes f :: "'b \<Rightarrow> 'a :: mult_zero"
   assumes "finite {a. f a \<noteq> 0}"
   shows "finite {a. g a * f a \<noteq> 0}"
 proof -
   have "{a. g a * f a \<noteq> 0} \<subseteq> {a. f a \<noteq> 0}" by auto
   then show ?thesis using assms by (rule finite_subset)
 qed
 
 lemma finite_mult_not_eq_zero_rightI:
   fixes f :: "'b \<Rightarrow> 'a :: mult_zero"
   assumes "finite {a. f a \<noteq> 0}"
   shows "finite {a. f a * g a \<noteq> 0}"
 proof -
   have "{a. f a * g a \<noteq> 0} \<subseteq> {a. f a \<noteq> 0}" by auto
   then show ?thesis using assms by (rule finite_subset)
 qed
 
 lemma finite_mult_not_eq_zero_prodI:
   fixes f g :: "'a \<Rightarrow> 'b::semiring_0"
   assumes "finite {a. f a \<noteq> 0}" (is "finite ?F")
   assumes "finite {b. g b \<noteq> 0}" (is "finite ?G")
   shows "finite {(a, b). f a * g b \<noteq> 0}"
 proof -
   from assms have "finite (?F \<times> ?G)"
     by blast
   then have "finite {(a, b). f a \<noteq> 0 \<and> g b \<noteq> 0}"
     by simp
   then show ?thesis
     by (rule rev_finite_subset) auto
 qed
 
 lemma finite_not_eq_zero_sumI:
   fixes f g :: "'a::monoid_add \<Rightarrow> 'b::semiring_0"
   assumes "finite {a. f a \<noteq> 0}" (is "finite ?F")
   assumes "finite {b. g b \<noteq> 0}" (is "finite ?G")
   shows "finite {a + b | a b. f a \<noteq> 0 \<and> g b \<noteq> 0}" (is "finite ?FG")
 proof -
   from assms have "finite (?F \<times> ?G)"
     by (simp add: finite_cartesian_product_iff)
   then have "finite (case_prod plus ` (?F \<times> ?G))"
     by (rule finite_imageI)
   also have "case_prod plus ` (?F \<times> ?G) = ?FG"
     by auto
   finally show ?thesis
     by simp
 qed
 
 lemma finite_mult_not_eq_zero_sumI:
   fixes f g :: "'a::monoid_add \<Rightarrow> 'b::semiring_0"
   assumes "finite {a. f a \<noteq> 0}"
   assumes "finite {b. g b \<noteq> 0}"
   shows "finite {a + b | a b. f a * g b \<noteq> 0}"
 proof -
   from assms
   have "finite {a + b | a b. f a \<noteq> 0 \<and> g b \<noteq> 0}"
     by (rule finite_not_eq_zero_sumI)
   then show ?thesis
     by (rule rev_finite_subset) (auto dest: mult_not_zero)
 qed
 
 lemma finite_Sum_any_not_eq_zero_weakenI:
   assumes "finite {a. \<exists>b. f a b \<noteq> 0}"
   shows "finite {a. Sum_any (f a) \<noteq> 0}"
 proof -
   have "{a. Sum_any (f a) \<noteq> 0} \<subseteq> {a. \<exists>b. f a b \<noteq> 0}"
     by (auto elim: Sum_any.not_neutral_obtains_not_neutral)
   then show ?thesis using assms by (rule finite_subset)
 qed
 
 context zero
 begin
 
 definition "when" :: "'a \<Rightarrow> bool \<Rightarrow> 'a" (infixl "when" 20)
 where
   "(a when P) = (if P then a else 0)"
 
 text \<open>
   Case distinctions always complicate matters, particularly when
   nested.  The @{const "when"} operation allows to minimise these
   if @{term 0} is the false-case value and makes proof obligations
   much more readable.
 \<close>
 
 lemma "when" [simp]:
   "P \<Longrightarrow> (a when P) = a"
   "\<not> P \<Longrightarrow> (a when P) = 0"
   by (simp_all add: when_def)
 
 lemma when_simps [simp]:
   "(a when True) = a"
   "(a when False) = 0"
   by simp_all
 
 lemma when_cong:
   assumes "P \<longleftrightarrow> Q"
     and "Q \<Longrightarrow> a = b"
   shows "(a when P) = (b when Q)"
   using assms by (simp add: when_def)
 
 lemma zero_when [simp]:
   "(0 when P) = 0"
   by (simp add: when_def)
 
 lemma when_when:
   "(a when P when Q) = (a when P \<and> Q)"
   by (cases Q) simp_all
 
 lemma when_commute:
   "(a when Q when P) = (a when P when Q)"
   by (simp add: when_when conj_commute)
 
 lemma when_neq_zero [simp]:
   "(a when P) \<noteq> 0 \<longleftrightarrow> P \<and> a \<noteq> 0"
   by (cases P) simp_all
 
 end
 
 context monoid_add
 begin
 
 lemma when_add_distrib:
   "(a + b when P) = (a when P) + (b when P)"
   by (simp add: when_def)
 
 end
 
 context semiring_1
 begin
 
 lemma zero_power_eq:
   "0 ^ n = (1 when n = 0)"
   by (simp add: power_0_left)
 
 end
 
 context comm_monoid_add
 begin
 
 lemma Sum_any_when_equal [simp]:
   "(\<Sum>a. (f a when a = b)) = f b"
   by (simp add: when_def)
 
 lemma Sum_any_when_equal' [simp]:
   "(\<Sum>a. (f a when b = a)) = f b"
   by (simp add: when_def)
 
 lemma Sum_any_when_independent:
   "(\<Sum>a. g a when P) = ((\<Sum>a. g a) when P)"
   by (cases P) simp_all
 
 lemma Sum_any_when_dependent_prod_right:
   "(\<Sum>(a, b). g a when b = h a) = (\<Sum>a. g a)"
 proof -
   have "inj_on (\<lambda>a. (a, h a)) {a. g a \<noteq> 0}"
     by (rule inj_onI) auto
   then show ?thesis unfolding Sum_any.expand_set
     by (rule sum.reindex_cong) auto
 qed
 
 lemma Sum_any_when_dependent_prod_left:
   "(\<Sum>(a, b). g b when a = h b) = (\<Sum>b. g b)"
 proof -
   have "(\<Sum>(a, b). g b when a = h b) = (\<Sum>(b, a). g b when a = h b)"
     by (rule Sum_any.reindex_cong [of prod.swap]) (simp_all add: fun_eq_iff)
   then show ?thesis by (simp add: Sum_any_when_dependent_prod_right)
 qed
 
 end
 
 context cancel_comm_monoid_add
 begin
 
 lemma when_diff_distrib:
   "(a - b when P) = (a when P) - (b when P)"
   by (simp add: when_def)
 
 end
 
 context group_add
 begin
 
 lemma when_uminus_distrib:
   "(- a when P) = - (a when P)"
   by (simp add: when_def)
 
 end
 
 context mult_zero
 begin
 
 lemma mult_when:
   "a * (b when P) = (a * b when P)"
   by (cases P) simp_all
 
 lemma when_mult:
   "(a when P) * b = (a * b when P)"
   by (cases P) simp_all
 
 end
 
 
 subsection \<open>Type definition\<close>
 
 text \<open>
   The following type is of central importance:
 \<close>
 
 typedef (overloaded) ('a, 'b) poly_mapping ("(_ \<Rightarrow>\<^sub>0 /_)" [1, 0] 0) =
   "{f :: 'a \<Rightarrow> 'b::zero. finite {x. f x \<noteq> 0}}"
   morphisms lookup Abs_poly_mapping
 proof -
   have "(\<lambda>_::'a. (0 :: 'b)) \<in> ?poly_mapping" by simp
   then show ?thesis by (blast intro!: exI)
 qed
 
 declare lookup_inverse [simp]
 declare lookup_inject [simp]
 
 lemma lookup_Abs_poly_mapping [simp]:
   "finite {x. f x \<noteq> 0} \<Longrightarrow> lookup (Abs_poly_mapping f) = f"
   using Abs_poly_mapping_inverse [of f] by simp
 
 lemma finite_lookup [simp]:
   "finite {k. lookup f k \<noteq> 0}"
   using poly_mapping.lookup [of f] by simp
 
 lemma finite_lookup_nat [simp]:
   fixes f :: "'a \<Rightarrow>\<^sub>0 nat"
   shows "finite {k. 0 < lookup f k}"
   using poly_mapping.lookup [of f] by simp
 
 lemma poly_mapping_eqI:
   assumes "\<And>k. lookup f k = lookup g k"
   shows "f = g"
   using assms unfolding poly_mapping.lookup_inject [symmetric]
   by blast
 
 lemma poly_mapping_eq_iff: "a = b \<longleftrightarrow> lookup a = lookup b"
   by auto
 
 text \<open>
   We model the universe of functions being \emph{almost everywhere zero}
   by means of a separate type @{typ "('a, 'b) poly_mapping"}.
   For convenience we provide a suggestive infix syntax which
   is a variant of the usual function space syntax.  Conversion between both types
   happens through the morphisms
   \begin{quote}
     @{term_type lookup}
   \end{quote}
   \begin{quote}
     @{term_type Abs_poly_mapping}
   \end{quote}
   satisfying
   \begin{quote}
     @{thm lookup_inverse}
   \end{quote}
   \begin{quote}
     @{thm lookup_Abs_poly_mapping}
   \end{quote}
   Luckily, we have rarely to deal with those low-level morphisms explicitly
   but rely on Isabelle's \emph{lifting} package with its method \<open>transfer\<close>
   and its specification tool \<open>lift_definition\<close>.
 \<close>
 
 setup_lifting type_definition_poly_mapping
 code_datatype Abs_poly_mapping\<comment>\<open>FIXME? workaround for preventing \<open>code_abstype\<close> setup\<close>
 
 text \<open>
   @{typ "'a \<Rightarrow>\<^sub>0 'b"} serves distinctive purposes:
   \begin{enumerate}
     \item A clever nesting as @{typ "(nat \<Rightarrow>\<^sub>0 nat) \<Rightarrow>\<^sub>0 'a"}
       later in theory \<open>MPoly\<close> gives a suitable
       representation type for polynomials \emph{almost for free}:
       Interpreting @{typ "nat \<Rightarrow>\<^sub>0 nat"} as a mapping from variable identifiers
       to exponents yields monomials, and the whole type maps monomials
       to coefficients.  Lets call this the \emph{ultimate interpretation}.
     \item A further more specialised type isomorphic to @{typ "nat \<Rightarrow>\<^sub>0 'a"}
       is apt to direct implementation using code generation
-      \cite{Haftmann-Nipkow:2010:code}.
+      \<^cite>\<open>"Haftmann-Nipkow:2010:code"\<close>.
   \end{enumerate}
   Note that despite the names \emph{mapping} and \emph{lookup} suggest something
   implementation-near, it is best to keep @{typ "'a \<Rightarrow>\<^sub>0 'b"} as an abstract
   \emph{algebraic} type
   providing operations like \emph{addition}, \emph{multiplication} without any notion
   of key-order, data structures etc.  This implementations-specific notions are
   easily introduced later for particular implementations but do not provide any
   gain for specifying logical properties of polynomials.
 \<close>
 
 subsection \<open>Additive structure\<close>
 
 text \<open>
   The additive structure covers the usual operations \<open>0\<close>, \<open>+\<close> and
   (unary and binary) \<open>-\<close>.  Recalling the ultimate interpretation, it
   is obvious that these have just lift the corresponding operations on values
   to mappings.
 
   Isabelle has a rich hierarchy of algebraic type classes, and in such situations
   of pointwise lifting a typical pattern is to have instantiations for a considerable
   number of type classes.
 
   The operations themselves are specified using \<open>lift_definition\<close>, where
   the proofs of the \emph{almost everywhere zero} property can be significantly involved.
 
   The @{const lookup} operation is supposed to be usable explicitly (unless in
   other situations where the morphisms between types are somehow internal
   to the \emph{lifting} package).  Hence it is good style to provide explicit rewrite
   rules how @{const lookup} acts on operations immediately.
 \<close>
 
 instantiation poly_mapping :: (type, zero) zero
 begin
 
 lift_definition zero_poly_mapping :: "'a \<Rightarrow>\<^sub>0 'b"
   is "\<lambda>k. 0"
   by simp
 
 instance ..
 
 end
 
 lemma Abs_poly_mapping [simp]: "Abs_poly_mapping (\<lambda>k. 0) = 0"
   by (simp add: zero_poly_mapping.abs_eq)
 
 lemma lookup_zero [simp]: "lookup 0 k = 0"
   by transfer rule
 
 instantiation poly_mapping :: (type, monoid_add) monoid_add
 begin
 
 lift_definition plus_poly_mapping ::
     "('a \<Rightarrow>\<^sub>0 'b) \<Rightarrow> ('a \<Rightarrow>\<^sub>0 'b) \<Rightarrow> 'a \<Rightarrow>\<^sub>0 'b"
   is "\<lambda>f1 f2 k. f1 k + f2 k"
 proof -
   fix f1 f2 :: "'a \<Rightarrow> 'b"
   assume "finite {k. f1 k \<noteq> 0}"
     and "finite {k. f2 k \<noteq> 0}"
   then have "finite ({k. f1 k \<noteq> 0} \<union> {k. f2 k \<noteq> 0})" by auto
   moreover have "{x. f1 x + f2 x \<noteq> 0} \<subseteq> {k. f1 k \<noteq> 0} \<union> {k. f2 k \<noteq> 0}"
     by auto
   ultimately show "finite {x. f1 x + f2 x \<noteq> 0}"
     by (blast intro: finite_subset)
 qed
 
 instance
   by intro_classes (transfer, simp add: fun_eq_iff ac_simps)+
 
 end
 
 lemma lookup_add:
   "lookup (f + g) k = lookup f k + lookup g k"
   by transfer rule
 
 instance poly_mapping :: (type, comm_monoid_add) comm_monoid_add
   by intro_classes (transfer, simp add: fun_eq_iff ac_simps)+
 
 lemma lookup_sum: "lookup (sum pp X) i = sum (\<lambda>x. lookup (pp x) i) X"
   by (induction rule: infinite_finite_induct) (auto simp: lookup_add)
 
 (*instance poly_mapping :: (type, "{monoid_add, cancel_semigroup_add}") cancel_semigroup_add
   by intro_classes (transfer, simp add: fun_eq_iff)+*)
 
 instantiation poly_mapping :: (type, cancel_comm_monoid_add) cancel_comm_monoid_add
 begin
 
 lift_definition minus_poly_mapping :: "('a \<Rightarrow>\<^sub>0 'b) \<Rightarrow> ('a \<Rightarrow>\<^sub>0 'b) \<Rightarrow> 'a \<Rightarrow>\<^sub>0 'b"
   is "\<lambda>f1 f2 k. f1 k - f2 k"
 proof -
   fix f1 f2 :: "'a \<Rightarrow> 'b"
   assume "finite {k. f1 k \<noteq> 0}"
     and "finite {k. f2 k \<noteq> 0}"
   then have "finite ({k. f1 k \<noteq> 0} \<union> {k. f2 k \<noteq> 0})" by auto
   moreover have "{x. f1 x - f2 x \<noteq> 0} \<subseteq> {k. f1 k \<noteq> 0} \<union> {k. f2 k \<noteq> 0}"
     by auto
   ultimately show "finite {x. f1 x - f2 x \<noteq> 0}" by (blast intro: finite_subset)
 qed
 
 instance
   by intro_classes (transfer, simp add: fun_eq_iff diff_diff_add)+
 
 end
 
 instantiation poly_mapping :: (type, ab_group_add) ab_group_add
 begin
 
 lift_definition uminus_poly_mapping :: "('a \<Rightarrow>\<^sub>0 'b) \<Rightarrow> 'a \<Rightarrow>\<^sub>0 'b"
   is uminus
   by simp
 
 
 instance
   by intro_classes (transfer, simp add: fun_eq_iff ac_simps)+
 
 end
 
 lemma lookup_uminus [simp]:
   "lookup (- f) k = - lookup f k"
   by transfer simp
 
 lemma lookup_minus:
   "lookup (f - g) k = lookup f k - lookup g k"
   by transfer rule
 
 
 subsection \<open>Multiplicative structure\<close>
 
 instantiation poly_mapping :: (zero, zero_neq_one) zero_neq_one
 begin
 
 lift_definition one_poly_mapping :: "'a \<Rightarrow>\<^sub>0 'b"
   is "\<lambda>k. 1 when k = 0"
   by simp
 
 instance
   by intro_classes (transfer, simp add: fun_eq_iff)
 
 end
 
 lemma lookup_one:
   "lookup 1 k = (1 when k = 0)"
   by transfer rule
 
 lemma lookup_one_zero [simp]:
   "lookup 1 0 = 1"
   by transfer simp
 
 definition prod_fun :: "('a \<Rightarrow> 'b) \<Rightarrow> ('a \<Rightarrow> 'b) \<Rightarrow> 'a::monoid_add \<Rightarrow> 'b::semiring_0"
 where
   "prod_fun f1 f2 k = (\<Sum>l. f1 l * (\<Sum>q. (f2 q when k = l + q)))"
 
 lemma prod_fun_unfold_prod:
   fixes f g :: "'a :: monoid_add \<Rightarrow> 'b::semiring_0"
   assumes fin_f: "finite {a. f a \<noteq> 0}"
   assumes fin_g: "finite {b. g b \<noteq> 0}"
   shows "prod_fun f g k = (\<Sum>(a, b). f a * g b when k = a + b)"
 proof -
   let ?C = "{a. f a \<noteq> 0} \<times> {b. g b \<noteq> 0}"
   from fin_f fin_g have "finite ?C" by blast
   moreover have "{a. \<exists>b. (f a * g b when k = a + b) \<noteq> 0} \<times>
     {b. \<exists>a. (f a * g b when k = a + b) \<noteq> 0} \<subseteq> {a. f a \<noteq> 0} \<times> {b. g b \<noteq> 0}"
     by auto
   ultimately show ?thesis using fin_g
     by (auto simp add: prod_fun_def
       Sum_any.cartesian_product [of "{a. f a \<noteq> 0} \<times> {b. g b \<noteq> 0}"] Sum_any_right_distrib mult_when)
 qed
 
 lemma finite_prod_fun:
   fixes f1 f2 :: "'a :: monoid_add \<Rightarrow> 'b :: semiring_0"
   assumes fin1: "finite {l. f1 l \<noteq> 0}"
   and fin2: "finite {q. f2 q \<noteq> 0}"
   shows "finite {k. prod_fun f1 f2 k \<noteq> 0}"
 proof -
   have *: "finite {k. (\<exists>l. f1 l \<noteq> 0 \<and> (\<exists>q. f2 q \<noteq> 0 \<and> k = l + q))}"
     using assms by simp
   { fix k l
     have "{q. (f2 q when k = l + q) \<noteq> 0} \<subseteq> {q. f2 q \<noteq> 0 \<and> k = l + q}" by auto
     with fin2 have "sum f2 {q. f2 q \<noteq> 0 \<and> k = l + q} = (\<Sum>q. (f2 q when k = l + q))"
       by (simp add: Sum_any.expand_superset [of "{q. f2 q \<noteq> 0 \<and> k = l + q}"]) }
   note aux = this
   have "{k. (\<Sum>l. f1 l * sum f2 {q. f2 q \<noteq> 0 \<and> k = l + q}) \<noteq> 0}
     \<subseteq> {k. (\<exists>l. f1 l * sum f2 {q. f2 q \<noteq> 0 \<and> k = l + q} \<noteq> 0)}"
     by (auto elim!: Sum_any.not_neutral_obtains_not_neutral)
   also have "\<dots> \<subseteq> {k. (\<exists>l. f1 l \<noteq> 0 \<and> sum f2 {q. f2 q \<noteq> 0 \<and> k = l + q} \<noteq> 0)}"
     by (auto dest: mult_not_zero)
   also have "\<dots> \<subseteq> {k. (\<exists>l. f1 l \<noteq> 0 \<and> (\<exists>q. f2 q \<noteq> 0 \<and> k = l + q))}"
     by (auto elim!: sum.not_neutral_contains_not_neutral)
   finally have "finite {k. (\<Sum>l. f1 l * sum f2 {q. f2 q \<noteq> 0 \<and> k = l + q}) \<noteq> 0}"
     using * by (rule finite_subset)
   with aux have "finite {k. (\<Sum>l. f1 l * (\<Sum>q. (f2 q when k = l + q))) \<noteq> 0}"
     by simp
   with fin2 show ?thesis
    by (simp add: prod_fun_def)
 qed
 
 instantiation poly_mapping :: (monoid_add, semiring_0) semiring_0
 begin
 
 lift_definition times_poly_mapping :: "('a \<Rightarrow>\<^sub>0 'b) \<Rightarrow> ('a \<Rightarrow>\<^sub>0 'b) \<Rightarrow> 'a \<Rightarrow>\<^sub>0 'b"
   is prod_fun
 by(rule finite_prod_fun)
 
 instance
 proof
   fix a b c :: "'a \<Rightarrow>\<^sub>0 'b"
   show "a * b * c = a * (b * c)"
   proof transfer
     fix f g h :: "'a \<Rightarrow> 'b"
     assume fin_f: "finite {a. f a \<noteq> 0}" (is "finite ?F")
     assume fin_g: "finite {b. g b \<noteq> 0}" (is "finite ?G")
     assume fin_h: "finite {c. h c \<noteq> 0}" (is "finite ?H")
     from fin_f fin_g have fin_fg: "finite {(a, b). f a * g b \<noteq> 0}" (is "finite ?FG")
       by (rule finite_mult_not_eq_zero_prodI)
     from fin_g fin_h have fin_gh: "finite {(b, c). g b * h c \<noteq> 0}" (is "finite ?GH")
       by (rule finite_mult_not_eq_zero_prodI)
     from fin_f fin_g have fin_fg': "finite {a + b | a b. f a * g b \<noteq> 0}" (is "finite ?FG'")
       by (rule finite_mult_not_eq_zero_sumI)
     then have fin_fg'': "finite {d. (\<Sum>(a, b). f a * g b when d = a + b) \<noteq> 0}"
       by (auto intro: finite_Sum_any_not_eq_zero_weakenI)
     from fin_g fin_h have fin_gh': "finite {b + c | b c. g b * h c \<noteq> 0}" (is "finite ?GH'")
       by (rule finite_mult_not_eq_zero_sumI)
     then have fin_gh'': "finite {d. (\<Sum>(b, c). g b * h c when d = b + c) \<noteq> 0}"
       by (auto intro: finite_Sum_any_not_eq_zero_weakenI)
     show "prod_fun (prod_fun f g) h = prod_fun f (prod_fun g h)" (is "?lhs = ?rhs")
     proof
       fix k
       from fin_f fin_g fin_h fin_fg''
       have "?lhs k = (\<Sum>(ab, c). (\<Sum>(a, b). f a * g b when ab = a + b) * h c when k = ab + c)"
         by (simp add: prod_fun_unfold_prod)
       also have "\<dots> = (\<Sum>(ab, c). (\<Sum>(a, b). f a * g b * h c when k = ab + c when ab = a + b))"
         apply (subst Sum_any_left_distrib)
         using fin_fg apply (simp add: split_def)
         apply (subst Sum_any_when_independent [symmetric])
         apply (simp add: when_when when_mult mult_when split_def conj_commute)
         done
       also have "\<dots> = (\<Sum>(ab, c, a, b). f a * g b * h c when k = ab + c when ab = a + b)"
         apply (subst Sum_any.cartesian_product2 [of "(?FG' \<times> ?H) \<times> ?FG"])
         apply (auto simp add: finite_cartesian_product_iff fin_fg fin_fg' fin_h dest: mult_not_zero)
         done
       also have "\<dots> = (\<Sum>(ab, c, a, b). f a * g b * h c when k = a + b + c when ab = a + b)"
         by (rule Sum_any.cong) (simp add: split_def when_def)
       also have "\<dots> = (\<Sum>(ab, cab). (case cab of (c, a, b) \<Rightarrow> f a * g b * h c when k = a + b + c)
         when ab = (case cab of (c, a, b) \<Rightarrow> a + b))"
         by (simp add: split_def)
       also have "\<dots> = (\<Sum>(c, a, b). f a * g b * h c when k = a + b + c)"
         by (simp add: Sum_any_when_dependent_prod_left)
       also have "\<dots> = (\<Sum>(bc, cab). (case cab of (c, a, b) \<Rightarrow> f a * g b * h c when k = a + b + c)
         when bc = (case cab of (c, a, b) \<Rightarrow> b + c))"
         by (simp add: Sum_any_when_dependent_prod_left)
       also have "\<dots> = (\<Sum>(bc, c, a, b). f a * g b * h c when k = a + b + c when bc = b + c)"
         by (simp add: split_def)
       also have "\<dots> = (\<Sum>(bc, c, a, b). f a * g b * h c when bc = b + c when k = a + bc)"
         by (rule Sum_any.cong) (simp add: split_def when_def ac_simps)
       also have "\<dots> = (\<Sum>(a, bc, b, c). f a * g b * h c when bc = b + c when k = a + bc)"
       proof -
         have "bij (\<lambda>(a, d, b, c). (d, c, a, b))"
           by (auto intro!: bijI injI surjI [of _ "\<lambda>(d, c, a, b). (a, d, b, c)"] simp add: split_def)
         then show ?thesis
           by (rule Sum_any.reindex_cong) auto
       qed
       also have "\<dots> = (\<Sum>(a, bc). (\<Sum>(b, c). f a * g b * h c when bc = b + c when k = a + bc))"
         apply (subst Sum_any.cartesian_product2 [of "(?F \<times> ?GH') \<times> ?GH"])
         apply (auto simp add: finite_cartesian_product_iff fin_f fin_gh fin_gh' ac_simps dest: mult_not_zero)
         done
       also have "\<dots> = (\<Sum>(a, bc). f a * (\<Sum>(b, c). g b * h c when bc = b + c) when k = a + bc)"
         apply (subst Sum_any_right_distrib)
         using fin_gh apply (simp add: split_def)
         apply (subst Sum_any_when_independent [symmetric])
         apply (simp add: when_when when_mult mult_when split_def ac_simps)
         done
       also from fin_f fin_g fin_h fin_gh''
       have "\<dots> = ?rhs k"
         by (simp add: prod_fun_unfold_prod)
       finally show "?lhs k = ?rhs k" .
     qed
   qed
   show "(a + b) * c = a * c + b * c"
   proof transfer
     fix f g h :: "'a \<Rightarrow> 'b"
     assume fin_f: "finite {k. f k \<noteq> 0}"
     assume fin_g: "finite {k. g k \<noteq> 0}"
     assume fin_h: "finite {k. h k \<noteq> 0}"
     show "prod_fun (\<lambda>k. f k + g k) h = (\<lambda>k. prod_fun f h k + prod_fun g h k)"
       apply (rule ext)
       apply (auto simp add: prod_fun_def algebra_simps)
       apply (subst Sum_any.distrib)
       using fin_f fin_g apply (auto intro: finite_mult_not_eq_zero_rightI)
       done
   qed
   show "a * (b + c) = a * b + a * c"
   proof transfer
     fix f g h :: "'a \<Rightarrow> 'b"
     assume fin_f: "finite {k. f k \<noteq> 0}"
     assume fin_g: "finite {k. g k \<noteq> 0}"
     assume fin_h: "finite {k. h k \<noteq> 0}"
     show "prod_fun f (\<lambda>k. g k + h k) = (\<lambda>k. prod_fun f g k + prod_fun f h k)"
       apply (rule ext)
       apply (auto simp add: prod_fun_def Sum_any.distrib algebra_simps when_add_distrib)
       apply (subst Sum_any.distrib)
       apply (simp_all add: algebra_simps)
       apply (auto intro: fin_g fin_h)
       apply (subst Sum_any.distrib)
       apply (simp_all add: algebra_simps)
       using fin_f apply (rule finite_mult_not_eq_zero_rightI)
       using fin_f apply (rule finite_mult_not_eq_zero_rightI)
       done
   qed
   show "0 * a = 0"
     by transfer (simp add: prod_fun_def [abs_def])
   show "a * 0 = 0"
     by transfer (simp add: prod_fun_def [abs_def])
 qed
 
 end
 
 lemma lookup_mult:
   "lookup (f * g) k = (\<Sum>l. lookup f l * (\<Sum>q. lookup g q when k = l + q))"
   by transfer (simp add: prod_fun_def)
 
 instance poly_mapping :: (comm_monoid_add, comm_semiring_0) comm_semiring_0
 proof
   fix a b c :: "'a \<Rightarrow>\<^sub>0 'b"
   show "a * b = b * a"
   proof transfer
     fix f g :: "'a \<Rightarrow> 'b"
     assume fin_f: "finite {a. f a \<noteq> 0}"
     assume fin_g: "finite {b. g b \<noteq> 0}"
     show "prod_fun f g = prod_fun g f"
     proof
       fix k
       have fin1: "\<And>l. finite {a. (f a when k = l + a) \<noteq> 0}"
         using fin_f by auto
       have fin2: "\<And>l. finite {b. (g b when k = l + b) \<noteq> 0}"
         using fin_g by auto
       from fin_f fin_g have "finite {(a, b). f a \<noteq> 0 \<and> g b \<noteq> 0}" (is "finite ?AB")
         by simp
       show "prod_fun f g k = prod_fun g f k"
         apply (simp add: prod_fun_def)
         apply (subst Sum_any_right_distrib)
         apply (rule fin2)
         apply (subst Sum_any_right_distrib)
          apply (rule fin1)
         apply (subst Sum_any.swap [of ?AB])
         apply (fact \<open>finite ?AB\<close>)
         apply (auto simp add: mult_when ac_simps)
         done
     qed
   qed
   show "(a + b) * c = a * c + b * c"
   proof transfer
     fix f g h :: "'a \<Rightarrow> 'b"
     assume fin_f: "finite {k. f k \<noteq> 0}"
     assume fin_g: "finite {k. g k \<noteq> 0}"
     assume fin_h: "finite {k. h k \<noteq> 0}"
     show "prod_fun (\<lambda>k. f k + g k) h = (\<lambda>k. prod_fun f h k + prod_fun g h k)"
       apply (auto simp add: prod_fun_def fun_eq_iff algebra_simps)
       apply (subst Sum_any.distrib)
       using fin_f apply (rule finite_mult_not_eq_zero_rightI)
       using fin_g apply (rule finite_mult_not_eq_zero_rightI)
       apply simp_all
       done
   qed
 qed
 
 instance poly_mapping :: (monoid_add, semiring_0_cancel) semiring_0_cancel
   ..
 
 instance poly_mapping :: (comm_monoid_add, comm_semiring_0_cancel) comm_semiring_0_cancel
   ..
 
 instance poly_mapping :: (monoid_add, semiring_1) semiring_1
 proof
   fix a :: "'a \<Rightarrow>\<^sub>0 'b"
   show "1 * a = a"
     by transfer (simp add: prod_fun_def [abs_def] when_mult)
   show "a * 1 = a"
     apply transfer
     apply (simp add: prod_fun_def [abs_def] Sum_any_right_distrib Sum_any_left_distrib mult_when)
     apply (subst when_commute)
     apply simp
     done
 qed
 
 instance poly_mapping :: (comm_monoid_add, comm_semiring_1) comm_semiring_1
 proof
   fix a :: "'a \<Rightarrow>\<^sub>0 'b"
   show "1 * a = a"
     by transfer (simp add: prod_fun_def [abs_def])
 qed
 
 instance poly_mapping :: (monoid_add, semiring_1_cancel) semiring_1_cancel
   ..
 
 instance poly_mapping :: (monoid_add, ring) ring
   ..
 
 instance poly_mapping :: (comm_monoid_add, comm_ring) comm_ring
   ..
 
 instance poly_mapping :: (monoid_add, ring_1) ring_1
   ..
 
 instance poly_mapping :: (comm_monoid_add, comm_ring_1) comm_ring_1
   ..
 
 
 subsection \<open>Single-point mappings\<close>
 
 lift_definition single :: "'a \<Rightarrow> 'b \<Rightarrow> 'a \<Rightarrow>\<^sub>0 'b::zero"
   is "\<lambda>k v k'. (v when k = k')"
   by simp
 
 lemma inj_single [iff]:
   "inj (single k)"
 proof (rule injI, transfer)
   fix k :: 'b and a b :: "'a::zero"
   assume "(\<lambda>k'. a when k = k') = (\<lambda>k'. b when k = k')"
   then have "(\<lambda>k'. a when k = k') k = (\<lambda>k'. b when k = k') k"
     by (rule arg_cong)
   then show "a = b" by simp
 qed
 
 lemma lookup_single:
   "lookup (single k v) k' = (v when k = k')"
   by transfer rule
 
 lemma lookup_single_eq [simp]:
   "lookup (single k v) k = v"
   by transfer simp
 
 lemma lookup_single_not_eq:
   "k \<noteq> k' \<Longrightarrow> lookup (single k v) k' = 0"
   by transfer simp
 
 lemma single_zero [simp]:
   "single k 0 = 0"
   by transfer simp
 
 lemma single_one [simp]:
   "single 0 1 = 1"
   by transfer simp
 
 lemma single_add:
   "single k (a + b) = single k a + single k b"
   by transfer (simp add: fun_eq_iff when_add_distrib)
 
 lemma single_uminus:
   "single k (- a) = - single k a"
   by transfer (simp add: fun_eq_iff when_uminus_distrib)
 
 lemma single_diff:
   "single k (a - b) = single k a - single k b"
   by transfer (simp add: fun_eq_iff when_diff_distrib)
 
 lemma single_numeral [simp]:
   "single 0 (numeral n) = numeral n"
   by (induct n) (simp_all only: numeral.simps numeral_add single_zero single_one single_add)
 
 lemma lookup_numeral:
   "lookup (numeral n) k = (numeral n when k = 0)"
 proof -
   have "lookup (numeral n) k = lookup (single 0 (numeral n)) k"
     by simp
   then show ?thesis unfolding lookup_single by simp
 qed
 
 lemma single_of_nat [simp]:
   "single 0 (of_nat n) = of_nat n"
   by (induct n) (simp_all add: single_add)
 
 lemma lookup_of_nat:
   "lookup (of_nat n) k = (of_nat n when k = 0)"
 proof -
   have "lookup (of_nat n) k = lookup (single 0 (of_nat n)) k"
     by simp
   then show ?thesis unfolding lookup_single by simp
 qed
 
 lemma of_nat_single:
   "of_nat = single 0 \<circ> of_nat"
   by (simp add: fun_eq_iff)
 
 lemma mult_single:
   "single k a * single l b = single (k + l) (a * b)"
 proof transfer
   fix k l :: 'a and a b :: 'b
   show "prod_fun (\<lambda>k'. a when k = k') (\<lambda>k'. b when l = k') = (\<lambda>k'. a * b when k + l = k')"
   proof
     fix k'
     have "prod_fun (\<lambda>k'. a when k = k') (\<lambda>k'. b when l = k') k' = (\<Sum>n. a * b when l = n when k' = k + n)"
       by (simp add: prod_fun_def Sum_any_right_distrib mult_when when_mult)
     also have "\<dots> = (\<Sum>n. a * b when k' = k + n when l = n)"
       by (simp add: when_when conj_commute)
     also have "\<dots> = (a * b when k' = k + l)"
       by simp
     also have "\<dots> = (a * b when k + l = k')"
       by (simp add: when_def)
     finally show "prod_fun (\<lambda>k'. a when k = k') (\<lambda>k'. b when l = k') k' =
       (\<lambda>k'. a * b when k + l = k') k'" .
   qed
 qed
 
 instance poly_mapping :: (monoid_add, semiring_char_0) semiring_char_0
   by intro_classes (auto intro: inj_compose inj_of_nat simp add: of_nat_single)
 
 instance poly_mapping :: (monoid_add, ring_char_0) ring_char_0
   ..
 
 lemma single_of_int [simp]:
   "single 0 (of_int k) = of_int k"
   by (cases k) (simp_all add: single_diff single_uminus)
 
 lemma lookup_of_int:
   "lookup (of_int l) k = (of_int l when k = 0)"
 proof -
   have "lookup (of_int l) k = lookup (single 0 (of_int l)) k"
     by simp
   then show ?thesis unfolding lookup_single by simp
 qed
 
 
 subsection \<open>Integral domains\<close>
 
 instance poly_mapping :: ("{ordered_cancel_comm_monoid_add, linorder}", semiring_no_zero_divisors) semiring_no_zero_divisors
   text \<open>The @{class "linorder"} constraint is a pragmatic device for the proof --- maybe it can be dropped\<close>
 proof
   fix f g :: "'a \<Rightarrow>\<^sub>0 'b"
   assume "f \<noteq> 0" and "g \<noteq> 0"
   then show "f * g \<noteq> 0"
   proof transfer
     fix f g :: "'a \<Rightarrow> 'b"
     define F where "F = {a. f a \<noteq> 0}"
     moreover define G where "G = {a. g a \<noteq> 0}"
     ultimately have [simp]:
       "\<And>a. f a \<noteq> 0 \<longleftrightarrow> a \<in> F"
       "\<And>b. g b \<noteq> 0 \<longleftrightarrow> b \<in> G"
       by simp_all
     assume "finite {a. f a \<noteq> 0}"
     then have [simp]: "finite F"
       by simp
     assume "finite {a. g a \<noteq> 0}"
     then have [simp]: "finite G"
       by simp
     assume "f \<noteq> (\<lambda>a. 0)"
     then obtain a where "f a \<noteq> 0"
       by (auto simp add: fun_eq_iff)
     assume "g \<noteq> (\<lambda>b. 0)"
     then obtain b where "g b \<noteq> 0"
       by (auto simp add: fun_eq_iff)
     from \<open>f a \<noteq> 0\<close> and \<open>g b \<noteq> 0\<close> have "F \<noteq> {}" and "G \<noteq> {}"
       by auto
     note Max_F = \<open>finite F\<close> \<open>F \<noteq> {}\<close>
     note Max_G = \<open>finite G\<close> \<open>G \<noteq> {}\<close>
     from Max_F and Max_G have [simp]:
       "Max F \<in> F"
       "Max G \<in> G"
       by auto
     from Max_F Max_G have [dest!]:
       "\<And>a. a \<in> F \<Longrightarrow> a \<le> Max F"
       "\<And>b. b \<in> G \<Longrightarrow> b \<le> Max G"
       by auto
     define q where "q = Max F + Max G"
     have "(\<Sum>(a, b). f a * g b when q = a + b) =
       (\<Sum>(a, b). f a * g b when q = a + b when a \<in> F \<and> b \<in> G)"
       by (rule Sum_any.cong) (auto simp add: split_def when_def q_def intro: ccontr)
     also have "\<dots> =
       (\<Sum>(a, b). f a * g b when (Max F, Max G) = (a, b))"
     proof (rule Sum_any.cong)
       fix ab :: "'a \<times> 'a"
       obtain a b where [simp]: "ab = (a, b)"
         by (cases ab) simp_all
       have [dest!]:
         "a \<le> Max F \<Longrightarrow> Max F \<noteq> a \<Longrightarrow> a < Max F"
         "b \<le> Max G \<Longrightarrow> Max G \<noteq> b \<Longrightarrow> b < Max G"
         by auto
       show "(case ab of (a, b) \<Rightarrow> f a * g b when q = a + b when a \<in> F \<and> b \<in> G) =
          (case ab of (a, b) \<Rightarrow> f a * g b when (Max F, Max G) = (a, b))"
         by (auto simp add: split_def when_def q_def dest: add_strict_mono [of a "Max F" b "Max G"])
     qed
     also have "\<dots> = (\<Sum>ab. (case ab of (a, b) \<Rightarrow> f a * g b) when
       (Max F, Max G) = ab)"
       unfolding split_def when_def by auto
     also have "\<dots> \<noteq> 0"
       by simp
     finally have "prod_fun f g q \<noteq> 0"
       by (simp add: prod_fun_unfold_prod)
     then show "prod_fun f g \<noteq> (\<lambda>k. 0)"
       by (auto simp add: fun_eq_iff)
   qed
 qed
 
 instance poly_mapping :: ("{ordered_cancel_comm_monoid_add, linorder}", ring_no_zero_divisors) ring_no_zero_divisors
   ..
 
 instance poly_mapping :: ("{ordered_cancel_comm_monoid_add, linorder}", ring_1_no_zero_divisors) ring_1_no_zero_divisors
   ..
 
 instance poly_mapping :: ("{ordered_cancel_comm_monoid_add, linorder}", idom) idom
   ..
 
 
 subsection \<open>Mapping order\<close>
 
 instantiation poly_mapping :: (linorder, "{zero, linorder}") linorder
 begin
 
 lift_definition less_poly_mapping :: "('a \<Rightarrow>\<^sub>0 'b) \<Rightarrow> ('a \<Rightarrow>\<^sub>0 'b) \<Rightarrow> bool"
   is less_fun
   .
 
 lift_definition less_eq_poly_mapping :: "('a \<Rightarrow>\<^sub>0 'b) \<Rightarrow> ('a \<Rightarrow>\<^sub>0 'b) \<Rightarrow> bool"
   is "\<lambda>f g. less_fun f g \<or> f = g"
   .
 
 instance proof (rule class.Orderings.linorder.of_class.intro)
   show "class.linorder (less_eq :: (_ \<Rightarrow>\<^sub>0 _) \<Rightarrow> _) less"
   proof (rule linorder_strictI, rule order_strictI)
     fix f g h :: "'a \<Rightarrow>\<^sub>0 'b"
     show "f \<le> g \<longleftrightarrow> f < g \<or> f = g"
       by transfer (rule refl)
     show "\<not> f < f"
       by transfer (rule less_fun_irrefl)
     show "f < g \<or> f = g \<or> g < f"
     proof transfer
       fix f g :: "'a \<Rightarrow> 'b"
       assume "finite {k. f k \<noteq> 0}" and "finite {k. g k \<noteq> 0}"
       then have "finite ({k. f k \<noteq> 0} \<union> {k. g k \<noteq> 0})"
         by simp
       moreover have "{k. f k \<noteq> g k} \<subseteq> {k. f k \<noteq> 0} \<union> {k. g k \<noteq> 0}"
         by auto
       ultimately have "finite {k. f k \<noteq> g k}"
         by (rule rev_finite_subset)
       then show "less_fun f g \<or> f = g \<or> less_fun g f"
         by (rule less_fun_trichotomy)
     qed
     assume "f < g" then show "\<not> g < f"
       by transfer (rule less_fun_asym)
     note \<open>f < g\<close> moreover assume "g < h"
       ultimately show "f < h"
       by transfer (rule less_fun_trans)
   qed
 qed
 
 end
 
 instance poly_mapping :: (linorder, "{ordered_comm_monoid_add, ordered_ab_semigroup_add_imp_le, linorder}") ordered_ab_semigroup_add
 proof (intro_classes, transfer)
   fix f g h :: "'a \<Rightarrow> 'b"
   assume *: "less_fun f g \<or> f = g"
   { assume "less_fun f g"
     then obtain k where "f k < g k" "(\<And>k'. k' < k \<Longrightarrow> f k' = g k')"
       by (blast elim!: less_funE)
     then have "h k + f k < h k + g k" "(\<And>k'. k' < k \<Longrightarrow> h k' + f k' = h k' + g k')"
       by simp_all
     then have "less_fun (\<lambda>k. h k + f k) (\<lambda>k. h k + g k)"
       by (blast intro: less_funI)
   }
   with * show "less_fun (\<lambda>k. h k + f k) (\<lambda>k. h k + g k) \<or> (\<lambda>k. h k + f k) = (\<lambda>k. h k + g k)"
     by (auto simp add: fun_eq_iff)
 qed
 
 instance poly_mapping :: (linorder, "{ordered_comm_monoid_add, ordered_ab_semigroup_add_imp_le, cancel_comm_monoid_add, linorder}") linordered_cancel_ab_semigroup_add
   ..
 
 instance poly_mapping :: (linorder, "{ordered_comm_monoid_add, ordered_ab_semigroup_add_imp_le, cancel_comm_monoid_add, linorder}") ordered_comm_monoid_add
   ..
 
 instance poly_mapping :: (linorder, "{ordered_comm_monoid_add, ordered_ab_semigroup_add_imp_le, cancel_comm_monoid_add, linorder}") ordered_cancel_comm_monoid_add
   ..
 
 instance poly_mapping :: (linorder, linordered_ab_group_add) linordered_ab_group_add
   ..
 
 text \<open>
   For pragmatism we leave out the final elements in the hierarchy:
   @{class linordered_ring}, @{class linordered_ring_strict}, @{class linordered_idom};
   remember that the order instance is a mere technical device, not a deeper algebraic
   property.
 \<close>
 
 
 subsection \<open>Fundamental mapping notions\<close>
 
 lift_definition keys :: "('a \<Rightarrow>\<^sub>0 'b::zero) \<Rightarrow> 'a set"
   is "\<lambda>f. {k. f k \<noteq> 0}" .
 
 lift_definition range :: "('a \<Rightarrow>\<^sub>0 'b::zero) \<Rightarrow> 'b set"
   is "\<lambda>f :: 'a \<Rightarrow> 'b. Set.range f - {0}" .
 
 lemma finite_keys [simp]:
   "finite (keys f)"
   by transfer
 
 lemma not_in_keys_iff_lookup_eq_zero:
   "k \<notin> keys f \<longleftrightarrow> lookup f k = 0"
   by transfer simp
 
 lemma lookup_not_eq_zero_eq_in_keys:
   "lookup f k \<noteq> 0 \<longleftrightarrow> k \<in> keys f"
   by transfer simp
 
 lemma lookup_eq_zero_in_keys_contradict [dest]:
   "lookup f k = 0 \<Longrightarrow> \<not> k \<in> keys f"
   by (simp add: not_in_keys_iff_lookup_eq_zero)
 
 lemma finite_range [simp]: "finite (Poly_Mapping.range p)"
 proof transfer
   fix f :: "'b \<Rightarrow> 'a"
   assume *: "finite {x. f x \<noteq> 0}"
   have "Set.range f - {0} \<subseteq> f ` {x. f x \<noteq> 0}"
     by auto
   thus "finite (Set.range f - {0})"
     by(rule finite_subset)(rule finite_imageI[OF *])
 qed
 
 lemma in_keys_lookup_in_range [simp]:
   "k \<in> keys f \<Longrightarrow> lookup f k \<in> range f"
   by transfer simp
 
 lemma in_keys_iff: "x \<in> (keys s) = (lookup s x \<noteq> 0)"
   by (transfer, simp)
 
 lemma keys_zero [simp]:
   "keys 0 = {}"
   by transfer simp
 
 lemma range_zero [simp]:
   "range 0 = {}"
   by transfer auto
 
 lemma keys_add:
   "keys (f + g) \<subseteq> keys f \<union> keys g"
   by transfer auto
 
 lemma keys_one [simp]:
   "keys 1 = {0}"
   by transfer simp
 
 lemma range_one [simp]:
   "range 1 = {1}"
   by transfer (auto simp add: when_def)
 
 lemma keys_single [simp]:
   "keys (single k v) = (if v = 0 then {} else {k})"
   by transfer simp
 
 lemma range_single [simp]:
   "range (single k v) = (if v = 0 then {} else {v})"
   by transfer (auto simp add: when_def)
 
 lemma keys_mult:
   "keys (f * g) \<subseteq> {a + b | a b. a \<in> keys f \<and> b \<in> keys g}"
   apply transfer
   apply (auto simp add: prod_fun_def dest!: mult_not_zero elim!: Sum_any.not_neutral_obtains_not_neutral)
   apply blast
   done
 
 lemma setsum_keys_plus_distrib:
   assumes hom_0: "\<And>k. f k 0 = 0"
   and hom_plus: "\<And>k. k \<in> Poly_Mapping.keys p \<union> Poly_Mapping.keys q \<Longrightarrow> f k (Poly_Mapping.lookup p k + Poly_Mapping.lookup q k) = f k (Poly_Mapping.lookup p k) + f k (Poly_Mapping.lookup q k)"
   shows
   "(\<Sum>k\<in>Poly_Mapping.keys (p + q). f k (Poly_Mapping.lookup (p + q) k)) =
    (\<Sum>k\<in>Poly_Mapping.keys p. f k (Poly_Mapping.lookup p k)) +
    (\<Sum>k\<in>Poly_Mapping.keys q. f k (Poly_Mapping.lookup q k))"
   (is "?lhs = ?p + ?q")
 proof -
   let ?A = "Poly_Mapping.keys p \<union> Poly_Mapping.keys q"
   have "?lhs = (\<Sum>k\<in>?A. f k (Poly_Mapping.lookup p k + Poly_Mapping.lookup q k))"
     apply(rule sum.mono_neutral_cong_left)
        apply(simp_all add: Poly_Mapping.keys_add)
      apply(transfer fixing: f)
      apply(auto simp add: hom_0)[1]
     apply(transfer fixing: f)
     apply(auto simp add: hom_0)[1]
     done
   also have "\<dots> = (\<Sum>k\<in>?A. f k (Poly_Mapping.lookup p k) + f k (Poly_Mapping.lookup q k))"
     by(rule sum.cong)(simp_all add: hom_plus)
   also have "\<dots> = (\<Sum>k\<in>?A. f k (Poly_Mapping.lookup p k)) + (\<Sum>k\<in>?A. f k (Poly_Mapping.lookup q k))"
     (is "_ = ?p' + ?q'")
     by(simp add: sum.distrib)
   also have "?p' = ?p"
     by (simp add: hom_0 in_keys_iff sum.mono_neutral_cong_right)
   also have "?q' = ?q"
     by (simp add: hom_0 in_keys_iff sum.mono_neutral_cong_right)
   finally show ?thesis .
 qed
 
 subsection \<open>Degree\<close>
 
 definition degree :: "(nat \<Rightarrow>\<^sub>0 'a::zero) \<Rightarrow> nat"
 where
   "degree f = Max (insert 0 (Suc ` keys f))"
 
 lemma degree_zero [simp]:
   "degree 0 = 0"
   unfolding degree_def by transfer simp
 
 lemma degree_one [simp]:
   "degree 1 = 1"
   unfolding degree_def by transfer simp
 
 lemma degree_single_zero [simp]:
   "degree (single k 0) = 0"
   unfolding degree_def by transfer simp
 
 lemma degree_single_not_zero [simp]:
   "v \<noteq> 0 \<Longrightarrow> degree (single k v) = Suc k"
   unfolding degree_def by transfer simp
 
 lemma degree_zero_iff [simp]:
   "degree f = 0 \<longleftrightarrow> f = 0"
 unfolding degree_def proof transfer
   fix f :: "nat \<Rightarrow> 'a"
   assume "finite {n. f n \<noteq> 0}"
   then have fin: "finite (insert 0 (Suc ` {n. f n \<noteq> 0}))" by auto
   show "Max (insert 0 (Suc ` {n. f n \<noteq> 0})) = 0 \<longleftrightarrow> f = (\<lambda>n. 0)" (is "?P \<longleftrightarrow> ?Q")
   proof
     assume ?P
     have "{n. f n \<noteq> 0} = {}"
     proof (rule ccontr)
       assume "{n. f n \<noteq> 0} \<noteq> {}"
       then obtain n where "n \<in> {n. f n \<noteq> 0}" by blast
       then have "{n. f n \<noteq> 0} = insert n {n. f n \<noteq> 0}" by auto
       then have "Suc ` {n. f n \<noteq> 0} = insert (Suc n) (Suc ` {n. f n \<noteq> 0})" by auto
       with \<open>?P\<close> have "Max (insert 0 (insert (Suc n) (Suc ` {n. f n \<noteq> 0}))) = 0" by simp
       then have "Max (insert (Suc n) (insert 0 (Suc ` {n. f n \<noteq> 0}))) = 0"
         by (simp add: insert_commute)
       with fin have "max (Suc n) (Max (insert 0 (Suc ` {n. f n \<noteq> 0}))) = 0"
         by simp
       then show False by simp
     qed
     then show ?Q by (simp add: fun_eq_iff)
   next
     assume ?Q then show ?P by simp
   qed
 qed
 
 lemma degree_greater_zero_in_keys:
   assumes "0 < degree f"
   shows "degree f - 1 \<in> keys f"
 proof -
   from assms have "keys f \<noteq> {}"
     by (auto simp add: degree_def)
   then show ?thesis unfolding degree_def
     by (simp add: mono_Max_commute [symmetric] mono_Suc)
 qed
 
 lemma in_keys_less_degree:
   "n \<in> keys f \<Longrightarrow> n < degree f"
 unfolding degree_def by transfer (auto simp add: Max_gr_iff)
 
 lemma beyond_degree_lookup_zero:
   "degree f \<le> n \<Longrightarrow> lookup f n = 0"
   unfolding degree_def by transfer auto
 
 lemma degree_add:
   "degree (f + g) \<le> max (degree f) (Poly_Mapping.degree g)"
 unfolding degree_def proof transfer
   fix f g :: "nat \<Rightarrow> 'a"
   assume f: "finite {x. f x \<noteq> 0}"
   assume g: "finite {x. g x \<noteq> 0}"
   let ?f = "Max (insert 0 (Suc ` {k. f k \<noteq> 0}))"
   let ?g = "Max (insert 0 (Suc ` {k. g k \<noteq> 0}))"
   have "Max (insert 0 (Suc ` {k. f k + g k \<noteq> 0})) \<le> Max (insert 0 (Suc ` ({k. f k \<noteq> 0} \<union> {k. g k \<noteq> 0})))"
     by (rule Max.subset_imp) (insert f g, auto)
   also have "\<dots> = max ?f ?g"
     using f g by (simp_all add: image_Un Max_Un [symmetric])
   finally show "Max (insert 0 (Suc ` {k. f k + g k \<noteq> 0}))
     \<le> max (Max (insert 0 (Suc ` {k. f k \<noteq> 0}))) (Max (insert 0 (Suc ` {k. g k \<noteq> 0})))"
     .
 qed
 
 lemma sorted_list_of_set_keys:
   "sorted_list_of_set (keys f) = filter (\<lambda>k. k \<in> keys f) [0..<degree f]" (is "_ = ?r")
 proof -
   have "keys f = set ?r"
     by (auto dest: in_keys_less_degree)
   moreover have "sorted_list_of_set (set ?r) = ?r"
     unfolding sorted_list_of_set_sort_remdups
     by (simp add: remdups_filter filter_sort [symmetric])
   ultimately show ?thesis by simp
 qed
 
 
 subsection \<open>Inductive structure\<close>
 
 lift_definition update :: "'a \<Rightarrow> 'b \<Rightarrow> ('a \<Rightarrow>\<^sub>0 'b::zero) \<Rightarrow> 'a \<Rightarrow>\<^sub>0 'b"
   is "\<lambda>k v f. f(k := v)"
 proof -
   fix f :: "'a \<Rightarrow> 'b" and k' v
   assume "finite {k. f k \<noteq> 0}"
   then have "finite (insert k' {k. f k \<noteq> 0})"
     by simp
   then show "finite {k. (f(k' := v)) k \<noteq> 0}"
     by (rule rev_finite_subset) auto
 qed
 
 lemma update_induct [case_names const update]:
   assumes const': "P 0"
   assumes update': "\<And>f a b. a \<notin> keys f \<Longrightarrow> b \<noteq> 0 \<Longrightarrow> P f \<Longrightarrow> P (update a b f)"
   shows "P f"
 proof -
   obtain g where "f = Abs_poly_mapping g" and "finite {a. g a \<noteq> 0}"
     by (cases f) simp_all
   define Q where "Q g = P (Abs_poly_mapping g)" for g
   from \<open>finite {a. g a \<noteq> 0}\<close> have "Q g"
   proof (induct g rule: finite_update_induct)
     case const with const' Q_def show ?case
       by simp
   next
     case (update a b g)
     from \<open>finite {a. g a \<noteq> 0}\<close> \<open>g a = 0\<close> have "a \<notin> keys (Abs_poly_mapping g)"
       by (simp add: Abs_poly_mapping_inverse keys.rep_eq)
     moreover note \<open>b \<noteq> 0\<close>
     moreover from \<open>Q g\<close> have "P (Abs_poly_mapping g)"
       by (simp add: Q_def)
     ultimately have "P (update a b (Abs_poly_mapping g))"
       by (rule update')
     also from \<open>finite {a. g a \<noteq> 0}\<close>
     have "update a b (Abs_poly_mapping g) = Abs_poly_mapping (g(a := b))"
       by (simp add: update.abs_eq eq_onp_same_args)
     finally show ?case
       by (simp add: Q_def fun_upd_def)
   qed
   then show ?thesis by (simp add: Q_def \<open>f = Abs_poly_mapping g\<close>)
 qed
 
 lemma lookup_update:
   "lookup (update k v f) k' = (if k = k' then v else lookup f k')"
   by transfer simp
 
 lemma keys_update:
   "keys (update k v f) = (if v = 0 then keys f - {k} else insert k (keys f))"
   by transfer auto
 
 
 subsection \<open>Quasi-functorial structure\<close>
 
 lift_definition map :: "('b::zero \<Rightarrow> 'c::zero)
   \<Rightarrow> ('a \<Rightarrow>\<^sub>0 'b) \<Rightarrow> ('a \<Rightarrow>\<^sub>0 'c::zero)"
   is "\<lambda>g f k. g (f k) when f k \<noteq> 0"
   by simp
 
 context
   fixes f :: "'b \<Rightarrow> 'a"
   assumes inj_f: "inj f"
 begin
 
 lift_definition map_key :: "('a \<Rightarrow>\<^sub>0 'c::zero) \<Rightarrow> 'b \<Rightarrow>\<^sub>0 'c"
   is "\<lambda>p. p \<circ> f"
 proof -
   fix g :: "'c \<Rightarrow> 'd" and p :: "'a \<Rightarrow> 'c"
   assume "finite {x. p x \<noteq> 0}"
   hence "finite (f ` {y. p (f y) \<noteq> 0})"
     by(rule finite_subset[rotated]) auto
   thus "finite {x. (p \<circ> f) x \<noteq> 0}" unfolding o_def
     by(rule finite_imageD)(rule subset_inj_on[OF inj_f], simp)
 qed
 
 end
 
 lemma map_key_compose:
   assumes [transfer_rule]: "inj f" "inj g"
   shows "map_key f (map_key g p) = map_key (g \<circ> f) p"
 proof -
   from assms have [transfer_rule]: "inj (g \<circ> f)"
     by(simp add: inj_compose)
   show ?thesis by transfer(simp add: o_assoc)
 qed
 
 lemma map_key_id:
   "map_key (\<lambda>x. x) p = p"
 proof -
   have [transfer_rule]: "inj (\<lambda>x. x)" by simp
   show ?thesis by transfer(simp add: o_def)
 qed
 
 context
   fixes f :: "'a \<Rightarrow> 'b"
   assumes inj_f [transfer_rule]: "inj f"
 begin
 
 lemma map_key_map:
   "map_key f (map g p) = map g (map_key f p)"
   by transfer (simp add: fun_eq_iff)
 
 lemma map_key_plus:
   "map_key f (p + q) = map_key f p + map_key f q"
   by transfer (simp add: fun_eq_iff)
 
 lemma keys_map_key:
   "keys (map_key f p) = f -` keys p"
   by transfer auto
 
 lemma map_key_zero [simp]:
   "map_key f 0 = 0"
   by transfer (simp add: fun_eq_iff)
 
 lemma map_key_single [simp]:
   "map_key f (single (f k) v) = single k v"
   by transfer (simp add: fun_eq_iff inj_onD [OF inj_f] when_def)
 
 end
 
 lemma mult_map_scale_conv_mult: "map ((*) s) p = single 0 s * p"
 proof(transfer fixing: s)
   fix p :: "'a \<Rightarrow> 'b"
   assume *: "finite {x. p x \<noteq> 0}"
   { fix x
     have "prod_fun (\<lambda>k'. s when 0 = k') p x =
           (\<Sum>l :: 'a. if l = 0 then s * (\<Sum>q. p q when x = q) else 0)"
       by(auto simp add: prod_fun_def when_def intro: Sum_any.cong simp del: Sum_any.delta)
     also have "\<dots> = (\<lambda>k. s * p k when p k \<noteq> 0) x" by(simp add: when_def)
     also note calculation }
   then show "(\<lambda>k. s * p k when p k \<noteq> 0) = prod_fun (\<lambda>k'. s when 0 = k') p"
     by(simp add: fun_eq_iff)
 qed
 
 lemma map_single [simp]:
   "(c = 0 \<Longrightarrow> f 0 = 0) \<Longrightarrow> map f (single x c) = single x (f c)"
 by transfer(auto simp add: fun_eq_iff when_def)
 
 lemma map_eq_zero_iff: "map f p = 0 \<longleftrightarrow> (\<forall>k \<in> keys p. f (lookup p k) = 0)"
 by transfer(auto simp add: fun_eq_iff when_def)
 
 subsection \<open>Canonical dense representation of @{typ "nat \<Rightarrow>\<^sub>0 'a"}\<close>
 
 abbreviation no_trailing_zeros :: "'a :: zero list \<Rightarrow> bool"
 where
   "no_trailing_zeros \<equiv> no_trailing ((=) 0)"
 
 lift_definition "nth" :: "'a list \<Rightarrow> (nat \<Rightarrow>\<^sub>0 'a::zero)"
   is "nth_default 0"
   by (fact finite_nth_default_neq_default)
 
 text \<open>
   The opposite direction is directly specified on (later)
   type \<open>nat_mapping\<close>.
 \<close>
 
 lemma nth_Nil [simp]:
   "nth [] = 0"
   by transfer (simp add: fun_eq_iff)
 
 lemma nth_singleton [simp]:
   "nth [v] = single 0 v"
 proof (transfer, rule ext)
   fix n :: nat and v :: 'a
   show "nth_default 0 [v] n = (v when 0 = n)"
     by (auto simp add: nth_default_def nth_append)
 qed
 
 lemma nth_replicate [simp]:
   "nth (replicate n 0 @ [v]) = single n v"
 proof (transfer, rule ext)
   fix m n :: nat and v :: 'a
   show "nth_default 0 (replicate n 0 @ [v]) m = (v when n = m)"
     by (auto simp add: nth_default_def nth_append)
 qed
 
 lemma nth_strip_while [simp]:
   "nth (strip_while ((=) 0) xs) = nth xs"
   by transfer (fact nth_default_strip_while_dflt)
 
 lemma nth_strip_while' [simp]:
   "nth (strip_while (\<lambda>k. k = 0) xs) = nth xs"
   by (subst eq_commute) (fact nth_strip_while)
 
 lemma nth_eq_iff:
   "nth xs = nth ys \<longleftrightarrow> strip_while (HOL.eq 0) xs = strip_while (HOL.eq 0) ys"
   by transfer (simp add: nth_default_eq_iff)
 
 lemma lookup_nth [simp]:
   "lookup (nth xs) = nth_default 0 xs"
   by (fact nth.rep_eq)
 
 lemma keys_nth [simp]:
   "keys (nth xs) =  fst ` {(n, v) \<in> set (enumerate 0 xs). v \<noteq> 0}"
 proof transfer
   fix xs :: "'a list"
   { fix n
     assume "nth_default 0 xs n \<noteq> 0"
     then have "n < length xs" and "xs ! n \<noteq> 0"
       by (auto simp add: nth_default_def split: if_splits)
     then have "(n, xs ! n) \<in> {(n, v). (n, v) \<in> set (enumerate 0 xs) \<and> v \<noteq> 0}" (is "?x \<in> ?A")
       by (auto simp add: in_set_conv_nth enumerate_eq_zip)
     then have "fst ?x \<in> fst ` ?A"
       by blast
     then have "n \<in> fst ` {(n, v). (n, v) \<in> set (enumerate 0 xs) \<and> v \<noteq> 0}"
       by simp
   }
   then show "{k. nth_default 0 xs k \<noteq> 0} = fst ` {(n, v). (n, v) \<in> set (enumerate 0 xs) \<and> v \<noteq> 0}"
     by (auto simp add: in_enumerate_iff_nth_default_eq)
 qed
 
 lemma range_nth [simp]:
   "range (nth xs) = set xs - {0}"
   by transfer simp
 
 lemma degree_nth:
   "no_trailing_zeros xs \<Longrightarrow> degree (nth xs) = length xs"
 unfolding degree_def proof transfer
   fix xs :: "'a list"
   assume *: "no_trailing_zeros xs"
   let ?A = "{n. nth_default 0 xs n \<noteq> 0}"
   let ?f = "nth_default 0 xs"
   let ?bound = "Max (insert 0 (Suc ` {n. ?f n \<noteq> 0}))"
   show "?bound = length xs"
   proof (cases "xs = []")
     case False
     with * obtain n where n: "n < length xs" "xs ! n \<noteq> 0"
       by (fastforce simp add: no_trailing_unfold last_conv_nth neq_Nil_conv)
     then have "?bound = Max (Suc ` {k. (k < length xs \<longrightarrow> xs ! k \<noteq> (0::'a)) \<and> k < length xs})"
       by (subst Max_insert) (auto simp add: nth_default_def)
     also let ?A = "{k. k < length xs \<and> xs ! k \<noteq> 0}"
     have "{k. (k < length xs \<longrightarrow> xs ! k \<noteq> (0::'a)) \<and> k < length xs} = ?A" by auto
     also have "Max (Suc ` ?A) = Suc (Max ?A)" using n
       by (subst mono_Max_commute [where f = Suc, symmetric]) (auto simp add: mono_Suc)
     also {
       have "Max ?A \<in> ?A" using n Max_in [of ?A] by fastforce
       hence "Suc (Max ?A) \<le> length xs" by simp
       moreover from * False have "length xs - 1 \<in> ?A"
         by(auto simp add: no_trailing_unfold last_conv_nth)
       hence "length xs - 1 \<le> Max ?A" using Max_ge[of ?A "length xs - 1"] by auto
       hence "length xs \<le> Suc (Max ?A)" by simp
       ultimately have "Suc (Max ?A) = length xs" by simp }
     finally show ?thesis .
   qed simp
 qed
 
 lemma nth_trailing_zeros [simp]:
   "nth (xs @ replicate n 0) = nth xs"
   by transfer simp
 
 lemma nth_idem:
   "nth (List.map (lookup f) [0..<degree f]) = f"
   unfolding degree_def by transfer
     (auto simp add: nth_default_def fun_eq_iff not_less)
 
 lemma nth_idem_bound:
   assumes "degree f \<le> n"
   shows "nth (List.map (lookup f) [0..<n]) = f"
 proof -
   from assms obtain m where "n = degree f + m"
     by (blast dest: le_Suc_ex)
   then have "[0..<n] = [0..<degree f] @ [degree f..<degree f + m]"
     by (simp add: upt_add_eq_append [of 0])
   moreover have "List.map (lookup f) [degree f..<degree f + m] = replicate m 0"
     by (rule replicate_eqI) (auto simp add: beyond_degree_lookup_zero)
   ultimately show ?thesis by (simp add: nth_idem)
 qed
 
 
 subsection \<open>Canonical sparse representation of @{typ "'a \<Rightarrow>\<^sub>0 'b"}\<close>
 
 lift_definition the_value :: "('a \<times> 'b) list \<Rightarrow> 'a \<Rightarrow>\<^sub>0 'b::zero"
   is "\<lambda>xs k. case map_of xs k of None \<Rightarrow> 0 | Some v \<Rightarrow> v"
 proof -
   fix xs :: "('a \<times> 'b) list"
   have fin: "finite {k. \<exists>v. map_of xs k = Some v}"
     using finite_dom_map_of [of xs] unfolding dom_def by auto
   then show "finite {k. (case map_of xs k of None \<Rightarrow> 0 | Some v \<Rightarrow> v) \<noteq> 0}"
     using fin by (simp split: option.split)
 qed
 
 definition items :: "('a::linorder \<Rightarrow>\<^sub>0 'b::zero) \<Rightarrow> ('a \<times> 'b) list"
 where
   "items f = List.map (\<lambda>k. (k, lookup f k)) (sorted_list_of_set (keys f))"
 
 text \<open>
   For the canonical sparse representation we provide both
   directions of morphisms since the specification of
   ordered association lists in theory \<open>OAList\<close>
   will support arbitrary linear orders @{class linorder}
   as keys, not just natural numbers @{typ nat}.
 \<close>
 
 lemma the_value_items [simp]:
   "the_value (items f) = f"
   unfolding items_def
   by transfer (simp add: fun_eq_iff map_of_map_restrict restrict_map_def)
 
 lemma lookup_the_value:
   "lookup (the_value xs) k = (case map_of xs k of None \<Rightarrow> 0 | Some v \<Rightarrow> v)"
   by transfer rule
 
 lemma items_the_value:
   assumes "sorted (List.map fst xs)" and "distinct (List.map fst xs)" and "0 \<notin> snd ` set xs"
   shows "items (the_value xs) = xs"
 proof -
   from assms have "sorted_list_of_set (set (List.map fst xs)) = List.map fst xs"
     unfolding sorted_list_of_set_sort_remdups by (simp add: distinct_remdups_id sort_key_id_if_sorted)
   moreover from assms have "keys (the_value xs) = fst ` set xs"
     by transfer (auto simp add: image_def split: option.split dest: set_map_of_compr)
   ultimately show ?thesis
     unfolding items_def using assms
     by (auto simp add: lookup_the_value intro: map_idI)
 qed
 
 lemma the_value_Nil [simp]:
   "the_value [] = 0"
   by transfer (simp add: fun_eq_iff)
 
 lemma the_value_Cons [simp]:
   "the_value (x # xs) = update (fst x) (snd x) (the_value xs)"
   by transfer (simp add: fun_eq_iff)
 
 lemma items_zero [simp]:
   "items 0 = []"
   unfolding items_def by simp
 
 lemma items_one [simp]:
   "items 1 = [(0, 1)]"
   unfolding items_def by transfer simp
 
 lemma items_single [simp]:
   "items (single k v) = (if v = 0 then [] else [(k, v)])"
   unfolding items_def by simp
 
 lemma in_set_items_iff [simp]:
   "(k, v) \<in> set (items f) \<longleftrightarrow> k \<in> keys f \<and> lookup f k = v"
   unfolding items_def by transfer auto
 
 
 subsection \<open>Size estimation\<close>
 
 context
   fixes f :: "'a \<Rightarrow> nat"
   and g :: "'b :: zero \<Rightarrow> nat"
 begin
 
 definition poly_mapping_size :: "('a \<Rightarrow>\<^sub>0 'b) \<Rightarrow> nat"
 where
   "poly_mapping_size m = g 0 + (\<Sum>k \<in> keys m. Suc (f k + g (lookup m k)))"
 
 lemma poly_mapping_size_0 [simp]:
   "poly_mapping_size 0 = g 0"
   by (simp add: poly_mapping_size_def)
 
 lemma poly_mapping_size_single [simp]:
   "poly_mapping_size (single k v) = (if v = 0 then g 0 else g 0 + f k + g v + 1)"
   unfolding poly_mapping_size_def by transfer simp
 
 lemma keys_less_poly_mapping_size:
   "k \<in> keys m \<Longrightarrow> f k + g (lookup m k) < poly_mapping_size m"
 unfolding poly_mapping_size_def
 proof transfer
   fix k :: 'a and m :: "'a \<Rightarrow> 'b" and f :: "'a \<Rightarrow> nat" and g
   let ?keys = "{k. m k \<noteq> 0}"
   assume *: "finite ?keys" "k \<in> ?keys"
   then have "f k + g (m k) = (\<Sum>k' \<in> ?keys. f k' + g (m k') when k' = k)"
     by (simp add: sum.delta when_def)
   also have "\<dots> < (\<Sum>k' \<in> ?keys. Suc (f k' + g (m k')))" using *
     by (intro sum_strict_mono) (auto simp add: when_def)
   also have "\<dots> \<le> g 0 + \<dots>" by simp
   finally have "f k + g (m k) < \<dots>" .
   then show "f k + g (m k) < g 0 + (\<Sum>k | m k \<noteq> 0. Suc (f k + g (m k)))"
     by simp
 qed
 
 lemma lookup_le_poly_mapping_size:
   "g (lookup m k) \<le> poly_mapping_size m"
 proof (cases "k \<in> keys m")
   case True
   with keys_less_poly_mapping_size [of k m]
   show ?thesis by simp
 next
   case False
   then show ?thesis
     by (simp add: Poly_Mapping.poly_mapping_size_def in_keys_iff)
 qed 
 
 lemma poly_mapping_size_estimation:
   "k \<in> keys m \<Longrightarrow> y \<le> f k + g (lookup m k) \<Longrightarrow> y < poly_mapping_size m"
   using keys_less_poly_mapping_size by (auto intro: le_less_trans)
 
 lemma poly_mapping_size_estimation2:
   assumes "v \<in> range m" and "y \<le> g v"
   shows "y < poly_mapping_size m"
 proof -
   from assms obtain k where *: "lookup m k = v" "v \<noteq> 0"
     by transfer blast
   from * have "k \<in> keys m"
     by (simp add: in_keys_iff)
   then show ?thesis
   proof (rule poly_mapping_size_estimation)
     from assms * have "y \<le> g (lookup m k)"
       by simp
     then show "y \<le> f k + g (lookup m k)"
       by simp
   qed
 qed
 
 end
 
 lemma poly_mapping_size_one [simp]:
   "poly_mapping_size f g 1 = g 0 + f 0 + g 1 + 1"
   unfolding poly_mapping_size_def by transfer simp
 
 lemma poly_mapping_size_cong [fundef_cong]:
   "m = m' \<Longrightarrow> g 0 = g' 0 \<Longrightarrow> (\<And>k. k \<in> keys m' \<Longrightarrow> f k = f' k)
     \<Longrightarrow> (\<And>v. v \<in> range m' \<Longrightarrow> g v = g' v)
     \<Longrightarrow> poly_mapping_size f g m = poly_mapping_size f' g' m'"
   by (auto simp add: poly_mapping_size_def intro!: sum.cong)
 
 instantiation poly_mapping :: (type, zero) size
 begin
 
 definition "size = poly_mapping_size (\<lambda>_. 0) (\<lambda>_. 0)"
 
 instance ..
 
 end
 
 
 subsection \<open>Further mapping operations and properties\<close>
 
 text \<open>It is like in algebra: there are many definitions, some are also used\<close>
 
 lift_definition mapp ::
   "('a \<Rightarrow> 'b :: zero \<Rightarrow> 'c :: zero) \<Rightarrow> ('a \<Rightarrow>\<^sub>0 'b) \<Rightarrow> ('a \<Rightarrow>\<^sub>0 'c)"
   is "\<lambda>f p k. (if k \<in> keys p then f k (lookup p k) else 0)"
   by simp
 
 lemma mapp_cong [fundef_cong]:
   "\<lbrakk> m = m'; \<And>k. k \<in> keys m' \<Longrightarrow> f k (lookup m' k) = f' k (lookup m' k) \<rbrakk>
   \<Longrightarrow> mapp f m = mapp f' m'"
   by transfer (auto simp add: fun_eq_iff)
 
 lemma lookup_mapp:
   "lookup (mapp f p) k = (f k (lookup p k) when k \<in> keys p)"
   by (simp add: mapp.rep_eq)
 
 lemma keys_mapp_subset: "keys (mapp f p) \<subseteq> keys p"
   by (meson in_keys_iff mapp.rep_eq subsetI)
 
 subsection\<open>Free Abelian Groups Over a Type\<close>
 
 abbreviation frag_of :: "'a \<Rightarrow> 'a \<Rightarrow>\<^sub>0 int"
   where "frag_of c \<equiv> Poly_Mapping.single c (1::int)"
 
 lemma lookup_frag_of [simp]:
    "Poly_Mapping.lookup(frag_of c) = (\<lambda>x. if x = c then 1 else 0)"
   by (force simp add: lookup_single_not_eq)
 
 lemma frag_of_nonzero [simp]: "frag_of a \<noteq> 0"
 proof -
   let ?f = "\<lambda>x. if x = a then 1 else (0::int)"
   have "?f \<noteq> (\<lambda>x. 0::int)"
     by (auto simp: fun_eq_iff)
   then have "Poly_Mapping.lookup (Abs_poly_mapping ?f) \<noteq> Poly_Mapping.lookup (Abs_poly_mapping (\<lambda>x. 0))"
     by fastforce
   then show ?thesis
     by (metis lookup_single_eq lookup_zero)
 qed
 
 definition frag_cmul :: "int \<Rightarrow> ('a \<Rightarrow>\<^sub>0 int) \<Rightarrow> ('a \<Rightarrow>\<^sub>0 int)"
   where "frag_cmul c a = Abs_poly_mapping (\<lambda>x. c * Poly_Mapping.lookup a x)"
 
 lemma frag_cmul_zero [simp]: "frag_cmul 0 x = 0"
   by (simp add: frag_cmul_def)
 
 lemma frag_cmul_zero2 [simp]: "frag_cmul c 0 = 0"
   by (simp add: frag_cmul_def)
 
 lemma frag_cmul_one [simp]: "frag_cmul 1 x = x"
   by (auto simp: frag_cmul_def Poly_Mapping.poly_mapping.lookup_inverse)
 
 lemma frag_cmul_minus_one [simp]: "frag_cmul (-1) x = -x"
   by (simp add: frag_cmul_def uminus_poly_mapping_def poly_mapping_eqI)
 
 lemma frag_cmul_cmul [simp]: "frag_cmul c (frag_cmul d x) = frag_cmul (c*d) x"
   by (simp add: frag_cmul_def mult_ac)
 
 lemma lookup_frag_cmul [simp]: "poly_mapping.lookup (frag_cmul c x) i = c * poly_mapping.lookup x i"
   by (simp add: frag_cmul_def)
 
 lemma minus_frag_cmul [simp]: "- frag_cmul k x = frag_cmul (-k) x"
   by (simp add: poly_mapping_eqI)
 
 lemma keys_frag_of: "Poly_Mapping.keys(frag_of a) = {a}"
   by simp
 
 lemma finite_cmul_nonzero: "finite {x. c * Poly_Mapping.lookup a x \<noteq> (0::int)}"
   by simp
 
 lemma keys_cmul: "Poly_Mapping.keys(frag_cmul c a) \<subseteq> Poly_Mapping.keys a"
   using finite_cmul_nonzero [of c a]
   by (metis lookup_frag_cmul mult_zero_right not_in_keys_iff_lookup_eq_zero subsetI)
   
 
 lemma keys_cmul_iff [iff]: "i \<in> Poly_Mapping.keys (frag_cmul c x) \<longleftrightarrow> i \<in> Poly_Mapping.keys x \<and> c \<noteq> 0"
   apply auto
   apply (meson subsetD keys_cmul)
   by (metis in_keys_iff lookup_frag_cmul mult_eq_0_iff)
 
 lemma keys_minus [simp]: "Poly_Mapping.keys(-a) = Poly_Mapping.keys a"
   by (metis (no_types, opaque_lifting) in_keys_iff lookup_uminus neg_equal_0_iff_equal subsetI subset_antisym)
 
 lemma keys_diff: 
   "Poly_Mapping.keys(a - b) \<subseteq> Poly_Mapping.keys a \<union> Poly_Mapping.keys b"
   by (auto simp add: in_keys_iff lookup_minus)
 
 lemma keys_eq_empty [simp]: "Poly_Mapping.keys c = {} \<longleftrightarrow> c = 0"
   by (metis in_keys_iff keys_zero lookup_zero poly_mapping_eqI)
 
 lemma frag_cmul_eq_0_iff [simp]: "frag_cmul k c = 0 \<longleftrightarrow> k=0 \<or> c=0"
   by auto (metis subsetI subset_antisym keys_cmul_iff keys_eq_empty)
 
 lemma frag_of_eq: "frag_of x = frag_of y \<longleftrightarrow> x = y"
   by (metis lookup_single_eq lookup_single_not_eq zero_neq_one)
 
 lemma frag_cmul_distrib: "frag_cmul (c+d) a = frag_cmul c a + frag_cmul d a"
   by (simp add: frag_cmul_def plus_poly_mapping_def int_distrib)
 
 lemma frag_cmul_distrib2: "frag_cmul c (a+b) = frag_cmul c a + frag_cmul c b"
 proof -
   have "finite {x. poly_mapping.lookup a x + poly_mapping.lookup b x \<noteq> 0}"
     using keys_add [of a b]
     by (metis (no_types, lifting) finite_keys finite_subset keys.rep_eq lookup_add mem_Collect_eq subsetI)
   then show ?thesis
     by (simp add: frag_cmul_def plus_poly_mapping_def int_distrib)
 qed
 
 lemma frag_cmul_diff_distrib: "frag_cmul (a - b) c = frag_cmul a c - frag_cmul b c"
   by (auto simp: left_diff_distrib lookup_minus poly_mapping_eqI)
 
 lemma frag_cmul_sum:
      "frag_cmul a (sum b I) = (\<Sum>i\<in>I. frag_cmul a (b i))"
 proof (induction rule: infinite_finite_induct)
   case (insert i I)
   then show ?case
     by (auto simp: algebra_simps frag_cmul_distrib2)
 qed auto
 
 lemma keys_sum: "Poly_Mapping.keys(sum b I) \<subseteq> (\<Union>i \<in>I. Poly_Mapping.keys(b i))"
 proof (induction I rule: infinite_finite_induct)
   case (insert i I)
   then show ?case
     using keys_add [of "b i" "sum b I"] by auto
 qed auto
 
 
 definition frag_extend :: "('b \<Rightarrow> 'a \<Rightarrow>\<^sub>0 int) \<Rightarrow> ('b \<Rightarrow>\<^sub>0 int) \<Rightarrow> 'a \<Rightarrow>\<^sub>0 int"
   where "frag_extend b x \<equiv> (\<Sum>i \<in> Poly_Mapping.keys x. frag_cmul (Poly_Mapping.lookup x i) (b i))"
 
 lemma frag_extend_0 [simp]: "frag_extend b 0 = 0"
   by (simp add: frag_extend_def)
 
 lemma frag_extend_of [simp]: "frag_extend f (frag_of a) = f a"
   by (simp add: frag_extend_def)
 
 lemma frag_extend_cmul:
    "frag_extend f (frag_cmul c x) = frag_cmul c (frag_extend f x)"
   by (auto simp: frag_extend_def frag_cmul_sum intro: sum.mono_neutral_cong_left)
 
 lemma frag_extend_minus:
    "frag_extend f (- x) = - (frag_extend f x)"
   using frag_extend_cmul [of f "-1"] by simp
 
 lemma frag_extend_add:
   "frag_extend f (a+b) = (frag_extend f a) + (frag_extend f b)"
 proof -
   have *: "(\<Sum>i\<in>Poly_Mapping.keys a. frag_cmul (poly_mapping.lookup a i) (f i)) 
          = (\<Sum>i\<in>Poly_Mapping.keys a \<union> Poly_Mapping.keys b. frag_cmul (poly_mapping.lookup a i) (f i))"
           "(\<Sum>i\<in>Poly_Mapping.keys b. frag_cmul (poly_mapping.lookup b i) (f i)) 
          = (\<Sum>i\<in>Poly_Mapping.keys a \<union> Poly_Mapping.keys b. frag_cmul (poly_mapping.lookup b i) (f i))"
     by (auto simp: in_keys_iff intro: sum.mono_neutral_cong_left)
   have "frag_extend f (a+b) = (\<Sum>i\<in>Poly_Mapping.keys (a + b).
        frag_cmul (poly_mapping.lookup a i) (f i) + frag_cmul (poly_mapping.lookup b i) (f i)) "
     by (auto simp: frag_extend_def Poly_Mapping.lookup_add frag_cmul_distrib)
   also have "... = (\<Sum>i \<in> Poly_Mapping.keys a \<union> Poly_Mapping.keys b. frag_cmul (poly_mapping.lookup a i) (f i) 
                          + frag_cmul (poly_mapping.lookup b i) (f i))"
     apply (rule sum.mono_neutral_cong_left)
     using keys_add [of a b]
      apply (auto simp add: in_keys_iff plus_poly_mapping.rep_eq frag_cmul_distrib [symmetric])
     done
   also have "... = (frag_extend f a) + (frag_extend f b)"
     by (auto simp: * sum.distrib frag_extend_def)
   finally show ?thesis .
 qed
 
 lemma frag_extend_diff:
    "frag_extend f (a-b) = (frag_extend f a) - (frag_extend f b)"
   by (metis (no_types, opaque_lifting) add_uminus_conv_diff frag_extend_add frag_extend_minus)
 
 lemma frag_extend_sum:
    "finite I \<Longrightarrow> frag_extend f (\<Sum>i\<in>I. g i) = sum (frag_extend f o g) I"
   by (induction I rule: finite_induct) (simp_all add: frag_extend_add)
 
 lemma frag_extend_eq:
    "(\<And>f. f \<in> Poly_Mapping.keys c \<Longrightarrow> g f = h f) \<Longrightarrow> frag_extend g c = frag_extend h c"
   by (simp add: frag_extend_def)
 
 lemma frag_extend_eq_0:
    "(\<And>x. x \<in> Poly_Mapping.keys c \<Longrightarrow> f x = 0) \<Longrightarrow> frag_extend f c = 0"
   by (simp add: frag_extend_def)
 
 lemma keys_frag_extend: "Poly_Mapping.keys(frag_extend f c) \<subseteq> (\<Union>x \<in> Poly_Mapping.keys c. Poly_Mapping.keys(f x))"
   unfolding frag_extend_def
   using keys_sum by fastforce
 
 lemma frag_expansion: "a = frag_extend frag_of a"
 proof -
   have *: "finite I
         \<Longrightarrow> Poly_Mapping.lookup (\<Sum>i\<in>I. frag_cmul (Poly_Mapping.lookup a i) (frag_of i)) j =
             (if j \<in> I then Poly_Mapping.lookup a j else 0)" for I j
     by (induction I rule: finite_induct) (auto simp: lookup_single lookup_add)
   show ?thesis
     unfolding frag_extend_def
     by (rule poly_mapping_eqI) (fastforce simp add: in_keys_iff *)
 qed
 
 lemma frag_closure_minus_cmul:
   assumes "P 0" and P: "\<And>x y. \<lbrakk>P x; P y\<rbrakk> \<Longrightarrow> P(x - y)" "P c"
   shows "P(frag_cmul k c)"
 proof -
   have "P (frag_cmul (int n) c)" for n
     apply (induction n)
      apply (simp_all add: assms frag_cmul_distrib)
     by (metis add.left_neutral add_diff_cancel_right' add_uminus_conv_diff P)
   then show ?thesis
     by (metis (no_types, opaque_lifting) add_diff_eq assms(2) diff_add_cancel frag_cmul_distrib int_diff_cases)
 qed
 
 lemma frag_induction [consumes 1, case_names zero one diff]:
   assumes supp: "Poly_Mapping.keys c \<subseteq> S"
     and 0: "P 0" and sing: "\<And>x. x \<in> S \<Longrightarrow> P(frag_of x)"
     and diff: "\<And>a b. \<lbrakk>P a; P b\<rbrakk> \<Longrightarrow> P(a - b)"
   shows "P c"
 proof -
   have "P (\<Sum>i\<in>I. frag_cmul (poly_mapping.lookup c i) (frag_of i))"
     if "I \<subseteq> Poly_Mapping.keys c" for I
     using finite_subset [OF that finite_keys [of c]] that supp
   proof (induction I arbitrary: c rule: finite_induct)
     case empty
     then show ?case
       by (auto simp: 0)
   next
     case (insert i I c)
     have ab: "a+b = a - (0 - b)" for a b :: "'a \<Rightarrow>\<^sub>0 int"
       by simp
     have Pfrag: "P (frag_cmul (poly_mapping.lookup c i) (frag_of i))"
       by (metis "0" diff frag_closure_minus_cmul insert.prems insert_subset sing subset_iff)
     show ?case
       apply (simp add: insert.hyps)
       apply (subst ab)
       using insert apply (blast intro: assms Pfrag)
       done
   qed
   then show ?thesis
     by (subst frag_expansion) (auto simp add: frag_extend_def)
 qed
 
 lemma frag_extend_compose:
   "frag_extend f (frag_extend (frag_of o g) c) = frag_extend (f o g) c"
   using subset_UNIV
   by (induction c rule: frag_induction) (auto simp: frag_extend_diff)
 
 lemma frag_split:
   fixes c :: "'a \<Rightarrow>\<^sub>0 int"
   assumes "Poly_Mapping.keys c \<subseteq> S \<union> T"
   obtains d e where "Poly_Mapping.keys d \<subseteq> S" "Poly_Mapping.keys e \<subseteq> T" "d + e = c"
 proof 
   let ?d = "frag_extend (\<lambda>f. if f \<in> S then frag_of f else 0) c"
   let ?e = "frag_extend (\<lambda>f. if f \<in> S then 0 else frag_of f) c"
   show "Poly_Mapping.keys ?d \<subseteq> S" "Poly_Mapping.keys ?e \<subseteq> T"
     using assms by (auto intro!: order_trans [OF keys_frag_extend] split: if_split_asm)
   show "?d + ?e = c"
     using assms
   proof (induction c rule: frag_induction)
     case (diff a b)
     then show ?case
       by (metis (no_types, lifting) frag_extend_diff add_diff_eq diff_add_eq diff_add_eq_diff_diff_swap)
   qed auto
 qed
 
 hide_const (open) lookup single update keys range map map_key degree nth the_value items foldr mapp
 
 end
\ No newline at end of file
diff --git a/src/HOL/Library/Ramsey.thy b/src/HOL/Library/Ramsey.thy
--- a/src/HOL/Library/Ramsey.thy
+++ b/src/HOL/Library/Ramsey.thy
@@ -1,1002 +1,1002 @@
 (*  Title:      HOL/Library/Ramsey.thy
     Author:     Tom Ridge. Full finite version by L C Paulson.
 *)
 
 section \<open>Ramsey's Theorem\<close>
 
 theory Ramsey
   imports Infinite_Set FuncSet
 begin
 
 subsection \<open>Preliminary definitions\<close>
 
 abbreviation strict_sorted :: "'a::linorder list \<Rightarrow> bool" where
   "strict_sorted \<equiv> sorted_wrt (<)" 
 
 subsubsection \<open>The $n$-element subsets of a set $A$\<close>
 
 definition nsets :: "['a set, nat] \<Rightarrow> 'a set set" ("([_]\<^bsup>_\<^esup>)" [0,999] 999)
   where "nsets A n \<equiv> {N. N \<subseteq> A \<and> finite N \<and> card N = n}"
 
 lemma nsets_mono: "A \<subseteq> B \<Longrightarrow> nsets A n \<subseteq> nsets B n"
   by (auto simp: nsets_def)
 
 lemma nsets_Pi_contra: "A' \<subseteq> A \<Longrightarrow> Pi ([A]\<^bsup>n\<^esup>) B \<subseteq> Pi ([A']\<^bsup>n\<^esup>) B"
   by (auto simp: nsets_def)
 
 lemma nsets_2_eq: "nsets A 2 = (\<Union>x\<in>A. \<Union>y\<in>A - {x}. {{x, y}})"
   by (auto simp: nsets_def card_2_iff)
 
 lemma nsets_doubleton_2_eq [simp]: "[{x, y}]\<^bsup>2\<^esup> = (if x=y then {} else {{x, y}})"
   by (auto simp: nsets_2_eq)
 
 lemma doubleton_in_nsets_2 [simp]: "{x,y} \<in> [A]\<^bsup>2\<^esup> \<longleftrightarrow> x \<in> A \<and> y \<in> A \<and> x \<noteq> y"
   by (auto simp: nsets_2_eq Set.doubleton_eq_iff)
 
 lemma nsets_3_eq: "nsets A 3 = (\<Union>x\<in>A. \<Union>y\<in>A - {x}. \<Union>z\<in>A - {x,y}. {{x,y,z}})"
   by (simp add: eval_nat_numeral nsets_def card_Suc_eq) blast
 
 lemma nsets_4_eq: "[A]\<^bsup>4\<^esup> = (\<Union>u\<in>A. \<Union>x\<in>A - {u}. \<Union>y\<in>A - {u,x}. \<Union>z\<in>A - {u,x,y}. {{u,x,y,z}})"
      (is "_ = ?rhs")
 proof
   show "[A]\<^bsup>4\<^esup> \<subseteq> ?rhs"
     by (clarsimp simp add: nsets_def eval_nat_numeral card_Suc_eq) blast
   show "?rhs \<subseteq> [A]\<^bsup>4\<^esup>"
     apply (clarsimp simp add: nsets_def eval_nat_numeral card_Suc_eq)
     by (metis insert_iff singletonD)
 qed
 
 lemma nsets_disjoint_2:
   "X \<inter> Y = {} \<Longrightarrow> [X \<union> Y]\<^bsup>2\<^esup> = [X]\<^bsup>2\<^esup> \<union> [Y]\<^bsup>2\<^esup> \<union> (\<Union>x\<in>X. \<Union>y\<in>Y. {{x,y}})"
   by (fastforce simp: nsets_2_eq Set.doubleton_eq_iff)
 
 lemma ordered_nsets_2_eq:
   fixes A :: "'a::linorder set"
   shows "nsets A 2 = {{x,y} | x y. x \<in> A \<and> y \<in> A \<and> x<y}"
      (is "_ = ?rhs")
 proof
   show "nsets A 2 \<subseteq> ?rhs"
     unfolding numeral_nat
     apply (clarsimp simp add: nsets_def card_Suc_eq Set.doubleton_eq_iff not_less)
     by (metis antisym)
   show "?rhs \<subseteq> nsets A 2"
     unfolding numeral_nat by (auto simp: nsets_def card_Suc_eq)
 qed
 
 lemma ordered_nsets_3_eq:
   fixes A :: "'a::linorder set"
   shows "nsets A 3 = {{x,y,z} | x y z. x \<in> A \<and> y \<in> A \<and> z \<in> A \<and> x<y \<and> y<z}"
      (is "_ = ?rhs")
 proof
   show "nsets A 3 \<subseteq> ?rhs"
     apply (clarsimp simp add: nsets_def card_Suc_eq eval_nat_numeral)
     by (metis insert_commute linorder_cases)
   show "?rhs \<subseteq> nsets A 3"
     apply (clarsimp simp add: nsets_def card_Suc_eq eval_nat_numeral)
   by (metis empty_iff insert_iff not_less_iff_gr_or_eq)
 qed
 
 lemma ordered_nsets_4_eq:
   fixes A :: "'a::linorder set"
   shows "[A]\<^bsup>4\<^esup> = {U. \<exists>u x y z. U = {u,x,y,z} \<and> u \<in> A \<and> x \<in> A \<and> y \<in> A \<and> z \<in> A \<and> u < x \<and> x < y \<and> y < z}"
     (is "_ = Collect ?RHS")
 proof -
   { fix U
     assume "U \<in> [A]\<^bsup>4\<^esup>"
     then obtain l where "strict_sorted l" "List.set l = U" "length l = 4" "U \<subseteq> A"
       by (simp add: nsets_def) (metis finite_set_strict_sorted)
     then have "?RHS U"
       unfolding numeral_nat length_Suc_conv by auto blast }
   moreover
   have "Collect ?RHS \<subseteq> [A]\<^bsup>4\<^esup>"
     apply (clarsimp simp add: nsets_def eval_nat_numeral)
     apply (subst card_insert_disjoint, auto)+
     done
   ultimately show ?thesis
     by auto
 qed
 
 lemma ordered_nsets_5_eq:
   fixes A :: "'a::linorder set"
   shows "[A]\<^bsup>5\<^esup> = {U. \<exists>u v x y z. U = {u,v,x,y,z} \<and> u \<in> A \<and> v \<in> A \<and> x \<in> A \<and> y \<in> A \<and> z \<in> A \<and> u < v \<and> v < x \<and> x < y \<and> y < z}"
     (is "_ = Collect ?RHS")
 proof -
   { fix U
   assume "U \<in> [A]\<^bsup>5\<^esup>"
   then obtain l where "strict_sorted l" "List.set l = U" "length l = 5" "U \<subseteq> A"
     apply (simp add: nsets_def)
     by (metis finite_set_strict_sorted)
   then have "?RHS U"
     unfolding numeral_nat length_Suc_conv by auto blast }
   moreover
   have "Collect ?RHS \<subseteq> [A]\<^bsup>5\<^esup>"
     apply (clarsimp simp add: nsets_def eval_nat_numeral)
     apply (subst card_insert_disjoint, auto)+
     done
   ultimately show ?thesis
     by auto
 qed
 
 lemma binomial_eq_nsets: "n choose k = card (nsets {0..<n} k)"
   apply (simp add: binomial_def nsets_def)
   by (meson subset_eq_atLeast0_lessThan_finite)
 
 lemma nsets_eq_empty_iff: "nsets A r = {} \<longleftrightarrow> finite A \<and> card A < r"
   unfolding nsets_def
 proof (intro iffI conjI)
   assume that: "{N. N \<subseteq> A \<and> finite N \<and> card N = r} = {}"
   show "finite A"
     using infinite_arbitrarily_large that by auto
   then have "\<not> r \<le> card A"
     using that by (simp add: set_eq_iff) (metis obtain_subset_with_card_n)
   then show "card A < r"
     using not_less by blast
 next
   show "{N. N \<subseteq> A \<and> finite N \<and> card N = r} = {}"
     if "finite A \<and> card A < r"
     using that card_mono leD by auto
 qed
 
 lemma nsets_eq_empty: "\<lbrakk>finite A; card A < r\<rbrakk> \<Longrightarrow> nsets A r = {}"
   by (simp add: nsets_eq_empty_iff)
 
 lemma nsets_empty_iff: "nsets {} r = (if r=0 then {{}} else {})"
   by (auto simp: nsets_def)
 
 lemma nsets_singleton_iff: "nsets {a} r = (if r=0 then {{}} else if r=1 then {{a}} else {})"
   by (auto simp: nsets_def card_gt_0_iff subset_singleton_iff)
 
 lemma nsets_self [simp]: "nsets {..<m} m = {{..<m}}"
   unfolding nsets_def
   apply auto
   by (metis add.left_neutral lessThan_atLeast0 lessThan_iff subset_card_intvl_is_intvl)
 
 lemma nsets_zero [simp]: "nsets A 0 = {{}}"
   by (auto simp: nsets_def)
 
 lemma nsets_one: "nsets A (Suc 0) = (\<lambda>x. {x}) ` A"
   using card_eq_SucD by (force simp: nsets_def)
 
 lemma inj_on_nsets:
   assumes "inj_on f A"
   shows "inj_on (\<lambda>X. f ` X) ([A]\<^bsup>n\<^esup>)"
   using assms unfolding nsets_def
   by (metis (no_types, lifting) inj_on_inverseI inv_into_image_cancel mem_Collect_eq)
 
 lemma bij_betw_nsets:
   assumes "bij_betw f A B"
   shows "bij_betw (\<lambda>X. f ` X) ([A]\<^bsup>n\<^esup>) ([B]\<^bsup>n\<^esup>)"
 proof -
   have "(`) f ` [A]\<^bsup>n\<^esup> = [f ` A]\<^bsup>n\<^esup>"
     using assms
     apply (auto simp: nsets_def bij_betw_def image_iff card_image inj_on_subset)
     by (metis card_image inj_on_finite order_refl subset_image_inj)
   with assms show ?thesis
     by (auto simp: bij_betw_def inj_on_nsets)
 qed
 
 lemma nset_image_obtains:
   assumes "X \<in> [f`A]\<^bsup>k\<^esup>" "inj_on f A"
   obtains Y where "Y \<in> [A]\<^bsup>k\<^esup>" "X = f ` Y"
   using assms
   apply (clarsimp simp add: nsets_def subset_image_iff)
   by (metis card_image finite_imageD inj_on_subset)
 
 lemma nsets_image_funcset:
   assumes "g \<in> S \<rightarrow> T" and "inj_on g S"
   shows "(\<lambda>X. g ` X) \<in> [S]\<^bsup>k\<^esup> \<rightarrow> [T]\<^bsup>k\<^esup>"
     using assms
     by (fastforce simp add: nsets_def card_image inj_on_subset subset_iff simp flip: image_subset_iff_funcset)
 
 lemma nsets_compose_image_funcset:
   assumes f: "f \<in> [T]\<^bsup>k\<^esup> \<rightarrow> D" and "g \<in> S \<rightarrow> T" and "inj_on g S"
   shows "f \<circ> (\<lambda>X. g ` X) \<in> [S]\<^bsup>k\<^esup> \<rightarrow> D"
 proof -
   have "(\<lambda>X. g ` X) \<in> [S]\<^bsup>k\<^esup> \<rightarrow> [T]\<^bsup>k\<^esup>"
     using assms by (simp add: nsets_image_funcset)
   then show ?thesis
     using f by fastforce
 qed
 
 subsubsection \<open>Partition predicates\<close>
 
 definition partn :: "'a set \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> 'b set \<Rightarrow> bool"
   where "partn \<beta> \<alpha> \<gamma> \<delta> \<equiv> \<forall>f \<in> nsets \<beta> \<gamma>  \<rightarrow>  \<delta>. \<exists>H \<in> nsets \<beta> \<alpha>. \<exists>\<xi>\<in>\<delta>. f ` (nsets H \<gamma>) \<subseteq> {\<xi>}"
 
 definition partn_lst :: "'a set \<Rightarrow> nat list \<Rightarrow> nat \<Rightarrow> bool"
   where "partn_lst \<beta> \<alpha> \<gamma> \<equiv> \<forall>f \<in> nsets \<beta> \<gamma>  \<rightarrow>  {..<length \<alpha>}.
               \<exists>i < length \<alpha>. \<exists>H \<in> nsets \<beta> (\<alpha>!i). f ` (nsets H \<gamma>) \<subseteq> {i}"
 
 lemma partn_lst_greater_resource:
   fixes M::nat
   assumes M: "partn_lst {..<M} \<alpha> \<gamma>" and "M \<le> N"
   shows "partn_lst {..<N} \<alpha> \<gamma>"
 proof (clarsimp simp: partn_lst_def)
   fix f
   assume "f \<in> nsets {..<N} \<gamma> \<rightarrow> {..<length \<alpha>}"
   then have "f \<in> nsets {..<M} \<gamma> \<rightarrow> {..<length \<alpha>}"
     by (meson Pi_anti_mono \<open>M \<le> N\<close> lessThan_subset_iff nsets_mono subsetD)
   then obtain i H where i: "i < length \<alpha>" and H: "H \<in> nsets {..<M} (\<alpha> ! i)" and subi: "f ` nsets H \<gamma> \<subseteq> {i}"
     using M partn_lst_def by blast
   have "H \<in> nsets {..<N} (\<alpha> ! i)"
     using \<open>M \<le> N\<close> H by (auto simp: nsets_def subset_iff)
   then show "\<exists>i<length \<alpha>. \<exists>H\<in>nsets {..<N} (\<alpha> ! i). f ` nsets H \<gamma> \<subseteq> {i}"
     using i subi by blast
 qed
 
 lemma partn_lst_fewer_colours:
   assumes major: "partn_lst \<beta> (n#\<alpha>) \<gamma>" and "n \<ge> \<gamma>"
   shows "partn_lst \<beta> \<alpha> \<gamma>"
 proof (clarsimp simp: partn_lst_def)
   fix f :: "'a set \<Rightarrow> nat"
   assume f: "f \<in> [\<beta>]\<^bsup>\<gamma>\<^esup> \<rightarrow> {..<length \<alpha>}"
   then obtain i H where i: "i < Suc (length \<alpha>)"
       and H: "H \<in> [\<beta>]\<^bsup>((n # \<alpha>) ! i)\<^esup>"
       and hom: "\<forall>x\<in>[H]\<^bsup>\<gamma>\<^esup>. Suc (f x) = i"
     using \<open>n \<ge> \<gamma>\<close> major [unfolded partn_lst_def, rule_format, of "Suc o f"]
     by (fastforce simp: image_subset_iff nsets_eq_empty_iff)
   show "\<exists>i<length \<alpha>. \<exists>H\<in>nsets \<beta> (\<alpha> ! i). f ` [H]\<^bsup>\<gamma>\<^esup> \<subseteq> {i}"
   proof (cases i)
     case 0
     then have "[H]\<^bsup>\<gamma>\<^esup> = {}"
       using hom by blast
     then show ?thesis
       using 0 H \<open>n \<ge> \<gamma>\<close>
       by (simp add: nsets_eq_empty_iff) (simp add: nsets_def)
   next
     case (Suc i')
     then show ?thesis
       using i H hom by auto
   qed
 qed
 
 lemma partn_lst_eq_partn: "partn_lst {..<n} [m,m] 2 = partn {..<n} m 2 {..<2::nat}"
   apply (simp add: partn_lst_def partn_def numeral_2_eq_2)
   by (metis less_2_cases numeral_2_eq_2 lessThan_iff nth_Cons_0 nth_Cons_Suc)
 
 
 subsection \<open>Finite versions of Ramsey's theorem\<close>
 
 text \<open>
   To distinguish the finite and infinite ones, lower and upper case
   names are used.
 \<close>
 
 subsubsection \<open>Trivial cases\<close>
 
 text \<open>Vacuous, since we are dealing with 0-sets!\<close>
 lemma ramsey0: "\<exists>N::nat. partn_lst {..<N} [q1,q2] 0"
   by (force simp: partn_lst_def ex_in_conv less_Suc_eq nsets_eq_empty_iff)
 
 text \<open>Just the pigeon hole principle, since we are dealing with 1-sets\<close>
 lemma ramsey1: "\<exists>N::nat. partn_lst {..<N} [q0,q1] 1"
 proof -
   have "\<exists>i<Suc (Suc 0). \<exists>H\<in>nsets {..<Suc (q0 + q1)} ([q0, q1] ! i). f ` nsets H (Suc 0) \<subseteq> {i}"
     if "f \<in> nsets {..<Suc (q0 + q1)} (Suc 0) \<rightarrow> {..<Suc (Suc 0)}" for f
   proof -
     define A where "A \<equiv> \<lambda>i. {q. q \<le> q0+q1 \<and> f {q} = i}"
     have "A 0 \<union> A 1 = {..q0 + q1}"
       using that by (auto simp: A_def PiE_iff nsets_one lessThan_Suc_atMost le_Suc_eq)
     moreover have "A 0 \<inter> A 1 = {}"
       by (auto simp: A_def)
     ultimately have "q0 + q1 \<le> card (A 0) + card (A 1)"
       by (metis card_Un_le card_atMost eq_imp_le le_SucI le_trans)
     then consider "card (A 0) \<ge> q0" | "card (A 1) \<ge> q1"
       by linarith
     then obtain i where "i < Suc (Suc 0)" "card (A i) \<ge> [q0, q1] ! i"
       by (metis One_nat_def lessI nth_Cons_0 nth_Cons_Suc zero_less_Suc)
     then obtain B where "B \<subseteq> A i" "card B = [q0, q1] ! i" "finite B"
       by (meson obtain_subset_with_card_n)
     then have "B \<in> nsets {..<Suc (q0 + q1)} ([q0, q1] ! i) \<and> f ` nsets B (Suc 0) \<subseteq> {i}"
       by (auto simp: A_def nsets_def card_1_singleton_iff)
     then show ?thesis
       using \<open>i < Suc (Suc 0)\<close> by auto
   qed
   then show ?thesis
     by (clarsimp simp: partn_lst_def) blast
 qed
 
 
 subsubsection \<open>Ramsey's theorem with two colours and arbitrary exponents (hypergraph version)\<close>
 
 proposition ramsey2_full: "\<exists>N::nat. partn_lst {..<N} [q1,q2] r"
 proof (induction r arbitrary: q1 q2)
   case 0
   then show ?case
     by (simp add: ramsey0)
 next
   case (Suc r)
   note outer = this
   show ?case
   proof (cases "r = 0")
     case True
     then show ?thesis
       using ramsey1 by auto
   next
     case False
     then have "r > 0"
       by simp
     show ?thesis
       using Suc.prems
     proof (induct k \<equiv> "q1 + q2" arbitrary: q1 q2)
       case 0
       show ?case
       proof
         show "partn_lst {..<1::nat} [q1, q2] (Suc r)"
           using nsets_empty_iff subset_insert 0
           by (fastforce simp: partn_lst_def funcset_to_empty_iff nsets_eq_empty image_subset_iff)
       qed
     next
       case (Suc k)
       consider "q1 = 0 \<or> q2 = 0" | "q1 \<noteq> 0" "q2 \<noteq> 0" by auto
       then show ?case
       proof cases
         case 1
         then have "partn_lst {..< Suc 0} [q1, q2] (Suc r)"
           unfolding partn_lst_def using \<open>r > 0\<close>
           by (fastforce simp add: nsets_empty_iff nsets_singleton_iff lessThan_Suc)
         then show ?thesis by blast
       next
         case 2
         with Suc have "k = (q1 - 1) + q2" "k = q1 + (q2 - 1)" by auto
         then obtain p1 p2::nat where  p1: "partn_lst {..<p1} [q1-1,q2] (Suc r)" and p2: "partn_lst {..<p2} [q1,q2-1] (Suc r)"
           using Suc.hyps by blast
         then obtain p::nat where p: "partn_lst {..<p} [p1,p2] r"
           using outer Suc.prems by auto
         show ?thesis
         proof (intro exI conjI)
           have "\<exists>i<Suc (Suc 0). \<exists>H\<in>nsets {..p} ([q1,q2] ! i). f ` nsets H (Suc r) \<subseteq> {i}"
             if f: "f \<in> nsets {..p} (Suc r) \<rightarrow> {..<Suc (Suc 0)}" for f
           proof -
             define g where "g \<equiv> \<lambda>R. f (insert p R)"
             have "f (insert p i) \<in> {..<Suc (Suc 0)}" if "i \<in> nsets {..<p} r" for i
               using that card_insert_if by (fastforce simp: nsets_def intro!: Pi_mem [OF f])
             then have g: "g \<in> nsets {..<p} r \<rightarrow> {..<Suc (Suc 0)}"
               by (force simp: g_def PiE_iff)
             then obtain i U where i: "i < Suc (Suc 0)" and gi: "g ` nsets U r \<subseteq> {i}"
               and U: "U \<in> nsets {..<p} ([p1, p2] ! i)"
               using p by (auto simp: partn_lst_def)
             then have Usub: "U \<subseteq> {..<p}"
               by (auto simp: nsets_def)
             consider (izero) "i = 0" | (ione) "i = Suc 0"
               using i by linarith
             then show ?thesis
             proof cases
               case izero
               then have "U \<in> nsets {..<p} p1"
                 using U by simp
               then obtain u where u: "bij_betw u {..<p1} U"
                 using ex_bij_betw_nat_finite lessThan_atLeast0 by (fastforce simp add: nsets_def)
               have u_nsets: "u ` X \<in> nsets {..p} n" if "X \<in> nsets {..<p1} n" for X n
               proof -
                 have "inj_on u X"
                   using u that bij_betw_imp_inj_on inj_on_subset by (force simp: nsets_def)
                 then show ?thesis
                   using Usub u that bij_betwE
                   by (fastforce simp add: nsets_def card_image)
               qed
               define h where "h \<equiv> \<lambda>R. f (u ` R)"
               have "h \<in> nsets {..<p1} (Suc r) \<rightarrow> {..<Suc (Suc 0)}"
                 unfolding h_def using f u_nsets by auto
               then obtain j V where j: "j <Suc (Suc 0)" and hj: "h ` nsets V (Suc r) \<subseteq> {j}"
                 and V: "V \<in> nsets {..<p1} ([q1 - Suc 0, q2] ! j)"
                 using p1 by (auto simp: partn_lst_def)
               then have Vsub: "V \<subseteq> {..<p1}"
                 by (auto simp: nsets_def)
               have invinv_eq: "u ` inv_into {..<p1} u ` X = X" if "X \<subseteq> u ` {..<p1}" for X
                 by (simp add: image_inv_into_cancel that)
               let ?W = "insert p (u ` V)"
               consider (jzero) "j = 0" | (jone) "j = Suc 0"
                 using j by linarith
               then show ?thesis
               proof cases
                 case jzero
                 then have "V \<in> nsets {..<p1} (q1 - Suc 0)"
                   using V by simp
                 then have "u ` V \<in> nsets {..<p} (q1 - Suc 0)"
                   using u_nsets [of _ "q1 - Suc 0"] nsets_mono [OF Vsub] Usub u
                   unfolding bij_betw_def nsets_def
                   by (fastforce elim!: subsetD)
                 then have inq1: "?W \<in> nsets {..p} q1"
                   unfolding nsets_def using \<open>q1 \<noteq> 0\<close> card_insert_if by fastforce
                 have invu_nsets: "inv_into {..<p1} u ` X \<in> nsets V r"
                   if "X \<in> nsets (u ` V) r" for X r
                 proof -
                   have "X \<subseteq> u ` V \<and> finite X \<and> card X = r"
                     using nsets_def that by auto
                   then have [simp]: "card (inv_into {..<p1} u ` X) = card X"
                     by (meson Vsub bij_betw_def bij_betw_inv_into card_image image_mono inj_on_subset u)
                   show ?thesis
                     using that u Vsub by (fastforce simp: nsets_def bij_betw_def)
                 qed
                 have "f X = i" if X: "X \<in> nsets ?W (Suc r)" for X
                 proof (cases "p \<in> X")
                   case True
                   then have Xp: "X - {p} \<in> nsets (u ` V) r"
                     using X by (auto simp: nsets_def)
                   moreover have "u ` V \<subseteq> U"
                     using Vsub bij_betwE u by blast
                   ultimately have "X - {p} \<in> nsets U r"
                     by (meson in_mono nsets_mono)
                   then have "g (X - {p}) = i"
                     using gi by blast
                   have "f X = i"
                     using gi True \<open>X - {p} \<in> nsets U r\<close> insert_Diff
                     by (fastforce simp add: g_def image_subset_iff)
                   then show ?thesis
                     by (simp add: \<open>f X = i\<close> \<open>g (X - {p}) = i\<close>)
                 next
                   case False
                   then have Xim: "X \<in> nsets (u ` V) (Suc r)"
                     using X by (auto simp: nsets_def subset_insert)
                   then have "u ` inv_into {..<p1} u ` X = X"
                     using Vsub bij_betw_imp_inj_on u
                     by (fastforce simp: nsets_def image_mono invinv_eq subset_trans)
                   then show ?thesis
                     using izero jzero hj Xim invu_nsets unfolding h_def
                     by (fastforce simp add: image_subset_iff)
                 qed
                 moreover have "insert p (u ` V) \<in> nsets {..p} q1"
                   by (simp add: izero inq1)
                 ultimately show ?thesis
                   by (metis izero image_subsetI insertI1 nth_Cons_0 zero_less_Suc)
               next
                 case jone
                 then have "u ` V \<in> nsets {..p} q2"
                   using V u_nsets by auto
                 moreover have "f ` nsets (u ` V) (Suc r) \<subseteq> {j}"
                   using hj
                   by (force simp add: h_def image_subset_iff nsets_def subset_image_inj card_image dest: finite_imageD)
                 ultimately show ?thesis
                   using jone not_less_eq by fastforce
               qed
             next
               case ione
               then have "U \<in> nsets {..<p} p2"
                 using U by simp
               then obtain u where u: "bij_betw u {..<p2} U"
                 using ex_bij_betw_nat_finite lessThan_atLeast0 by (fastforce simp add: nsets_def)
               have u_nsets: "u ` X \<in> nsets {..p} n" if "X \<in> nsets {..<p2} n" for X n
               proof -
                 have "inj_on u X"
                   using u that bij_betw_imp_inj_on inj_on_subset by (force simp: nsets_def)
                 then show ?thesis
                   using Usub u that bij_betwE
                   by (fastforce simp add: nsets_def card_image)
               qed
               define h where "h \<equiv> \<lambda>R. f (u ` R)"
               have "h \<in> nsets {..<p2} (Suc r) \<rightarrow> {..<Suc (Suc 0)}"
                 unfolding h_def using f u_nsets by auto
               then obtain j V where j: "j <Suc (Suc 0)" and hj: "h ` nsets V (Suc r) \<subseteq> {j}"
                 and V: "V \<in> nsets {..<p2} ([q1, q2 - Suc 0] ! j)"
                 using p2 by (auto simp: partn_lst_def)
               then have Vsub: "V \<subseteq> {..<p2}"
                 by (auto simp: nsets_def)
               have invinv_eq: "u ` inv_into {..<p2} u ` X = X" if "X \<subseteq> u ` {..<p2}" for X
                 by (simp add: image_inv_into_cancel that)
               let ?W = "insert p (u ` V)"
               consider (jzero) "j = 0" | (jone) "j = Suc 0"
                 using j by linarith
               then show ?thesis
               proof cases
                 case jone
                 then have "V \<in> nsets {..<p2} (q2 - Suc 0)"
                   using V by simp
                 then have "u ` V \<in> nsets {..<p} (q2 - Suc 0)"
                   using u_nsets [of _ "q2 - Suc 0"] nsets_mono [OF Vsub] Usub u
                   unfolding bij_betw_def nsets_def
                   by (fastforce elim!: subsetD)
                 then have inq1: "?W \<in> nsets {..p} q2"
                   unfolding nsets_def using \<open>q2 \<noteq> 0\<close> card_insert_if by fastforce
                 have invu_nsets: "inv_into {..<p2} u ` X \<in> nsets V r"
                   if "X \<in> nsets (u ` V) r" for X r
                 proof -
                   have "X \<subseteq> u ` V \<and> finite X \<and> card X = r"
                     using nsets_def that by auto
                   then have [simp]: "card (inv_into {..<p2} u ` X) = card X"
                     by (meson Vsub bij_betw_def bij_betw_inv_into card_image image_mono inj_on_subset u)
                   show ?thesis
                     using that u Vsub by (fastforce simp: nsets_def bij_betw_def)
                 qed
                 have "f X = i" if X: "X \<in> nsets ?W (Suc r)" for X
                 proof (cases "p \<in> X")
                   case True
                   then have Xp: "X - {p} \<in> nsets (u ` V) r"
                     using X by (auto simp: nsets_def)
                   moreover have "u ` V \<subseteq> U"
                     using Vsub bij_betwE u by blast
                   ultimately have "X - {p} \<in> nsets U r"
                     by (meson in_mono nsets_mono)
                   then have "g (X - {p}) = i"
                     using gi by blast
                   have "f X = i"
                     using gi True \<open>X - {p} \<in> nsets U r\<close> insert_Diff
                     by (fastforce simp add: g_def image_subset_iff)
                   then show ?thesis
                     by (simp add: \<open>f X = i\<close> \<open>g (X - {p}) = i\<close>)
                 next
                   case False
                   then have Xim: "X \<in> nsets (u ` V) (Suc r)"
                     using X by (auto simp: nsets_def subset_insert)
                   then have "u ` inv_into {..<p2} u ` X = X"
                     using Vsub bij_betw_imp_inj_on u
                     by (fastforce simp: nsets_def image_mono invinv_eq subset_trans)
                   then show ?thesis
                     using ione jone hj Xim invu_nsets unfolding h_def
                     by (fastforce simp add: image_subset_iff)
                 qed
                 moreover have "insert p (u ` V) \<in> nsets {..p} q2"
                   by (simp add: ione inq1)
                 ultimately show ?thesis
                   by (metis ione image_subsetI insertI1 lessI nth_Cons_0 nth_Cons_Suc)
               next
                 case jzero
                 then have "u ` V \<in> nsets {..p} q1"
                   using V u_nsets by auto
                 moreover have "f ` nsets (u ` V) (Suc r) \<subseteq> {j}"
                   using hj
                   apply (clarsimp simp add: h_def image_subset_iff nsets_def)
                   by (metis Zero_not_Suc card_eq_0_iff card_image subset_image_inj)
                 ultimately show ?thesis
                   using jzero not_less_eq by fastforce
               qed
             qed
           qed
           then show "partn_lst {..<Suc p} [q1,q2] (Suc r)"
             using lessThan_Suc lessThan_Suc_atMost by (auto simp: partn_lst_def insert_commute)
         qed
       qed
     qed
   qed
 qed
 
 subsubsection \<open>Full Ramsey's theorem with multiple colours and arbitrary exponents\<close>
 
 theorem ramsey_full: "\<exists>N::nat. partn_lst {..<N} qs r"
 proof (induction k \<equiv> "length qs" arbitrary: qs)
   case 0
   then show ?case
     by (rule_tac x=" r" in exI) (simp add: partn_lst_def)
 next
   case (Suc k)
   note IH = this
   show ?case
   proof (cases k)
     case 0
     with Suc obtain q where "qs = [q]"
       by (metis length_0_conv length_Suc_conv)
     then show ?thesis
       by (rule_tac x=q in exI) (auto simp: partn_lst_def funcset_to_empty_iff)
   next
     case (Suc k')
     then obtain q1 q2 l where qs: "qs = q1#q2#l"
       by (metis Suc.hyps(2) length_Suc_conv)
     then obtain q::nat where q: "partn_lst {..<q} [q1,q2] r"
       using ramsey2_full by blast
     then obtain p::nat where p: "partn_lst {..<p} (q#l) r"
       using IH \<open>qs = q1 # q2 # l\<close> by fastforce
     have keq: "Suc (length l) = k"
       using IH qs by auto
     show ?thesis
     proof (intro exI conjI)
       show "partn_lst {..<p} qs r"
       proof (auto simp: partn_lst_def)
         fix f
         assume f: "f \<in> nsets {..<p} r \<rightarrow> {..<length qs}"
         define g where "g \<equiv> \<lambda>X. if f X < Suc (Suc 0) then 0 else f X - Suc 0"
         have "g \<in> nsets {..<p} r \<rightarrow> {..<k}"
           unfolding g_def using f Suc IH
           by (auto simp: Pi_def not_less)
         then obtain i U where i: "i < k" and gi: "g ` nsets U r \<subseteq> {i}"
                 and U: "U \<in> nsets {..<p} ((q#l) ! i)"
           using p keq by (auto simp: partn_lst_def)
         show "\<exists>i<length qs. \<exists>H\<in>nsets {..<p} (qs ! i). f ` nsets H r \<subseteq> {i}"
         proof (cases "i = 0")
           case True
           then have "U \<in> nsets {..<p} q" and f01: "f ` nsets U r \<subseteq> {0, Suc 0}"
             using U gi unfolding g_def by (auto simp: image_subset_iff)
           then obtain u where u: "bij_betw u {..<q} U"
             using ex_bij_betw_nat_finite lessThan_atLeast0 by (fastforce simp add: nsets_def)
           then have Usub: "U \<subseteq> {..<p}"
             by (smt (verit) U mem_Collect_eq nsets_def)
           have u_nsets: "u ` X \<in> nsets {..<p} n" if "X \<in> nsets {..<q} n" for X n
           proof -
             have "inj_on u X"
               using u that bij_betw_imp_inj_on inj_on_subset
               by (force simp: nsets_def)
             then show ?thesis
               using Usub u that bij_betwE
               by (fastforce simp add: nsets_def card_image)
           qed
           define h where "h \<equiv> \<lambda>X. f (u ` X)"
           have "f (u ` X) < Suc (Suc 0)" if "X \<in> nsets {..<q} r" for X
           proof -
             have "u ` X \<in> nsets U r"
               using u u_nsets that by (auto simp: nsets_def bij_betwE subset_eq)
             then show ?thesis
               using f01 by auto
           qed
           then have "h \<in> nsets {..<q} r \<rightarrow> {..<Suc (Suc 0)}"
             unfolding h_def by blast
           then obtain j V where j: "j < Suc (Suc 0)" and hj: "h ` nsets V r \<subseteq> {j}"
             and V: "V \<in> nsets {..<q} ([q1,q2] ! j)"
             using q by (auto simp: partn_lst_def)
           show ?thesis
           proof (intro exI conjI bexI)
             show "j < length qs"
               using Suc Suc.hyps(2) j by linarith
             have "nsets (u ` V) r \<subseteq> (\<lambda>x. (u ` x)) ` nsets V r"
               apply (clarsimp simp add: nsets_def image_iff)
               by (metis card_eq_0_iff card_image image_is_empty subset_image_inj)
             then have "f ` nsets (u ` V) r \<subseteq> h ` nsets V r"
               by (auto simp: h_def)
             then show "f ` nsets (u ` V) r \<subseteq> {j}"
               using hj by auto
             show "(u ` V) \<in> nsets {..<p} (qs ! j)"
               using V j less_2_cases numeral_2_eq_2 qs u_nsets by fastforce
           qed
         next
           case False
           show ?thesis
           proof (intro exI conjI bexI)
             show "Suc i < length qs"
               using Suc.hyps(2) i by auto
             show "f ` nsets U r \<subseteq> {Suc i}"
               using i gi False
               apply (auto simp: g_def image_subset_iff)
               by (metis Suc_lessD Suc_pred g_def gi image_subset_iff not_less_eq singleton_iff)
             show "U \<in> nsets {..<p} (qs ! (Suc i))"
               using False U qs by auto
           qed
         qed
       qed
     qed
   qed
 qed
 
 subsubsection \<open>Simple graph version\<close>
 
 text \<open>This is the most basic version in terms of cliques and independent
   sets, i.e. the version for graphs and 2 colours.
 \<close>
 
 definition "clique V E \<longleftrightarrow> (\<forall>v\<in>V. \<forall>w\<in>V. v \<noteq> w \<longrightarrow> {v, w} \<in> E)"
 definition "indep V E \<longleftrightarrow> (\<forall>v\<in>V. \<forall>w\<in>V. v \<noteq> w \<longrightarrow> {v, w} \<notin> E)"
 
 lemma ramsey2:
   "\<exists>r\<ge>1. \<forall>(V::'a set) (E::'a set set). finite V \<and> card V \<ge> r \<longrightarrow>
     (\<exists>R \<subseteq> V. card R = m \<and> clique R E \<or> card R = n \<and> indep R E)"
 proof -
   obtain N where "N \<ge> Suc 0" and N: "partn_lst {..<N} [m,n] 2"
     using ramsey2_full nat_le_linear partn_lst_greater_resource by blast
   have "\<exists>R\<subseteq>V. card R = m \<and> clique R E \<or> card R = n \<and> indep R E"
     if "finite V" "N \<le> card V" for V :: "'a set" and E :: "'a set set"
   proof -
     from that
     obtain v where u: "inj_on v {..<N}" "v ` {..<N} \<subseteq> V"
       by (metis card_le_inj card_lessThan finite_lessThan)
     define f where "f \<equiv> \<lambda>e. if v ` e \<in> E then 0 else Suc 0"
     have f: "f \<in> nsets {..<N} 2 \<rightarrow> {..<Suc (Suc 0)}"
       by (simp add: f_def)
     then obtain i U where i: "i < 2" and gi: "f ` nsets U 2 \<subseteq> {i}"
       and U: "U \<in> nsets {..<N} ([m,n] ! i)"
       using N numeral_2_eq_2 by (auto simp: partn_lst_def)
     show ?thesis
     proof (intro exI conjI)
       show "v ` U \<subseteq> V"
         using U u by (auto simp: image_subset_iff nsets_def)
       show "card (v ` U) = m \<and> clique (v ` U) E \<or> card (v ` U) = n \<and> indep (v ` U) E"
         using i unfolding numeral_2_eq_2
           using gi U u
           apply (simp add: image_subset_iff nsets_2_eq clique_def indep_def less_Suc_eq)
           apply (auto simp: f_def nsets_def card_image inj_on_subset split: if_split_asm)
           done
     qed
   qed
   then show ?thesis
     using \<open>Suc 0 \<le> N\<close> by auto
 qed
 
 
 subsection \<open>Preliminaries\<close>
 
 subsubsection \<open>``Axiom'' of Dependent Choice\<close>
 
 primrec choice :: "('a \<Rightarrow> bool) \<Rightarrow> ('a \<times> 'a) set \<Rightarrow> nat \<Rightarrow> 'a"
   where \<comment> \<open>An integer-indexed chain of choices\<close>
     choice_0: "choice P r 0 = (SOME x. P x)"
   | choice_Suc: "choice P r (Suc n) = (SOME y. P y \<and> (choice P r n, y) \<in> r)"
 
 lemma choice_n:
   assumes P0: "P x0"
     and Pstep: "\<And>x. P x \<Longrightarrow> \<exists>y. P y \<and> (x, y) \<in> r"
   shows "P (choice P r n)"
 proof (induct n)
   case 0
   show ?case by (force intro: someI P0)
 next
   case Suc
   then show ?case by (auto intro: someI2_ex [OF Pstep])
 qed
 
 lemma dependent_choice:
   assumes trans: "trans r"
     and P0: "P x0"
     and Pstep: "\<And>x. P x \<Longrightarrow> \<exists>y. P y \<and> (x, y) \<in> r"
   obtains f :: "nat \<Rightarrow> 'a" where "\<And>n. P (f n)" and "\<And>n m. n < m \<Longrightarrow> (f n, f m) \<in> r"
 proof
   fix n
   show "P (choice P r n)"
     by (blast intro: choice_n [OF P0 Pstep])
 next
   fix n m :: nat
   assume "n < m"
   from Pstep [OF choice_n [OF P0 Pstep]] have "(choice P r k, choice P r (Suc k)) \<in> r" for k
     by (auto intro: someI2_ex)
   then show "(choice P r n, choice P r m) \<in> r"
     by (auto intro: less_Suc_induct [OF \<open>n < m\<close>] transD [OF trans])
 qed
 
 
 subsubsection \<open>Partition functions\<close>
 
 definition part_fn :: "nat \<Rightarrow> nat \<Rightarrow> 'a set \<Rightarrow> ('a set \<Rightarrow> nat) \<Rightarrow> bool"
   \<comment> \<open>the function \<^term>\<open>f\<close> partitions the \<^term>\<open>r\<close>-subsets of the typically
       infinite set \<^term>\<open>Y\<close> into \<^term>\<open>s\<close> distinct categories.\<close>
   where "part_fn r s Y f \<longleftrightarrow> (f \<in> nsets Y r \<rightarrow> {..<s})"
 
 text \<open>For induction, we decrease the value of \<^term>\<open>r\<close> in partitions.\<close>
 lemma part_fn_Suc_imp_part_fn:
   "\<lbrakk>infinite Y; part_fn (Suc r) s Y f; y \<in> Y\<rbrakk> \<Longrightarrow> part_fn r s (Y - {y}) (\<lambda>u. f (insert y u))"
   by (simp add: part_fn_def nsets_def Pi_def subset_Diff_insert)
 
 lemma part_fn_subset: "part_fn r s YY f \<Longrightarrow> Y \<subseteq> YY \<Longrightarrow> part_fn r s Y f"
   unfolding part_fn_def nsets_def by blast
 
 
 subsection \<open>Ramsey's Theorem: Infinitary Version\<close>
 
 lemma Ramsey_induction:
   fixes s r :: nat
     and YY :: "'a set"
     and f :: "'a set \<Rightarrow> nat"
   assumes "infinite YY" "part_fn r s YY f"
   shows "\<exists>Y' t'. Y' \<subseteq> YY \<and> infinite Y' \<and> t' < s \<and> (\<forall>X. X \<subseteq> Y' \<and> finite X \<and> card X = r \<longrightarrow> f X = t')"
   using assms
 proof (induct r arbitrary: YY f)
   case 0
   then show ?case
     by (auto simp add: part_fn_def card_eq_0_iff cong: conj_cong)
 next
   case (Suc r)
   show ?case
   proof -
     from Suc.prems infinite_imp_nonempty obtain yy where yy: "yy \<in> YY"
       by blast
     let ?ramr = "{((y, Y, t), (y', Y', t')). y' \<in> Y \<and> Y' \<subseteq> Y}"
     let ?propr = "\<lambda>(y, Y, t).
                  y \<in> YY \<and> y \<notin> Y \<and> Y \<subseteq> YY \<and> infinite Y \<and> t < s
                  \<and> (\<forall>X. X\<subseteq>Y \<and> finite X \<and> card X = r \<longrightarrow> (f \<circ> insert y) X = t)"
     from Suc.prems have infYY': "infinite (YY - {yy})" by auto
     from Suc.prems have partf': "part_fn r s (YY - {yy}) (f \<circ> insert yy)"
       by (simp add: o_def part_fn_Suc_imp_part_fn yy)
     have transr: "trans ?ramr" by (force simp add: trans_def)
     from Suc.hyps [OF infYY' partf']
     obtain Y0 and t0 where "Y0 \<subseteq> YY - {yy}" "infinite Y0" "t0 < s"
       "X \<subseteq> Y0 \<and> finite X \<and> card X = r \<longrightarrow> (f \<circ> insert yy) X = t0" for X
       by blast
     with yy have propr0: "?propr(yy, Y0, t0)" by blast
     have proprstep: "\<exists>y. ?propr y \<and> (x, y) \<in> ?ramr" if x: "?propr x" for x
     proof (cases x)
       case (fields yx Yx tx)
       with x obtain yx' where yx': "yx' \<in> Yx"
         by (blast dest: infinite_imp_nonempty)
       from fields x have infYx': "infinite (Yx - {yx'})" by auto
       with fields x yx' Suc.prems have partfx': "part_fn r s (Yx - {yx'}) (f \<circ> insert yx')"
         by (simp add: o_def part_fn_Suc_imp_part_fn part_fn_subset [where YY=YY and Y=Yx])
       from Suc.hyps [OF infYx' partfx'] obtain Y' and t'
         where Y': "Y' \<subseteq> Yx - {yx'}" "infinite Y'" "t' < s"
           "X \<subseteq> Y' \<and> finite X \<and> card X = r \<longrightarrow> (f \<circ> insert yx') X = t'" for X
         by blast
       from fields x Y' yx' have "?propr (yx', Y', t') \<and> (x, (yx', Y', t')) \<in> ?ramr"
         by blast
       then show ?thesis ..
     qed
     from dependent_choice [OF transr propr0 proprstep]
     obtain g where pg: "?propr (g n)" and rg: "n < m \<Longrightarrow> (g n, g m) \<in> ?ramr" for n m :: nat
       by blast
     let ?gy = "fst \<circ> g"
     let ?gt = "snd \<circ> snd \<circ> g"
     have rangeg: "\<exists>k. range ?gt \<subseteq> {..<k}"
     proof (intro exI subsetI)
       fix x
       assume "x \<in> range ?gt"
       then obtain n where "x = ?gt n" ..
       with pg [of n] show "x \<in> {..<s}" by (cases "g n") auto
     qed
     from rangeg have "finite (range ?gt)"
       by (simp add: finite_nat_iff_bounded)
     then obtain s' and n' where s': "s' = ?gt n'" and infeqs': "infinite {n. ?gt n = s'}"
       by (rule inf_img_fin_domE) (auto simp add: vimage_def intro: infinite_UNIV_nat)
     with pg [of n'] have less': "s'<s" by (cases "g n'") auto
     have inj_gy: "inj ?gy"
     proof (rule linorder_injI)
       fix m m' :: nat
       assume "m < m'"
       from rg [OF this] pg [of m] show "?gy m \<noteq> ?gy m'"
         by (cases "g m", cases "g m'") auto
     qed
     show ?thesis
     proof (intro exI conjI)
       from pg show "?gy ` {n. ?gt n = s'} \<subseteq> YY"
         by (auto simp add: Let_def split_beta)
       from infeqs' show "infinite (?gy ` {n. ?gt n = s'})"
         by (blast intro: inj_gy [THEN subset_inj_on] dest: finite_imageD)
       show "s' < s" by (rule less')
       show "\<forall>X. X \<subseteq> ?gy ` {n. ?gt n = s'} \<and> finite X \<and> card X = Suc r \<longrightarrow> f X = s'"
       proof -
         have "f X = s'"
           if X: "X \<subseteq> ?gy ` {n. ?gt n = s'}"
           and cardX: "finite X" "card X = Suc r"
           for X
         proof -
           from X obtain AA where AA: "AA \<subseteq> {n. ?gt n = s'}" and Xeq: "X = ?gy`AA"
             by (auto simp add: subset_image_iff)
           with cardX have "AA \<noteq> {}" by auto
           then have AAleast: "(LEAST x. x \<in> AA) \<in> AA" by (auto intro: LeastI_ex)
           show ?thesis
           proof (cases "g (LEAST x. x \<in> AA)")
             case (fields ya Ya ta)
             with AAleast Xeq have ya: "ya \<in> X" by (force intro!: rev_image_eqI)
             then have "f X = f (insert ya (X - {ya}))" by (simp add: insert_absorb)
             also have "\<dots> = ta"
             proof -
               have *: "X - {ya} \<subseteq> Ya"
               proof
                 fix x assume x: "x \<in> X - {ya}"
                 then obtain a' where xeq: "x = ?gy a'" and a': "a' \<in> AA"
                   by (auto simp add: Xeq)
                 with fields x have "a' \<noteq> (LEAST x. x \<in> AA)" by auto
                 with Least_le [of "\<lambda>x. x \<in> AA", OF a'] have "(LEAST x. x \<in> AA) < a'"
                   by arith
                 from xeq fields rg [OF this] show "x \<in> Ya" by auto
               qed
               have "card (X - {ya}) = r"
                 by (simp add: cardX ya)
               with pg [of "LEAST x. x \<in> AA"] fields cardX * show ?thesis
                 by (auto simp del: insert_Diff_single)
             qed
             also from AA AAleast fields have "\<dots> = s'" by auto
             finally show ?thesis .
           qed
         qed
         then show ?thesis by blast
       qed
     qed
   qed
 qed
 
 
 theorem Ramsey:
   fixes s r :: nat
     and Z :: "'a set"
     and f :: "'a set \<Rightarrow> nat"
   shows
    "\<lbrakk>infinite Z;
       \<forall>X. X \<subseteq> Z \<and> finite X \<and> card X = r \<longrightarrow> f X < s\<rbrakk>
     \<Longrightarrow> \<exists>Y t. Y \<subseteq> Z \<and> infinite Y \<and> t < s
             \<and> (\<forall>X. X \<subseteq> Y \<and> finite X \<and> card X = r \<longrightarrow> f X = t)"
   by (blast intro: Ramsey_induction [unfolded part_fn_def nsets_def])
 
 corollary Ramsey2:
   fixes s :: nat
     and Z :: "'a set"
     and f :: "'a set \<Rightarrow> nat"
   assumes infZ: "infinite Z"
     and part: "\<forall>x\<in>Z. \<forall>y\<in>Z. x \<noteq> y \<longrightarrow> f {x, y} < s"
   shows "\<exists>Y t. Y \<subseteq> Z \<and> infinite Y \<and> t < s \<and> (\<forall>x\<in>Y. \<forall>y\<in>Y. x\<noteq>y \<longrightarrow> f {x, y} = t)"
 proof -
   from part have part2: "\<forall>X. X \<subseteq> Z \<and> finite X \<and> card X = 2 \<longrightarrow> f X < s"
     by (fastforce simp add: eval_nat_numeral card_Suc_eq)
   obtain Y t where *:
     "Y \<subseteq> Z" "infinite Y" "t < s" "(\<forall>X. X \<subseteq> Y \<and> finite X \<and> card X = 2 \<longrightarrow> f X = t)"
     by (insert Ramsey [OF infZ part2]) auto
   then have "\<forall>x\<in>Y. \<forall>y\<in>Y. x \<noteq> y \<longrightarrow> f {x, y} = t" by auto
   with * show ?thesis by iprover
 qed
 
 corollary Ramsey_nsets:
   fixes f :: "'a set \<Rightarrow> nat"
   assumes "infinite Z" "f ` nsets Z r \<subseteq> {..<s}"
   obtains Y t where "Y \<subseteq> Z" "infinite Y" "t < s" "f ` nsets Y r \<subseteq> {t}"
   using Ramsey [of Z r f s] assms by (auto simp: nsets_def image_subset_iff)
 
 
 subsection \<open>Disjunctive Well-Foundedness\<close>
 
 text \<open>
   An application of Ramsey's theorem to program termination. See
-  @{cite "Podelski-Rybalchenko"}.
+  \<^cite>\<open>"Podelski-Rybalchenko"\<close>.
 \<close>
 
 definition disj_wf :: "('a \<times> 'a) set \<Rightarrow> bool"
   where "disj_wf r \<longleftrightarrow> (\<exists>T. \<exists>n::nat. (\<forall>i<n. wf (T i)) \<and> r = (\<Union>i<n. T i))"
 
 definition transition_idx :: "(nat \<Rightarrow> 'a) \<Rightarrow> (nat \<Rightarrow> ('a \<times> 'a) set) \<Rightarrow> nat set \<Rightarrow> nat"
   where "transition_idx s T A = (LEAST k. \<exists>i j. A = {i, j} \<and> i < j \<and> (s j, s i) \<in> T k)"
 
 
 lemma transition_idx_less:
   assumes "i < j" "(s j, s i) \<in> T k" "k < n"
   shows "transition_idx s T {i, j} < n"
 proof -
   from assms(1,2) have "transition_idx s T {i, j} \<le> k"
     by (simp add: transition_idx_def, blast intro: Least_le)
   with assms(3) show ?thesis by simp
 qed
 
 lemma transition_idx_in:
   assumes "i < j" "(s j, s i) \<in> T k"
   shows "(s j, s i) \<in> T (transition_idx s T {i, j})"
   using assms
   by (simp add: transition_idx_def doubleton_eq_iff conj_disj_distribR cong: conj_cong) (erule LeastI)
 
 text \<open>To be equal to the union of some well-founded relations is equivalent
   to being the subset of such a union.\<close>
 lemma disj_wf: "disj_wf r \<longleftrightarrow> (\<exists>T. \<exists>n::nat. (\<forall>i<n. wf(T i)) \<and> r \<subseteq> (\<Union>i<n. T i))"
 proof -
   have *: "\<And>T n. \<lbrakk>\<forall>i<n. wf (T i); r \<subseteq> \<Union> (T ` {..<n})\<rbrakk>
            \<Longrightarrow> (\<forall>i<n. wf (T i \<inter> r)) \<and> r = (\<Union>i<n. T i \<inter> r)"
     by (force simp add: wf_Int1)
   show ?thesis
     unfolding disj_wf_def by auto (metis "*")
 qed
 
 theorem trans_disj_wf_implies_wf:
   assumes "trans r"
     and "disj_wf r"
   shows "wf r"
 proof (simp only: wf_iff_no_infinite_down_chain, rule notI)
   assume "\<exists>s. \<forall>i. (s (Suc i), s i) \<in> r"
   then obtain s where sSuc: "\<forall>i. (s (Suc i), s i) \<in> r" ..
   from \<open>disj_wf r\<close> obtain T and n :: nat where wfT: "\<forall>k<n. wf(T k)" and r: "r = (\<Union>k<n. T k)"
     by (auto simp add: disj_wf_def)
   have s_in_T: "\<exists>k. (s j, s i) \<in> T k \<and> k<n" if "i < j" for i j
   proof -
     from \<open>i < j\<close> have "(s j, s i) \<in> r"
     proof (induct rule: less_Suc_induct)
       case 1
       then show ?case by (simp add: sSuc)
     next
       case 2
       with \<open>trans r\<close> show ?case
         unfolding trans_def by blast
     qed
     then show ?thesis by (auto simp add: r)
   qed
   have "i < j \<Longrightarrow> transition_idx s T {i, j} < n" for i j
     using s_in_T transition_idx_less by blast
   then have trless: "i \<noteq> j \<Longrightarrow> transition_idx s T {i, j} < n" for i j
     by (metis doubleton_eq_iff less_linear)
   have "\<exists>K k. K \<subseteq> UNIV \<and> infinite K \<and> k < n \<and>
       (\<forall>i\<in>K. \<forall>j\<in>K. i \<noteq> j \<longrightarrow> transition_idx s T {i, j} = k)"
     by (rule Ramsey2) (auto intro: trless infinite_UNIV_nat)
   then obtain K and k where infK: "infinite K" and "k < n"
     and allk: "\<forall>i\<in>K. \<forall>j\<in>K. i \<noteq> j \<longrightarrow> transition_idx s T {i, j} = k"
     by auto
   have "(s (enumerate K (Suc m)), s (enumerate K m)) \<in> T k" for m :: nat
   proof -
     let ?j = "enumerate K (Suc m)"
     let ?i = "enumerate K m"
     have ij: "?i < ?j" by (simp add: enumerate_step infK)
     have "?j \<in> K" "?i \<in> K" by (simp_all add: enumerate_in_set infK)
     with ij have k: "k = transition_idx s T {?i, ?j}" by (simp add: allk)
     from s_in_T [OF ij] obtain k' where "(s ?j, s ?i) \<in> T k'" "k'<n" by blast
     then show "(s ?j, s ?i) \<in> T k" by (simp add: k transition_idx_in ij)
   qed
   then have "\<not> wf (T k)"
     unfolding wf_iff_no_infinite_down_chain by iprover
   with wfT \<open>k < n\<close> show False by blast
 qed
 
 end
diff --git a/src/HOL/Proofs/Extraction/Euclid.thy b/src/HOL/Proofs/Extraction/Euclid.thy
--- a/src/HOL/Proofs/Extraction/Euclid.thy
+++ b/src/HOL/Proofs/Extraction/Euclid.thy
@@ -1,273 +1,273 @@
 (*  Title:      HOL/Proofs/Extraction/Euclid.thy
     Author:     Markus Wenzel, TU Muenchen
     Author:     Freek Wiedijk, Radboud University Nijmegen
     Author:     Stefan Berghofer, TU Muenchen
 *)
 
 section \<open>Euclid's theorem\<close>
 
 theory Euclid
 imports
   "HOL-Computational_Algebra.Primes"
   Util
   "HOL-Library.Code_Target_Numeral"
   "HOL-Library.Realizers"
 begin
 
 text \<open>
   A constructive version of the proof of Euclid's theorem by
-  Markus Wenzel and Freek Wiedijk @{cite "Wenzel-Wiedijk-JAR2002"}.
+  Markus Wenzel and Freek Wiedijk \<^cite>\<open>"Wenzel-Wiedijk-JAR2002"\<close>.
 \<close>
 
 lemma factor_greater_one1: "n = m * k \<Longrightarrow> m < n \<Longrightarrow> k < n \<Longrightarrow> Suc 0 < m"
   by (induct m) auto
 
 lemma factor_greater_one2: "n = m * k \<Longrightarrow> m < n \<Longrightarrow> k < n \<Longrightarrow> Suc 0 < k"
   by (induct k) auto
 
 lemma prod_mn_less_k: "0 < n \<Longrightarrow> 0 < k \<Longrightarrow> Suc 0 < m \<Longrightarrow> m * n = k \<Longrightarrow> n < k"
   by (induct m) auto
 
 lemma prime_eq: "prime (p::nat) \<longleftrightarrow> 1 < p \<and> (\<forall>m. m dvd p \<longrightarrow> 1 < m \<longrightarrow> m = p)"
   apply (simp add: prime_nat_iff)
   apply (rule iffI)
   apply blast
   apply (erule conjE)
   apply (rule conjI)
   apply assumption
   apply (rule allI impI)+
   apply (erule allE)
   apply (erule impE)
   apply assumption
   apply (case_tac "m = 0")
   apply simp
   apply (case_tac "m = Suc 0")
   apply simp
   apply simp
   done
 
 lemma prime_eq': "prime (p::nat) \<longleftrightarrow> 1 < p \<and> (\<forall>m k. p = m * k \<longrightarrow> 1 < m \<longrightarrow> m = p)"
   by (simp add: prime_eq dvd_def HOL.all_simps [symmetric] del: HOL.all_simps)
 
 lemma not_prime_ex_mk:
   assumes n: "Suc 0 < n"
   shows "(\<exists>m k. Suc 0 < m \<and> Suc 0 < k \<and> m < n \<and> k < n \<and> n = m * k) \<or> prime n"
 proof -
   from nat_eq_dec have "(\<exists>m<n. n = m * k) \<or> \<not> (\<exists>m<n. n = m * k)" for k
     by (rule search)
   then have "(\<exists>k<n. \<exists>m<n. n = m * k) \<or> \<not> (\<exists>k<n. \<exists>m<n. n = m * k)"
     by (rule search)
   then show ?thesis
   proof
     assume "\<exists>k<n. \<exists>m<n. n = m * k"
     then obtain k m where k: "k<n" and m: "m<n" and nmk: "n = m * k"
       by iprover
     from nmk m k have "Suc 0 < m" by (rule factor_greater_one1)
     moreover from nmk m k have "Suc 0 < k" by (rule factor_greater_one2)
     ultimately show ?thesis using k m nmk by iprover
   next
     assume "\<not> (\<exists>k<n. \<exists>m<n. n = m * k)"
     then have A: "\<forall>k<n. \<forall>m<n. n \<noteq> m * k" by iprover
     have "\<forall>m k. n = m * k \<longrightarrow> Suc 0 < m \<longrightarrow> m = n"
     proof (intro allI impI)
       fix m k
       assume nmk: "n = m * k"
       assume m: "Suc 0 < m"
       from n m nmk have k: "0 < k"
         by (cases k) auto
       moreover from n have n: "0 < n" by simp
       moreover note m
       moreover from nmk have "m * k = n" by simp
       ultimately have kn: "k < n" by (rule prod_mn_less_k)
       show "m = n"
       proof (cases "k = Suc 0")
         case True
         with nmk show ?thesis by (simp only: mult_Suc_right)
       next
         case False
         from m have "0 < m" by simp
         moreover note n
         moreover from False n nmk k have "Suc 0 < k" by auto
         moreover from nmk have "k * m = n" by (simp only: ac_simps)
         ultimately have mn: "m < n" by (rule prod_mn_less_k)
         with kn A nmk show ?thesis by iprover
       qed
     qed
     with n have "prime n"
       by (simp only: prime_eq' One_nat_def simp_thms)
     then show ?thesis ..
   qed
 qed
 
 lemma dvd_factorial: "0 < m \<Longrightarrow> m \<le> n \<Longrightarrow> m dvd fact n"
 proof (induct n rule: nat_induct)
   case 0
   then show ?case by simp
 next
   case (Suc n)
   from \<open>m \<le> Suc n\<close> show ?case
   proof (rule le_SucE)
     assume "m \<le> n"
     with \<open>0 < m\<close> have "m dvd fact n" by (rule Suc)
     then have "m dvd (fact n * Suc n)" by (rule dvd_mult2)
     then show ?thesis by (simp add: mult.commute)
   next
     assume "m = Suc n"
     then have "m dvd (fact n * Suc n)"
       by (auto intro: dvdI simp: ac_simps)
     then show ?thesis by (simp add: mult.commute)
   qed
 qed
 
 lemma dvd_prod [iff]: "n dvd (\<Prod>m::nat \<in># mset (n # ns). m)"
   by (simp add: prod_mset_Un)
 
 definition all_prime :: "nat list \<Rightarrow> bool"
   where "all_prime ps \<longleftrightarrow> (\<forall>p\<in>set ps. prime p)"
 
 lemma all_prime_simps:
   "all_prime []"
   "all_prime (p # ps) \<longleftrightarrow> prime p \<and> all_prime ps"
   by (simp_all add: all_prime_def)
 
 lemma all_prime_append: "all_prime (ps @ qs) \<longleftrightarrow> all_prime ps \<and> all_prime qs"
   by (simp add: all_prime_def ball_Un)
 
 lemma split_all_prime:
   assumes "all_prime ms" and "all_prime ns"
   shows "\<exists>qs. all_prime qs \<and>
     (\<Prod>m::nat \<in># mset qs. m) = (\<Prod>m::nat \<in># mset ms. m) * (\<Prod>m::nat \<in># mset ns. m)"
   (is "\<exists>qs. ?P qs \<and> ?Q qs")
 proof -
   from assms have "all_prime (ms @ ns)"
     by (simp add: all_prime_append)
   moreover
   have "(\<Prod>m::nat \<in># mset (ms @ ns). m) = (\<Prod>m::nat \<in># mset ms. m) * (\<Prod>m::nat \<in># mset ns. m)"
     using assms by (simp add: prod_mset_Un)
   ultimately have "?P (ms @ ns) \<and> ?Q (ms @ ns)" ..
   then show ?thesis ..
 qed
 
 lemma all_prime_nempty_g_one:
   assumes "all_prime ps" and "ps \<noteq> []"
   shows "Suc 0 < (\<Prod>m::nat \<in># mset ps. m)"
   using \<open>ps \<noteq> []\<close> \<open>all_prime ps\<close>
   unfolding One_nat_def [symmetric]
   by (induct ps rule: list_nonempty_induct)
     (simp_all add: all_prime_simps prod_mset_Un prime_gt_1_nat less_1_mult del: One_nat_def)
 
 lemma factor_exists: "Suc 0 < n \<Longrightarrow> (\<exists>ps. all_prime ps \<and> (\<Prod>m::nat \<in># mset ps. m) = n)"
 proof (induct n rule: nat_wf_ind)
   case (1 n)
   from \<open>Suc 0 < n\<close>
   have "(\<exists>m k. Suc 0 < m \<and> Suc 0 < k \<and> m < n \<and> k < n \<and> n = m * k) \<or> prime n"
     by (rule not_prime_ex_mk)
   then show ?case
   proof
     assume "\<exists>m k. Suc 0 < m \<and> Suc 0 < k \<and> m < n \<and> k < n \<and> n = m * k"
     then obtain m k where m: "Suc 0 < m" and k: "Suc 0 < k" and mn: "m < n"
       and kn: "k < n" and nmk: "n = m * k"
       by iprover
     from mn and m have "\<exists>ps. all_prime ps \<and> (\<Prod>m::nat \<in># mset ps. m) = m"
       by (rule 1)
     then obtain ps1 where "all_prime ps1" and prod_ps1_m: "(\<Prod>m::nat \<in># mset ps1. m) = m"
       by iprover
     from kn and k have "\<exists>ps. all_prime ps \<and> (\<Prod>m::nat \<in># mset ps. m) = k"
       by (rule 1)
     then obtain ps2 where "all_prime ps2" and prod_ps2_k: "(\<Prod>m::nat \<in># mset ps2. m) = k"
       by iprover
     from \<open>all_prime ps1\<close> \<open>all_prime ps2\<close>
     have "\<exists>ps. all_prime ps \<and> (\<Prod>m::nat \<in># mset ps. m) =
       (\<Prod>m::nat \<in># mset ps1. m) * (\<Prod>m::nat \<in># mset ps2. m)"
       by (rule split_all_prime)
     with prod_ps1_m prod_ps2_k nmk show ?thesis by simp
   next
     assume "prime n" then have "all_prime [n]" by (simp add: all_prime_simps)
     moreover have "(\<Prod>m::nat \<in># mset [n]. m) = n" by (simp)
     ultimately have "all_prime [n] \<and> (\<Prod>m::nat \<in># mset [n]. m) = n" ..
     then show ?thesis ..
   qed
 qed
 
 lemma prime_factor_exists:
   assumes N: "(1::nat) < n"
   shows "\<exists>p. prime p \<and> p dvd n"
 proof -
   from N obtain ps where "all_prime ps" and prod_ps: "n = (\<Prod>m::nat \<in># mset ps. m)"
     using factor_exists by simp iprover
   with N have "ps \<noteq> []"
     by (auto simp add: all_prime_nempty_g_one)
   then obtain p qs where ps: "ps = p # qs"
     by (cases ps) simp
   with \<open>all_prime ps\<close> have "prime p"
     by (simp add: all_prime_simps)
   moreover from \<open>all_prime ps\<close> ps prod_ps have "p dvd n"
     by (simp only: dvd_prod)
   ultimately show ?thesis by iprover
 qed
 
 text \<open>Euclid's theorem: there are infinitely many primes.\<close>
 
 lemma Euclid: "\<exists>p::nat. prime p \<and> n < p"
 proof -
   let ?k = "fact n + (1::nat)"
   have "1 < ?k" by simp
   then obtain p where prime: "prime p" and dvd: "p dvd ?k"
     using prime_factor_exists by iprover
   have "n < p"
   proof -
     have "\<not> p \<le> n"
     proof
       assume pn: "p \<le> n"
       from \<open>prime p\<close> have "0 < p" by (rule prime_gt_0_nat)
       then have "p dvd fact n" using pn by (rule dvd_factorial)
       with dvd have "p dvd ?k - fact n" by (rule dvd_diff_nat)
       then have "p dvd 1" by simp
       with prime show False by auto
     qed
     then show ?thesis by simp
   qed
   with prime show ?thesis by iprover
 qed
 
 extract Euclid
 
 text \<open>
   The program extracted from the proof of Euclid's theorem looks as follows.
   @{thm [display] Euclid_def}
   The program corresponding to the proof of the factorization theorem is
   @{thm [display] factor_exists_def}
 \<close>
 
 instantiation nat :: default
 begin
 
 definition "default = (0::nat)"
 
 instance ..
 
 end
 
 instantiation list :: (type) default
 begin
 
 definition "default = []"
 
 instance ..
 
 end
 
 primrec iterate :: "nat \<Rightarrow> ('a \<Rightarrow> 'a) \<Rightarrow> 'a \<Rightarrow> 'a list"
 where
   "iterate 0 f x = []"
 | "iterate (Suc n) f x = (let y = f x in y # iterate n f y)"
 
 lemma "factor_exists 1007 = [53, 19]" by eval
 lemma "factor_exists 567 = [7, 3, 3, 3, 3]" by eval
 lemma "factor_exists 345 = [23, 5, 3]" by eval
 lemma "factor_exists 999 = [37, 3, 3, 3]" by eval
 lemma "factor_exists 876 = [73, 3, 2, 2]" by eval
 
 lemma "iterate 4 Euclid 0 = [2, 3, 7, 71]" by eval
 
 end
diff --git a/src/HOL/Proofs/Extraction/Higman.thy b/src/HOL/Proofs/Extraction/Higman.thy
--- a/src/HOL/Proofs/Extraction/Higman.thy
+++ b/src/HOL/Proofs/Extraction/Higman.thy
@@ -1,327 +1,327 @@
 (*  Title:      HOL/Proofs/Extraction/Higman.thy
     Author:     Stefan Berghofer, TU Muenchen
     Author:     Monika Seisenberger, LMU Muenchen
 *)
 
 section \<open>Higman's lemma\<close>
 
 theory Higman
 imports Main
 begin
 
 text \<open>
   Formalization by Stefan Berghofer and Monika Seisenberger,
-  based on Coquand and Fridlender @{cite Coquand93}.
+  based on Coquand and Fridlender \<^cite>\<open>Coquand93\<close>.
 \<close>
 
 datatype letter = A | B
 
 inductive emb :: "letter list \<Rightarrow> letter list \<Rightarrow> bool"
 where
   emb0 [Pure.intro]: "emb [] bs"
 | emb1 [Pure.intro]: "emb as bs \<Longrightarrow> emb as (b # bs)"
 | emb2 [Pure.intro]: "emb as bs \<Longrightarrow> emb (a # as) (a # bs)"
 
 inductive L :: "letter list \<Rightarrow> letter list list \<Rightarrow> bool"
   for v :: "letter list"
 where
   L0 [Pure.intro]: "emb w v \<Longrightarrow> L v (w # ws)"
 | L1 [Pure.intro]: "L v ws \<Longrightarrow> L v (w # ws)"
 
 inductive good :: "letter list list \<Rightarrow> bool"
 where
   good0 [Pure.intro]: "L w ws \<Longrightarrow> good (w # ws)"
 | good1 [Pure.intro]: "good ws \<Longrightarrow> good (w # ws)"
 
 inductive R :: "letter \<Rightarrow> letter list list \<Rightarrow> letter list list \<Rightarrow> bool"
   for a :: letter
 where
   R0 [Pure.intro]: "R a [] []"
 | R1 [Pure.intro]: "R a vs ws \<Longrightarrow> R a (w # vs) ((a # w) # ws)"
 
 inductive T :: "letter \<Rightarrow> letter list list \<Rightarrow> letter list list \<Rightarrow> bool"
   for a :: letter
 where
   T0 [Pure.intro]: "a \<noteq> b \<Longrightarrow> R b ws zs \<Longrightarrow> T a (w # zs) ((a # w) # zs)"
 | T1 [Pure.intro]: "T a ws zs \<Longrightarrow> T a (w # ws) ((a # w) # zs)"
 | T2 [Pure.intro]: "a \<noteq> b \<Longrightarrow> T a ws zs \<Longrightarrow> T a ws ((b # w) # zs)"
 
 inductive bar :: "letter list list \<Rightarrow> bool"
 where
   bar1 [Pure.intro]: "good ws \<Longrightarrow> bar ws"
 | bar2 [Pure.intro]: "(\<And>w. bar (w # ws)) \<Longrightarrow> bar ws"
 
 theorem prop1: "bar ([] # ws)"
   by iprover
 
 theorem lemma1: "L as ws \<Longrightarrow> L (a # as) ws"
   by (erule L.induct) iprover+
 
 lemma lemma2': "R a vs ws \<Longrightarrow> L as vs \<Longrightarrow> L (a # as) ws"
   supply [[simproc del: defined_all]]
   apply (induct set: R)
   apply (erule L.cases)
   apply simp+
   apply (erule L.cases)
   apply simp_all
   apply (rule L0)
   apply (erule emb2)
   apply (erule L1)
   done
 
 lemma lemma2: "R a vs ws \<Longrightarrow> good vs \<Longrightarrow> good ws"
   supply [[simproc del: defined_all]]
   apply (induct set: R)
   apply iprover
   apply (erule good.cases)
   apply simp_all
   apply (rule good0)
   apply (erule lemma2')
    apply assumption
   apply (erule good1)
   done
 
 lemma lemma3': "T a vs ws \<Longrightarrow> L as vs \<Longrightarrow> L (a # as) ws"
   supply [[simproc del: defined_all]]
   apply (induct set: T)
   apply (erule L.cases)
   apply simp_all
   apply (rule L0)
   apply (erule emb2)
   apply (rule L1)
   apply (erule lemma1)
   apply (erule L.cases)
   apply simp_all
   apply iprover+
   done
 
 lemma lemma3: "T a ws zs \<Longrightarrow> good ws \<Longrightarrow> good zs"
   supply [[simproc del: defined_all]]
   apply (induct set: T)
   apply (erule good.cases)
   apply simp_all
   apply (rule good0)
   apply (erule lemma1)
   apply (erule good1)
   apply (erule good.cases)
   apply simp_all
   apply (rule good0)
   apply (erule lemma3')
   apply iprover+
   done
 
 lemma lemma4: "R a ws zs \<Longrightarrow> ws \<noteq> [] \<Longrightarrow> T a ws zs"
   supply [[simproc del: defined_all]]
   apply (induct set: R)
   apply iprover
   apply (case_tac vs)
   apply (erule R.cases)
   apply simp
   apply (case_tac a)
   apply (rule_tac b=B in T0)
   apply simp
   apply (rule R0)
   apply (rule_tac b=A in T0)
   apply simp
   apply (rule R0)
   apply simp
   apply (rule T1)
   apply simp
   done
 
 lemma letter_neq: "a \<noteq> b \<Longrightarrow> c \<noteq> a \<Longrightarrow> c = b" for a b c :: letter
   apply (case_tac a)
   apply (case_tac b)
   apply (case_tac c, simp, simp)
   apply (case_tac c, simp, simp)
   apply (case_tac b)
   apply (case_tac c, simp, simp)
   apply (case_tac c, simp, simp)
   done
 
 lemma letter_eq_dec: "a = b \<or> a \<noteq> b" for a b :: letter
   apply (case_tac a)
   apply (case_tac b)
   apply simp
   apply simp
   apply (case_tac b)
   apply simp
   apply simp
   done
 
 theorem prop2:
   assumes ab: "a \<noteq> b" and bar: "bar xs"
   shows "\<And>ys zs. bar ys \<Longrightarrow> T a xs zs \<Longrightarrow> T b ys zs \<Longrightarrow> bar zs"
   using bar
 proof induct
   fix xs zs
   assume "T a xs zs" and "good xs"
   then have "good zs" by (rule lemma3)
   then show "bar zs" by (rule bar1)
 next
   fix xs ys
   assume I: "\<And>w ys zs. bar ys \<Longrightarrow> T a (w # xs) zs \<Longrightarrow> T b ys zs \<Longrightarrow> bar zs"
   assume "bar ys"
   then show "\<And>zs. T a xs zs \<Longrightarrow> T b ys zs \<Longrightarrow> bar zs"
   proof induct
     fix ys zs
     assume "T b ys zs" and "good ys"
     then have "good zs" by (rule lemma3)
     then show "bar zs" by (rule bar1)
   next
     fix ys zs
     assume I': "\<And>w zs. T a xs zs \<Longrightarrow> T b (w # ys) zs \<Longrightarrow> bar zs"
       and ys: "\<And>w. bar (w # ys)" and Ta: "T a xs zs" and Tb: "T b ys zs"
     show "bar zs"
     proof (rule bar2)
       fix w
       show "bar (w # zs)"
       proof (cases w)
         case Nil
         then show ?thesis by simp (rule prop1)
       next
         case (Cons c cs)
         from letter_eq_dec show ?thesis
         proof
           assume ca: "c = a"
           from ab have "bar ((a # cs) # zs)" by (iprover intro: I ys Ta Tb)
           then show ?thesis by (simp add: Cons ca)
         next
           assume "c \<noteq> a"
           with ab have cb: "c = b" by (rule letter_neq)
           from ab have "bar ((b # cs) # zs)" by (iprover intro: I' Ta Tb)
           then show ?thesis by (simp add: Cons cb)
         qed
       qed
     qed
   qed
 qed
 
 theorem prop3:
   assumes bar: "bar xs"
   shows "\<And>zs. xs \<noteq> [] \<Longrightarrow> R a xs zs \<Longrightarrow> bar zs"
   using bar
 proof induct
   fix xs zs
   assume "R a xs zs" and "good xs"
   then have "good zs" by (rule lemma2)
   then show "bar zs" by (rule bar1)
 next
   fix xs zs
   assume I: "\<And>w zs. w # xs \<noteq> [] \<Longrightarrow> R a (w # xs) zs \<Longrightarrow> bar zs"
     and xsb: "\<And>w. bar (w # xs)" and xsn: "xs \<noteq> []" and R: "R a xs zs"
   show "bar zs"
   proof (rule bar2)
     fix w
     show "bar (w # zs)"
     proof (induct w)
       case Nil
       show ?case by (rule prop1)
     next
       case (Cons c cs)
       from letter_eq_dec show ?case
       proof
         assume "c = a"
         then show ?thesis by (iprover intro: I [simplified] R)
       next
         from R xsn have T: "T a xs zs" by (rule lemma4)
         assume "c \<noteq> a"
         then show ?thesis by (iprover intro: prop2 Cons xsb xsn R T)
       qed
     qed
   qed
 qed
 
 theorem higman: "bar []"
 proof (rule bar2)
   fix w
   show "bar [w]"
   proof (induct w)
     show "bar [[]]" by (rule prop1)
   next
     fix c cs assume "bar [cs]"
     then show "bar [c # cs]" by (rule prop3) (simp, iprover)
   qed
 qed
 
 primrec is_prefix :: "'a list \<Rightarrow> (nat \<Rightarrow> 'a) \<Rightarrow> bool"
 where
   "is_prefix [] f = True"
 | "is_prefix (x # xs) f = (x = f (length xs) \<and> is_prefix xs f)"
 
 theorem L_idx:
   assumes L: "L w ws"
   shows "is_prefix ws f \<Longrightarrow> \<exists>i. emb (f i) w \<and> i < length ws"
   using L
 proof induct
   case (L0 v ws)
   then have "emb (f (length ws)) w" by simp
   moreover have "length ws < length (v # ws)" by simp
   ultimately show ?case by iprover
 next
   case (L1 ws v)
   then obtain i where emb: "emb (f i) w" and "i < length ws"
     by simp iprover
   then have "i < length (v # ws)" by simp
   with emb show ?case by iprover
 qed
 
 theorem good_idx:
   assumes good: "good ws"
   shows "is_prefix ws f \<Longrightarrow> \<exists>i j. emb (f i) (f j) \<and> i < j"
   using good
 proof induct
   case (good0 w ws)
   then have "w = f (length ws)" and "is_prefix ws f" by simp_all
   with good0 show ?case by (iprover dest: L_idx)
 next
   case (good1 ws w)
   then show ?case by simp
 qed
 
 theorem bar_idx:
   assumes bar: "bar ws"
   shows "is_prefix ws f \<Longrightarrow> \<exists>i j. emb (f i) (f j) \<and> i < j"
   using bar
 proof induct
   case (bar1 ws)
   then show ?case by (rule good_idx)
 next
   case (bar2 ws)
   then have "is_prefix (f (length ws) # ws) f" by simp
   then show ?case by (rule bar2)
 qed
 
 text \<open>
   Strong version: yields indices of words that can be embedded into each other.
 \<close>
 
 theorem higman_idx: "\<exists>(i::nat) j. emb (f i) (f j) \<and> i < j"
 proof (rule bar_idx)
   show "bar []" by (rule higman)
   show "is_prefix [] f" by simp
 qed
 
 text \<open>
   Weak version: only yield sequence containing words
   that can be embedded into each other.
 \<close>
 
 theorem good_prefix_lemma:
   assumes bar: "bar ws"
   shows "is_prefix ws f \<Longrightarrow> \<exists>vs. is_prefix vs f \<and> good vs"
   using bar
 proof induct
   case bar1
   then show ?case by iprover
 next
   case (bar2 ws)
   from bar2.prems have "is_prefix (f (length ws) # ws) f" by simp
   then show ?case by (iprover intro: bar2)
 qed
 
 theorem good_prefix: "\<exists>vs. is_prefix vs f \<and> good vs"
   using higman
   by (rule good_prefix_lemma) simp+
 
 end
diff --git a/src/HOL/Proofs/Extraction/Pigeonhole.thy b/src/HOL/Proofs/Extraction/Pigeonhole.thy
--- a/src/HOL/Proofs/Extraction/Pigeonhole.thy
+++ b/src/HOL/Proofs/Extraction/Pigeonhole.thy
@@ -1,247 +1,247 @@
 (*  Title:      HOL/Proofs/Extraction/Pigeonhole.thy
     Author:     Stefan Berghofer, TU Muenchen
 *)
 
 section \<open>The pigeonhole principle\<close>
 
 theory Pigeonhole
 imports Util "HOL-Library.Realizers" "HOL-Library.Code_Target_Numeral"
 begin
 
 text \<open>
   We formalize two proofs of the pigeonhole principle, which lead
   to extracted programs of quite different complexity. The original
   formalization of these proofs in {\sc Nuprl} is due to
-  Aleksey Nogin @{cite "Nogin-ENTCS-2000"}.
+  Aleksey Nogin \<^cite>\<open>"Nogin-ENTCS-2000"\<close>.
 
   This proof yields a polynomial program.
 \<close>
 
 theorem pigeonhole:
   "\<And>f. (\<And>i. i \<le> Suc n \<Longrightarrow> f i \<le> n) \<Longrightarrow> \<exists>i j. i \<le> Suc n \<and> j < i \<and> f i = f j"
 proof (induct n)
   case 0
   then have "Suc 0 \<le> Suc 0 \<and> 0 < Suc 0 \<and> f (Suc 0) = f 0" by simp
   then show ?case by iprover
 next
   case (Suc n)
   have r:
     "k \<le> Suc (Suc n) \<Longrightarrow>
     (\<And>i j. Suc k \<le> i \<Longrightarrow> i \<le> Suc (Suc n) \<Longrightarrow> j < i \<Longrightarrow> f i \<noteq> f j) \<Longrightarrow>
     (\<exists>i j. i \<le> k \<and> j < i \<and> f i = f j)" for k
   proof (induct k)
     case 0
     let ?f = "\<lambda>i. if f i = Suc n then f (Suc (Suc n)) else f i"
     have "\<not> (\<exists>i j. i \<le> Suc n \<and> j < i \<and> ?f i = ?f j)"
     proof
       assume "\<exists>i j. i \<le> Suc n \<and> j < i \<and> ?f i = ?f j"
       then obtain i j where i: "i \<le> Suc n" and j: "j < i" and f: "?f i = ?f j"
         by iprover
       from j have i_nz: "Suc 0 \<le> i" by simp
       from i have iSSn: "i \<le> Suc (Suc n)" by simp
       have S0SSn: "Suc 0 \<le> Suc (Suc n)" by simp
       show False
       proof cases
         assume fi: "f i = Suc n"
         show False
         proof cases
           assume fj: "f j = Suc n"
           from i_nz and iSSn and j have "f i \<noteq> f j" by (rule 0)
           moreover from fi have "f i = f j"
             by (simp add: fj [symmetric])
           ultimately show ?thesis ..
         next
           from i and j have "j < Suc (Suc n)" by simp
           with S0SSn and le_refl have "f (Suc (Suc n)) \<noteq> f j"
             by (rule 0)
           moreover assume "f j \<noteq> Suc n"
           with fi and f have "f (Suc (Suc n)) = f j" by simp
           ultimately show False ..
         qed
       next
         assume fi: "f i \<noteq> Suc n"
         show False
         proof cases
           from i have "i < Suc (Suc n)" by simp
           with S0SSn and le_refl have "f (Suc (Suc n)) \<noteq> f i"
             by (rule 0)
           moreover assume "f j = Suc n"
           with fi and f have "f (Suc (Suc n)) = f i" by simp
           ultimately show False ..
         next
           from i_nz and iSSn and j
           have "f i \<noteq> f j" by (rule 0)
           moreover assume "f j \<noteq> Suc n"
           with fi and f have "f i = f j" by simp
           ultimately show False ..
         qed
       qed
     qed
     moreover have "?f i \<le> n" if "i \<le> Suc n" for i
     proof -
       from that have i: "i < Suc (Suc n)" by simp
       have "f (Suc (Suc n)) \<noteq> f i"
         by (rule 0) (simp_all add: i)
       moreover have "f (Suc (Suc n)) \<le> Suc n"
         by (rule Suc) simp
       moreover from i have "i \<le> Suc (Suc n)" by simp
       then have "f i \<le> Suc n" by (rule Suc)
       ultimately show ?thesis
         by simp
     qed
     then have "\<exists>i j. i \<le> Suc n \<and> j < i \<and> ?f i = ?f j"
       by (rule Suc)
     ultimately show ?case ..
   next
     case (Suc k)
     from search [OF nat_eq_dec] show ?case
     proof
       assume "\<exists>j<Suc k. f (Suc k) = f j"
       then show ?case by (iprover intro: le_refl)
     next
       assume nex: "\<not> (\<exists>j<Suc k. f (Suc k) = f j)"
       have "\<exists>i j. i \<le> k \<and> j < i \<and> f i = f j"
       proof (rule Suc)
         from Suc show "k \<le> Suc (Suc n)" by simp
         fix i j assume k: "Suc k \<le> i" and i: "i \<le> Suc (Suc n)"
           and j: "j < i"
         show "f i \<noteq> f j"
         proof cases
           assume eq: "i = Suc k"
           show ?thesis
           proof
             assume "f i = f j"
             then have "f (Suc k) = f j" by (simp add: eq)
             with nex and j and eq show False by iprover
           qed
         next
           assume "i \<noteq> Suc k"
           with k have "Suc (Suc k) \<le> i" by simp
           then show ?thesis using i and j by (rule Suc)
         qed
       qed
       then show ?thesis by (iprover intro: le_SucI)
     qed
   qed
   show ?case by (rule r) simp_all
 qed
 
 text \<open>
   The following proof, although quite elegant from a mathematical point of view,
   leads to an exponential program:
 \<close>
 
 theorem pigeonhole_slow:
   "\<And>f. (\<And>i. i \<le> Suc n \<Longrightarrow> f i \<le> n) \<Longrightarrow> \<exists>i j. i \<le> Suc n \<and> j < i \<and> f i = f j"
 proof (induct n)
   case 0
   have "Suc 0 \<le> Suc 0" ..
   moreover have "0 < Suc 0" ..
   moreover from 0 have "f (Suc 0) = f 0" by simp
   ultimately show ?case by iprover
 next
   case (Suc n)
   from search [OF nat_eq_dec] show ?case
   proof
     assume "\<exists>j < Suc (Suc n). f (Suc (Suc n)) = f j"
     then show ?case by (iprover intro: le_refl)
   next
     assume "\<not> (\<exists>j < Suc (Suc n). f (Suc (Suc n)) = f j)"
     then have nex: "\<forall>j < Suc (Suc n). f (Suc (Suc n)) \<noteq> f j" by iprover
     let ?f = "\<lambda>i. if f i = Suc n then f (Suc (Suc n)) else f i"
     have "\<And>i. i \<le> Suc n \<Longrightarrow> ?f i \<le> n"
     proof -
       fix i assume i: "i \<le> Suc n"
       show "?thesis i"
       proof (cases "f i = Suc n")
         case True
         from i and nex have "f (Suc (Suc n)) \<noteq> f i" by simp
         with True have "f (Suc (Suc n)) \<noteq> Suc n" by simp
         moreover from Suc have "f (Suc (Suc n)) \<le> Suc n" by simp
         ultimately have "f (Suc (Suc n)) \<le> n" by simp
         with True show ?thesis by simp
       next
         case False
         from Suc and i have "f i \<le> Suc n" by simp
         with False show ?thesis by simp
       qed
     qed
     then have "\<exists>i j. i \<le> Suc n \<and> j < i \<and> ?f i = ?f j" by (rule Suc)
     then obtain i j where i: "i \<le> Suc n" and ji: "j < i" and f: "?f i = ?f j"
       by iprover
     have "f i = f j"
     proof (cases "f i = Suc n")
       case True
       show ?thesis
       proof (cases "f j = Suc n")
         assume "f j = Suc n"
         with True show ?thesis by simp
       next
         assume "f j \<noteq> Suc n"
         moreover from i ji nex have "f (Suc (Suc n)) \<noteq> f j" by simp
         ultimately show ?thesis using True f by simp
       qed
     next
       case False
       show ?thesis
       proof (cases "f j = Suc n")
         assume "f j = Suc n"
         moreover from i nex have "f (Suc (Suc n)) \<noteq> f i" by simp
         ultimately show ?thesis using False f by simp
       next
         assume "f j \<noteq> Suc n"
         with False f show ?thesis by simp
       qed
     qed
     moreover from i have "i \<le> Suc (Suc n)" by simp
     ultimately show ?thesis using ji by iprover
   qed
 qed
 
 extract pigeonhole pigeonhole_slow
 
 text \<open>
   The programs extracted from the above proofs look as follows:
   @{thm [display] pigeonhole_def}
   @{thm [display] pigeonhole_slow_def}
   The program for searching for an element in an array is
   @{thm [display,eta_contract=false] search_def}
   The correctness statement for \<^term>\<open>pigeonhole\<close> is
   @{thm [display] pigeonhole_correctness [no_vars]}
 
   In order to analyze the speed of the above programs,
   we generate ML code from them.
 \<close>
 
 instantiation nat :: default
 begin
 
 definition "default = (0::nat)"
 
 instance ..
 
 end
 
 instantiation prod :: (default, default) default
 begin
 
 definition "default = (default, default)"
 
 instance ..
 
 end
 
 definition "test n u = pigeonhole (nat_of_integer n) (\<lambda>m. m - 1)"
 definition "test' n u = pigeonhole_slow (nat_of_integer n) (\<lambda>m. m - 1)"
 definition "test'' u = pigeonhole 8 (List.nth [0, 1, 2, 3, 4, 5, 6, 3, 7, 8])"
 
 ML_val "timeit (@{code test} 10)"
 ML_val "timeit (@{code test'} 10)"
 ML_val "timeit (@{code test} 20)"
 ML_val "timeit (@{code test'} 20)"
 ML_val "timeit (@{code test} 25)"
 ML_val "timeit (@{code test'} 25)"
 ML_val "timeit (@{code test} 500)"
 ML_val "timeit @{code test''}"
 
 end
diff --git a/src/HOL/Proofs/Extraction/Warshall.thy b/src/HOL/Proofs/Extraction/Warshall.thy
--- a/src/HOL/Proofs/Extraction/Warshall.thy
+++ b/src/HOL/Proofs/Extraction/Warshall.thy
@@ -1,255 +1,255 @@
 (*  Title:      HOL/Proofs/Extraction/Warshall.thy
     Author:     Stefan Berghofer, TU Muenchen
 *)
 
 section \<open>Warshall's algorithm\<close>
 
 theory Warshall
 imports "HOL-Library.Realizers"
 begin
 
 text \<open>
   Derivation of Warshall's algorithm using program extraction,
-  based on Berger, Schwichtenberg and Seisenberger @{cite "Berger-JAR-2001"}.
+  based on Berger, Schwichtenberg and Seisenberger \<^cite>\<open>"Berger-JAR-2001"\<close>.
 \<close>
 
 datatype b = T | F
 
 primrec is_path' :: "('a \<Rightarrow> 'a \<Rightarrow> b) \<Rightarrow> 'a \<Rightarrow> 'a list \<Rightarrow> 'a \<Rightarrow> bool"
 where
   "is_path' r x [] z \<longleftrightarrow> r x z = T"
 | "is_path' r x (y # ys) z \<longleftrightarrow> r x y = T \<and> is_path' r y ys z"
 
 definition is_path :: "(nat \<Rightarrow> nat \<Rightarrow> b) \<Rightarrow> (nat * nat list * nat) \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> bool"
   where "is_path r p i j k \<longleftrightarrow>
     fst p = j \<and> snd (snd p) = k \<and>
     list_all (\<lambda>x. x < i) (fst (snd p)) \<and>
     is_path' r (fst p) (fst (snd p)) (snd (snd p))"
 
 definition conc :: "'a \<times> 'a list \<times> 'a \<Rightarrow> 'a \<times> 'a list \<times> 'a \<Rightarrow> 'a \<times> 'a list * 'a"
   where "conc p q = (fst p, fst (snd p) @ fst q # fst (snd q), snd (snd q))"
 
 theorem is_path'_snoc [simp]: "\<And>x. is_path' r x (ys @ [y]) z = (is_path' r x ys y \<and> r y z = T)"
   by (induct ys) simp+
 
 theorem list_all_scoc [simp]: "list_all P (xs @ [x]) \<longleftrightarrow> P x \<and> list_all P xs"
   by (induct xs) (simp+, iprover)
 
 theorem list_all_lemma: "list_all P xs \<Longrightarrow> (\<And>x. P x \<Longrightarrow> Q x) \<Longrightarrow> list_all Q xs"
 proof -
   assume PQ: "\<And>x. P x \<Longrightarrow> Q x"
   show "list_all P xs \<Longrightarrow> list_all Q xs"
   proof (induct xs)
     case Nil
     show ?case by simp
   next
     case (Cons y ys)
     then have Py: "P y" by simp
     from Cons have Pys: "list_all P ys" by simp
     show ?case
       by simp (rule conjI PQ Py Cons Pys)+
   qed
 qed
 
 theorem lemma1: "\<And>p. is_path r p i j k \<Longrightarrow> is_path r p (Suc i) j k"
   unfolding is_path_def
   apply (simp cong add: conj_cong add: split_paired_all)
   apply (erule conjE)+
   apply (erule list_all_lemma)
   apply simp
   done
 
 theorem lemma2: "\<And>p. is_path r p 0 j k \<Longrightarrow> r j k = T"
   unfolding is_path_def
   apply (simp cong add: conj_cong add: split_paired_all)
   apply (case_tac a)
   apply simp_all
   done
 
 theorem is_path'_conc: "is_path' r j xs i \<Longrightarrow> is_path' r i ys k \<Longrightarrow>
   is_path' r j (xs @ i # ys) k"
 proof -
   assume pys: "is_path' r i ys k"
   show "\<And>j. is_path' r j xs i \<Longrightarrow> is_path' r j (xs @ i # ys) k"
   proof (induct xs)
     case (Nil j)
     then have "r j i = T" by simp
     with pys show ?case by simp
   next
     case (Cons z zs j)
     then have jzr: "r j z = T" by simp
     from Cons have pzs: "is_path' r z zs i" by simp
     show ?case
       by simp (rule conjI jzr Cons pzs)+
   qed
 qed
 
 theorem lemma3:
   "\<And>p q. is_path r p i j i \<Longrightarrow> is_path r q i i k \<Longrightarrow>
     is_path r (conc p q) (Suc i) j k"
   apply (unfold is_path_def conc_def)
   apply (simp cong add: conj_cong add: split_paired_all)
   apply (erule conjE)+
   apply (rule conjI)
   apply (erule list_all_lemma)
   apply simp
   apply (rule conjI)
   apply (erule list_all_lemma)
   apply simp
   apply (rule is_path'_conc)
   apply assumption+
   done
 
 theorem lemma5:
   "\<And>p. is_path r p (Suc i) j k \<Longrightarrow> \<not> is_path r p i j k \<Longrightarrow>
     (\<exists>q. is_path r q i j i) \<and> (\<exists>q'. is_path r q' i i k)"
 proof (simp cong add: conj_cong add: split_paired_all is_path_def, (erule conjE)+)
   fix xs
   assume asms:
     "list_all (\<lambda>x. x < Suc i) xs"
     "is_path' r j xs k"
     "\<not> list_all (\<lambda>x. x < i) xs"
   show "(\<exists>ys. list_all (\<lambda>x. x < i) ys \<and> is_path' r j ys i) \<and>
     (\<exists>ys. list_all (\<lambda>x. x < i) ys \<and> is_path' r i ys k)"
   proof
     have "\<And>j. list_all (\<lambda>x. x < Suc i) xs \<Longrightarrow> is_path' r j xs k \<Longrightarrow>
       \<not> list_all (\<lambda>x. x < i) xs \<Longrightarrow>
     \<exists>ys. list_all (\<lambda>x. x < i) ys \<and> is_path' r j ys i" (is "PROP ?ih xs")
     proof (induct xs)
       case Nil
       then show ?case by simp
     next
       case (Cons a as j)
       show ?case
       proof (cases "a=i")
         case True
         show ?thesis
         proof
           from True and Cons have "r j i = T" by simp
           then show "list_all (\<lambda>x. x < i) [] \<and> is_path' r j [] i" by simp
         qed
       next
         case False
         have "PROP ?ih as" by (rule Cons)
         then obtain ys where ys: "list_all (\<lambda>x. x < i) ys \<and> is_path' r a ys i"
         proof
           from Cons show "list_all (\<lambda>x. x < Suc i) as" by simp
           from Cons show "is_path' r a as k" by simp
           from Cons and False show "\<not> list_all (\<lambda>x. x < i) as" by (simp)
         qed
         show ?thesis
         proof
           from Cons False ys
           show "list_all (\<lambda>x. x<i) (a#ys) \<and> is_path' r j (a#ys) i" by simp
         qed
       qed
     qed
     from this asms show "\<exists>ys. list_all (\<lambda>x. x < i) ys \<and> is_path' r j ys i" .
     have "\<And>k. list_all (\<lambda>x. x < Suc i) xs \<Longrightarrow> is_path' r j xs k \<Longrightarrow>
       \<not> list_all (\<lambda>x. x < i) xs \<Longrightarrow>
       \<exists>ys. list_all (\<lambda>x. x < i) ys \<and> is_path' r i ys k" (is "PROP ?ih xs")
     proof (induct xs rule: rev_induct)
       case Nil
       then show ?case by simp
     next
       case (snoc a as k)
       show ?case
       proof (cases "a=i")
         case True
         show ?thesis
         proof
           from True and snoc have "r i k = T" by simp
           then show "list_all (\<lambda>x. x < i) [] \<and> is_path' r i [] k" by simp
         qed
       next
         case False
         have "PROP ?ih as" by (rule snoc)
         then obtain ys where ys: "list_all (\<lambda>x. x < i) ys \<and> is_path' r i ys a"
         proof
           from snoc show "list_all (\<lambda>x. x < Suc i) as" by simp
           from snoc show "is_path' r j as a" by simp
           from snoc and False show "\<not> list_all (\<lambda>x. x < i) as" by simp
         qed
         show ?thesis
         proof
           from snoc False ys
           show "list_all (\<lambda>x. x < i) (ys @ [a]) \<and> is_path' r i (ys @ [a]) k"
             by simp
         qed
       qed
     qed
     from this asms show "\<exists>ys. list_all (\<lambda>x. x < i) ys \<and> is_path' r i ys k" .
   qed
 qed
 
 theorem lemma5':
   "\<And>p. is_path r p (Suc i) j k \<Longrightarrow> \<not> is_path r p i j k \<Longrightarrow>
     \<not> (\<forall>q. \<not> is_path r q i j i) \<and> \<not> (\<forall>q'. \<not> is_path r q' i i k)"
   by (iprover dest: lemma5)
 
 theorem warshall: "\<And>j k. \<not> (\<exists>p. is_path r p i j k) \<or> (\<exists>p. is_path r p i j k)"
 proof (induct i)
   case (0 j k)
   show ?case
   proof (cases "r j k")
     assume "r j k = T"
     then have "is_path r (j, [], k) 0 j k"
       by (simp add: is_path_def)
     then have "\<exists>p. is_path r p 0 j k" ..
     then show ?thesis ..
   next
     assume "r j k = F"
     then have "r j k \<noteq> T" by simp
     then have "\<not> (\<exists>p. is_path r p 0 j k)"
       by (iprover dest: lemma2)
     then show ?thesis ..
   qed
 next
   case (Suc i j k)
   then show ?case
   proof
     assume h1: "\<not> (\<exists>p. is_path r p i j k)"
     from Suc show ?case
     proof
       assume "\<not> (\<exists>p. is_path r p i j i)"
       with h1 have "\<not> (\<exists>p. is_path r p (Suc i) j k)"
         by (iprover dest: lemma5')
       then show ?case ..
     next
       assume "\<exists>p. is_path r p i j i"
       then obtain p where h2: "is_path r p i j i" ..
       from Suc show ?case
       proof
         assume "\<not> (\<exists>p. is_path r p i i k)"
         with h1 have "\<not> (\<exists>p. is_path r p (Suc i) j k)"
           by (iprover dest: lemma5')
         then show ?case ..
       next
         assume "\<exists>q. is_path r q i i k"
         then obtain q where "is_path r q i i k" ..
         with h2 have "is_path r (conc p q) (Suc i) j k" 
           by (rule lemma3)
         then have "\<exists>pq. is_path r pq (Suc i) j k" ..
         then show ?case ..
       qed
     qed
   next
     assume "\<exists>p. is_path r p i j k"
     then have "\<exists>p. is_path r p (Suc i) j k"
       by (iprover intro: lemma1)
     then show ?case ..
   qed
 qed
 
 extract warshall
 
 text \<open>
   The program extracted from the above proof looks as follows
   @{thm [display, eta_contract=false] warshall_def [no_vars]}
   The corresponding correctness theorem is
   @{thm [display] warshall_correctness [no_vars]}
 \<close>
 
 ML_val "@{code warshall}"
 
 end
diff --git a/src/HOL/Proofs/Lambda/Eta.thy b/src/HOL/Proofs/Lambda/Eta.thy
--- a/src/HOL/Proofs/Lambda/Eta.thy
+++ b/src/HOL/Proofs/Lambda/Eta.thy
@@ -1,390 +1,390 @@
 (*  Title:      HOL/Proofs/Lambda/Eta.thy
     Author:     Tobias Nipkow and Stefan Berghofer
     Copyright   1995, 2005 TU Muenchen
 *)
 
 section \<open>Eta-reduction\<close>
 
 theory Eta imports ParRed begin
 
 
 subsection \<open>Definition of eta-reduction and relatives\<close>
 
 primrec
   free :: "dB => nat => bool"
 where
     "free (Var j) i = (j = i)"
   | "free (s \<degree> t) i = (free s i \<or> free t i)"
   | "free (Abs s) i = free s (i + 1)"
 
 inductive
   eta :: "[dB, dB] => bool"  (infixl "\<rightarrow>\<^sub>\<eta>" 50)
 where
     eta [simp, intro]: "\<not> free s 0 ==> Abs (s \<degree> Var 0) \<rightarrow>\<^sub>\<eta> s[dummy/0]"
   | appL [simp, intro]: "s \<rightarrow>\<^sub>\<eta> t ==> s \<degree> u \<rightarrow>\<^sub>\<eta> t \<degree> u"
   | appR [simp, intro]: "s \<rightarrow>\<^sub>\<eta> t ==> u \<degree> s \<rightarrow>\<^sub>\<eta> u \<degree> t"
   | abs [simp, intro]: "s \<rightarrow>\<^sub>\<eta> t ==> Abs s \<rightarrow>\<^sub>\<eta> Abs t"
 
 abbreviation
   eta_reds :: "[dB, dB] => bool"   (infixl "\<rightarrow>\<^sub>\<eta>\<^sup>*" 50) where
   "s \<rightarrow>\<^sub>\<eta>\<^sup>* t == eta\<^sup>*\<^sup>* s t"
 
 abbreviation
   eta_red0 :: "[dB, dB] => bool"   (infixl "\<rightarrow>\<^sub>\<eta>\<^sup>=" 50) where
   "s \<rightarrow>\<^sub>\<eta>\<^sup>= t == eta\<^sup>=\<^sup>= s t"
 
 inductive_cases eta_cases [elim!]:
   "Abs s \<rightarrow>\<^sub>\<eta> z"
   "s \<degree> t \<rightarrow>\<^sub>\<eta> u"
   "Var i \<rightarrow>\<^sub>\<eta> t"
 
 
 subsection \<open>Properties of \<open>eta\<close>, \<open>subst\<close> and \<open>free\<close>\<close>
 
 lemma subst_not_free [simp]: "\<not> free s i \<Longrightarrow> s[t/i] = s[u/i]"
   by (induct s arbitrary: i t u) (simp_all add: subst_Var)
 
 lemma free_lift [simp]:
     "free (lift t k) i = (i < k \<and> free t i \<or> k < i \<and> free t (i - 1))"
   apply (induct t arbitrary: i k)
   apply (auto cong: conj_cong)
   done
 
 lemma free_subst [simp]:
     "free (s[t/k]) i =
       (free s k \<and> free t i \<or> free s (if i < k then i else i + 1))"
   apply (induct s arbitrary: i k t)
     prefer 2
     apply simp
     apply blast
    prefer 2
    apply simp
   apply (simp add: diff_Suc subst_Var split: nat.split)
   done
 
 lemma free_eta: "s \<rightarrow>\<^sub>\<eta> t ==> free t i = free s i"
   by (induct arbitrary: i set: eta) (simp_all cong: conj_cong)
 
 lemma not_free_eta:
     "[| s \<rightarrow>\<^sub>\<eta> t; \<not> free s i |] ==> \<not> free t i"
   by (simp add: free_eta)
 
 lemma eta_subst [simp]:
     "s \<rightarrow>\<^sub>\<eta> t ==> s[u/i] \<rightarrow>\<^sub>\<eta> t[u/i]"
   by (induct arbitrary: u i set: eta) (simp_all add: subst_subst [symmetric])
 
 theorem lift_subst_dummy: "\<not> free s i \<Longrightarrow> lift (s[dummy/i]) i = s"
   by (induct s arbitrary: i dummy) simp_all
 
 
 subsection \<open>Confluence of \<open>eta\<close>\<close>
 
 lemma square_eta: "square eta eta (eta\<^sup>=\<^sup>=) (eta\<^sup>=\<^sup>=)"
   apply (unfold square_def id_def)
   apply (rule impI [THEN allI [THEN allI]])
   apply (erule eta.induct)
      apply (slowsimp intro: subst_not_free eta_subst free_eta [THEN iffD1])
     apply safe
        prefer 5
        apply (blast intro!: eta_subst intro: free_eta [THEN iffD1])
       apply blast+
   done
 
 theorem eta_confluent: "confluent eta"
   apply (rule square_eta [THEN square_reflcl_confluent])
   done
 
 
 subsection \<open>Congruence rules for \<open>eta\<^sup>*\<close>\<close>
 
 lemma rtrancl_eta_Abs: "s \<rightarrow>\<^sub>\<eta>\<^sup>* s' ==> Abs s \<rightarrow>\<^sub>\<eta>\<^sup>* Abs s'"
   by (induct set: rtranclp)
     (blast intro: rtranclp.rtrancl_into_rtrancl)+
 
 lemma rtrancl_eta_AppL: "s \<rightarrow>\<^sub>\<eta>\<^sup>* s' ==> s \<degree> t \<rightarrow>\<^sub>\<eta>\<^sup>* s' \<degree> t"
   by (induct set: rtranclp)
     (blast intro: rtranclp.rtrancl_into_rtrancl)+
 
 lemma rtrancl_eta_AppR: "t \<rightarrow>\<^sub>\<eta>\<^sup>* t' ==> s \<degree> t \<rightarrow>\<^sub>\<eta>\<^sup>* s \<degree> t'"
   by (induct set: rtranclp) (blast intro: rtranclp.rtrancl_into_rtrancl)+
 
 lemma rtrancl_eta_App:
     "[| s \<rightarrow>\<^sub>\<eta>\<^sup>* s'; t \<rightarrow>\<^sub>\<eta>\<^sup>* t' |] ==> s \<degree> t \<rightarrow>\<^sub>\<eta>\<^sup>* s' \<degree> t'"
   by (blast intro!: rtrancl_eta_AppL rtrancl_eta_AppR intro: rtranclp_trans)
 
 
 subsection \<open>Commutation of \<open>beta\<close> and \<open>eta\<close>\<close>
 
 lemma free_beta:
     "s \<rightarrow>\<^sub>\<beta> t ==> free t i \<Longrightarrow> free s i"
   by (induct arbitrary: i set: beta) auto
 
 lemma beta_subst [intro]: "s \<rightarrow>\<^sub>\<beta> t ==> s[u/i] \<rightarrow>\<^sub>\<beta> t[u/i]"
   by (induct arbitrary: u i set: beta) (simp_all add: subst_subst [symmetric])
 
 lemma subst_Var_Suc [simp]: "t[Var i/i] = t[Var(i)/i + 1]"
   by (induct t arbitrary: i) (auto elim!: linorder_neqE simp: subst_Var)
 
 lemma eta_lift [simp]: "s \<rightarrow>\<^sub>\<eta> t ==> lift s i \<rightarrow>\<^sub>\<eta> lift t i"
   by (induct arbitrary: i set: eta) simp_all
 
 lemma rtrancl_eta_subst: "s \<rightarrow>\<^sub>\<eta> t \<Longrightarrow> u[s/i] \<rightarrow>\<^sub>\<eta>\<^sup>* u[t/i]"
   apply (induct u arbitrary: s t i)
     apply (simp_all add: subst_Var)
     apply blast
    apply (blast intro: rtrancl_eta_App)
   apply (blast intro!: rtrancl_eta_Abs eta_lift)
   done
 
 lemma rtrancl_eta_subst':
   fixes s t :: dB
   assumes eta: "s \<rightarrow>\<^sub>\<eta>\<^sup>* t"
   shows "s[u/i] \<rightarrow>\<^sub>\<eta>\<^sup>* t[u/i]" using eta
   by induct (iprover intro: eta_subst)+
 
 lemma rtrancl_eta_subst'':
   fixes s t :: dB
   assumes eta: "s \<rightarrow>\<^sub>\<eta>\<^sup>* t"
   shows "u[s/i] \<rightarrow>\<^sub>\<eta>\<^sup>* u[t/i]" using eta
   by induct (iprover intro: rtrancl_eta_subst rtranclp_trans)+
 
 lemma square_beta_eta: "square beta eta (eta\<^sup>*\<^sup>*) (beta\<^sup>=\<^sup>=)"
   apply (unfold square_def)
   apply (rule impI [THEN allI [THEN allI]])
   apply (erule beta.induct)
      apply (slowsimp intro: rtrancl_eta_subst eta_subst)
     apply (blast intro: rtrancl_eta_AppL)
    apply (blast intro: rtrancl_eta_AppR)
   apply simp
   apply (slowsimp intro: rtrancl_eta_Abs free_beta
     iff del: dB.distinct simp: dB.distinct)    (*23 seconds?*)
   done
 
 lemma confluent_beta_eta: "confluent (sup beta eta)"
   apply (assumption |
     rule square_rtrancl_reflcl_commute confluent_Un
       beta_confluent eta_confluent square_beta_eta)+
   done
 
 
 subsection \<open>Implicit definition of \<open>eta\<close>\<close>
 
 text \<open>\<^term>\<open>Abs (lift s 0 \<degree> Var 0) \<rightarrow>\<^sub>\<eta> s\<close>\<close>
 
 lemma not_free_iff_lifted:
     "(\<not> free s i) = (\<exists>t. s = lift t i)"
   apply (induct s arbitrary: i)
     apply simp
     apply (rule iffI)
      apply (erule linorder_neqE)
       apply (rename_tac nat a, rule_tac x = "Var nat" in exI)
       apply simp
      apply (rename_tac nat a, rule_tac x = "Var (nat - 1)" in exI)
      apply simp
     apply clarify
     apply (rule notE)
      prefer 2
      apply assumption
     apply (erule thin_rl)
     apply (case_tac t)
       apply simp
      apply simp
     apply simp
    apply simp
    apply (erule thin_rl)
    apply (erule thin_rl)
    apply (rule iffI)
     apply (elim conjE exE)
     apply (rename_tac u1 u2)
     apply (rule_tac x = "u1 \<degree> u2" in exI)
     apply simp
    apply (erule exE)
    apply (erule rev_mp)
    apply (case_tac t)
      apply simp
     apply simp
     apply blast
    apply simp
   apply simp
   apply (erule thin_rl)
   apply (rule iffI)
    apply (erule exE)
    apply (rule_tac x = "Abs t" in exI)
    apply simp
   apply (erule exE)
   apply (erule rev_mp)
   apply (case_tac t)
     apply simp
    apply simp
   apply simp
   apply blast
   done
 
 theorem explicit_is_implicit:
   "(\<forall>s u. (\<not> free s 0) --> R (Abs (s \<degree> Var 0)) (s[u/0])) =
     (\<forall>s. R (Abs (lift s 0 \<degree> Var 0)) s)"
   by (auto simp add: not_free_iff_lifted)
 
 
 subsection \<open>Eta-postponement theorem\<close>
 
 text \<open>
   Based on a paper proof due to Andreas Abel.
-  Unlike the proof by Masako Takahashi @{cite "Takahashi-IandC"}, it does not
+  Unlike the proof by Masako Takahashi \<^cite>\<open>"Takahashi-IandC"\<close>, it does not
   use parallel eta reduction, which only seems to complicate matters unnecessarily.
 \<close>
 
 theorem eta_case:
   fixes s :: dB
   assumes free: "\<not> free s 0"
   and s: "s[dummy/0] => u"
   shows "\<exists>t'. Abs (s \<degree> Var 0) => t' \<and> t' \<rightarrow>\<^sub>\<eta>\<^sup>* u"
 proof -
   from s have "lift (s[dummy/0]) 0 => lift u 0" by (simp del: lift_subst)
   with free have "s => lift u 0" by (simp add: lift_subst_dummy del: lift_subst)
   hence "Abs (s \<degree> Var 0) => Abs (lift u 0 \<degree> Var 0)" by simp
   moreover have "\<not> free (lift u 0) 0" by simp
   hence "Abs (lift u 0 \<degree> Var 0) \<rightarrow>\<^sub>\<eta> lift u 0[dummy/0]"
     by (rule eta.eta)
   hence "Abs (lift u 0 \<degree> Var 0) \<rightarrow>\<^sub>\<eta>\<^sup>* u" by simp
   ultimately show ?thesis by iprover
 qed
 
 theorem eta_par_beta:
   assumes st: "s \<rightarrow>\<^sub>\<eta> t"
   and tu: "t => u"
   shows "\<exists>t'. s => t' \<and> t' \<rightarrow>\<^sub>\<eta>\<^sup>* u" using tu st
 proof (induct arbitrary: s)
   case (var n)
   thus ?case by (iprover intro: par_beta_refl)
 next
   case (abs s' t)
   note abs' = this
   from \<open>s \<rightarrow>\<^sub>\<eta> Abs s'\<close> show ?case
   proof cases
     case (eta s'' dummy)
     from abs have "Abs s' => Abs t" by simp
     with eta have "s''[dummy/0] => Abs t" by simp
     with \<open>\<not> free s'' 0\<close> have "\<exists>t'. Abs (s'' \<degree> Var 0) => t' \<and> t' \<rightarrow>\<^sub>\<eta>\<^sup>* Abs t"
       by (rule eta_case)
     with eta show ?thesis by simp
   next
     case (abs r)
     from \<open>r \<rightarrow>\<^sub>\<eta> s'\<close>
     obtain t' where r: "r => t'" and t': "t' \<rightarrow>\<^sub>\<eta>\<^sup>* t" by (iprover dest: abs')
     from r have "Abs r => Abs t'" ..
     moreover from t' have "Abs t' \<rightarrow>\<^sub>\<eta>\<^sup>* Abs t" by (rule rtrancl_eta_Abs)
     ultimately show ?thesis using abs by simp iprover
   qed
 next
   case (app u u' t t')
   from \<open>s \<rightarrow>\<^sub>\<eta> u \<degree> t\<close> show ?case
   proof cases
     case (eta s' dummy)
     from app have "u \<degree> t => u' \<degree> t'" by simp
     with eta have "s'[dummy/0] => u' \<degree> t'" by simp
     with \<open>\<not> free s' 0\<close> have "\<exists>r. Abs (s' \<degree> Var 0) => r \<and> r \<rightarrow>\<^sub>\<eta>\<^sup>* u' \<degree> t'"
       by (rule eta_case)
     with eta show ?thesis by simp
   next
     case (appL s')
     from \<open>s' \<rightarrow>\<^sub>\<eta> u\<close>
     obtain r where s': "s' => r" and r: "r \<rightarrow>\<^sub>\<eta>\<^sup>* u'" by (iprover dest: app)
     from s' and app have "s' \<degree> t => r \<degree> t'" by simp
     moreover from r have "r \<degree> t' \<rightarrow>\<^sub>\<eta>\<^sup>* u' \<degree> t'" by (simp add: rtrancl_eta_AppL)
     ultimately show ?thesis using appL by simp iprover
   next
     case (appR s')
     from \<open>s' \<rightarrow>\<^sub>\<eta> t\<close>
     obtain r where s': "s' => r" and r: "r \<rightarrow>\<^sub>\<eta>\<^sup>* t'" by (iprover dest: app)
     from s' and app have "u \<degree> s' => u' \<degree> r" by simp
     moreover from r have "u' \<degree> r \<rightarrow>\<^sub>\<eta>\<^sup>* u' \<degree> t'" by (simp add: rtrancl_eta_AppR)
     ultimately show ?thesis using appR by simp iprover
   qed
 next
   case (beta u u' t t')
   from \<open>s \<rightarrow>\<^sub>\<eta> Abs u \<degree> t\<close> show ?case
   proof cases
     case (eta s' dummy)
     from beta have "Abs u \<degree> t => u'[t'/0]" by simp
     with eta have "s'[dummy/0] => u'[t'/0]" by simp
     with \<open>\<not> free s' 0\<close> have "\<exists>r. Abs (s' \<degree> Var 0) => r \<and> r \<rightarrow>\<^sub>\<eta>\<^sup>* u'[t'/0]"
       by (rule eta_case)
     with eta show ?thesis by simp
   next
     case (appL s')
     from \<open>s' \<rightarrow>\<^sub>\<eta> Abs u\<close> show ?thesis
     proof cases
       case (eta s'' dummy)
       have "Abs (lift u 1) = lift (Abs u) 0" by simp
       also from eta have "\<dots> = s''" by (simp add: lift_subst_dummy del: lift_subst)
       finally have s: "s = Abs (Abs (lift u 1) \<degree> Var 0) \<degree> t" using appL and eta by simp
       from beta have "lift u 1 => lift u' 1" by simp
       hence "Abs (lift u 1) \<degree> Var 0 => lift u' 1[Var 0/0]"
         using par_beta.var ..
       hence "Abs (Abs (lift u 1) \<degree> Var 0) \<degree> t => lift u' 1[Var 0/0][t'/0]"
         using \<open>t => t'\<close> ..
       with s have "s => u'[t'/0]" by simp
       thus ?thesis by iprover
     next
       case (abs r)
       from \<open>r \<rightarrow>\<^sub>\<eta> u\<close>
       obtain r'' where r: "r => r''" and r'': "r'' \<rightarrow>\<^sub>\<eta>\<^sup>* u'" by (iprover dest: beta)
       from r and beta have "Abs r \<degree> t => r''[t'/0]" by simp
       moreover from r'' have "r''[t'/0] \<rightarrow>\<^sub>\<eta>\<^sup>* u'[t'/0]"
         by (rule rtrancl_eta_subst')
       ultimately show ?thesis using abs and appL by simp iprover
     qed
   next
     case (appR s')
     from \<open>s' \<rightarrow>\<^sub>\<eta> t\<close>
     obtain r where s': "s' => r" and r: "r \<rightarrow>\<^sub>\<eta>\<^sup>* t'" by (iprover dest: beta)
     from s' and beta have "Abs u \<degree> s' => u'[r/0]" by simp
     moreover from r have "u'[r/0] \<rightarrow>\<^sub>\<eta>\<^sup>* u'[t'/0]"
       by (rule rtrancl_eta_subst'')
     ultimately show ?thesis using appR by simp iprover
   qed
 qed
 
 theorem eta_postponement':
   assumes eta: "s \<rightarrow>\<^sub>\<eta>\<^sup>* t" and beta: "t => u"
   shows "\<exists>t'. s => t' \<and> t' \<rightarrow>\<^sub>\<eta>\<^sup>* u" using eta beta
 proof (induct arbitrary: u)
   case base
   thus ?case by blast
 next
   case (step s' s'' s''')
   then obtain t' where s': "s' => t'" and t': "t' \<rightarrow>\<^sub>\<eta>\<^sup>* s'''"
     by (auto dest: eta_par_beta)
   from s' obtain t'' where s: "s => t''" and t'': "t'' \<rightarrow>\<^sub>\<eta>\<^sup>* t'" using step
     by blast
   from t'' and t' have "t'' \<rightarrow>\<^sub>\<eta>\<^sup>* s'''" by (rule rtranclp_trans)
   with s show ?case by iprover
 qed
 
 theorem eta_postponement:
   assumes "(sup beta eta)\<^sup>*\<^sup>* s t"
   shows "(beta\<^sup>*\<^sup>* OO eta\<^sup>*\<^sup>*) s t" using assms
 proof induct
   case base
   show ?case by blast
 next
   case (step s' s'')
   from step(3) obtain t' where s: "s \<rightarrow>\<^sub>\<beta>\<^sup>* t'" and t': "t' \<rightarrow>\<^sub>\<eta>\<^sup>* s'" by blast
   from step(2) show ?case
   proof
     assume "s' \<rightarrow>\<^sub>\<beta> s''"
     with beta_subset_par_beta have "s' => s''" ..
     with t' obtain t'' where st: "t' => t''" and tu: "t'' \<rightarrow>\<^sub>\<eta>\<^sup>* s''"
       by (auto dest: eta_postponement')
     from par_beta_subset_beta st have "t' \<rightarrow>\<^sub>\<beta>\<^sup>* t''" ..
     with s have "s \<rightarrow>\<^sub>\<beta>\<^sup>* t''" by (rule rtranclp_trans)
     thus ?thesis using tu ..
   next
     assume "s' \<rightarrow>\<^sub>\<eta> s''"
     with t' have "t' \<rightarrow>\<^sub>\<eta>\<^sup>* s''" ..
     with s show ?thesis ..
   qed
 qed
 
 end
diff --git a/src/HOL/Proofs/Lambda/Standardization.thy b/src/HOL/Proofs/Lambda/Standardization.thy
--- a/src/HOL/Proofs/Lambda/Standardization.thy
+++ b/src/HOL/Proofs/Lambda/Standardization.thy
@@ -1,360 +1,360 @@
 (*  Title:      HOL/Proofs/Lambda/Standardization.thy
     Author:     Stefan Berghofer
     Copyright   2005 TU Muenchen
 *)
 
 section \<open>Standardization\<close>
 
 theory Standardization
 imports NormalForm
 begin
 
 text \<open>
-Based on lecture notes by Ralph Matthes @{cite "Matthes-ESSLLI2000"},
-original proof idea due to Ralph Loader @{cite Loader1998}.
+Based on lecture notes by Ralph Matthes \<^cite>\<open>"Matthes-ESSLLI2000"\<close>,
+original proof idea due to Ralph Loader \<^cite>\<open>Loader1998\<close>.
 \<close>
 
 
 subsection \<open>Standard reduction relation\<close>
 
 declare listrel_mono [mono_set]
 
 inductive
   sred :: "dB \<Rightarrow> dB \<Rightarrow> bool"  (infixl "\<rightarrow>\<^sub>s" 50)
   and sredlist :: "dB list \<Rightarrow> dB list \<Rightarrow> bool"  (infixl "[\<rightarrow>\<^sub>s]" 50)
 where
   "s [\<rightarrow>\<^sub>s] t \<equiv> listrelp (\<rightarrow>\<^sub>s) s t"
 | Var: "rs [\<rightarrow>\<^sub>s] rs' \<Longrightarrow> Var x \<degree>\<degree> rs \<rightarrow>\<^sub>s Var x \<degree>\<degree> rs'"
 | Abs: "r \<rightarrow>\<^sub>s r' \<Longrightarrow> ss [\<rightarrow>\<^sub>s] ss' \<Longrightarrow> Abs r \<degree>\<degree> ss \<rightarrow>\<^sub>s Abs r' \<degree>\<degree> ss'"
 | Beta: "r[s/0] \<degree>\<degree> ss \<rightarrow>\<^sub>s t \<Longrightarrow> Abs r \<degree> s \<degree>\<degree> ss \<rightarrow>\<^sub>s t"
 
 lemma refl_listrelp: "\<forall>x\<in>set xs. R x x \<Longrightarrow> listrelp R xs xs"
   by (induct xs) (auto intro: listrelp.intros)
 
 lemma refl_sred: "t \<rightarrow>\<^sub>s t"
   by (induct t rule: Apps_dB_induct) (auto intro: refl_listrelp sred.intros)
 
 lemma refl_sreds: "ts [\<rightarrow>\<^sub>s] ts"
   by (simp add: refl_sred refl_listrelp)
 
 lemma listrelp_conj1: "listrelp (\<lambda>x y. R x y \<and> S x y) x y \<Longrightarrow> listrelp R x y"
   by (erule listrelp.induct) (auto intro: listrelp.intros)
 
 lemma listrelp_conj2: "listrelp (\<lambda>x y. R x y \<and> S x y) x y \<Longrightarrow> listrelp S x y"
   by (erule listrelp.induct) (auto intro: listrelp.intros)
 
 lemma listrelp_app:
   assumes xsys: "listrelp R xs ys"
   shows "listrelp R xs' ys' \<Longrightarrow> listrelp R (xs @ xs') (ys @ ys')" using xsys
   by (induct arbitrary: xs' ys') (auto intro: listrelp.intros)
 
 lemma lemma1:
   assumes r: "r \<rightarrow>\<^sub>s r'" and s: "s \<rightarrow>\<^sub>s s'"
   shows "r \<degree> s \<rightarrow>\<^sub>s r' \<degree> s'" using r
 proof induct
   case (Var rs rs' x)
   then have "rs [\<rightarrow>\<^sub>s] rs'" by (rule listrelp_conj1)
   moreover have "[s] [\<rightarrow>\<^sub>s] [s']" by (iprover intro: s listrelp.intros)
   ultimately have "rs @ [s] [\<rightarrow>\<^sub>s] rs' @ [s']" by (rule listrelp_app)
   hence "Var x \<degree>\<degree> (rs @ [s]) \<rightarrow>\<^sub>s Var x \<degree>\<degree> (rs' @ [s'])" by (rule sred.Var)
   thus ?case by (simp only: app_last)
 next
   case (Abs r r' ss ss')
   from Abs(3) have "ss [\<rightarrow>\<^sub>s] ss'" by (rule listrelp_conj1)
   moreover have "[s] [\<rightarrow>\<^sub>s] [s']" by (iprover intro: s listrelp.intros)
   ultimately have "ss @ [s] [\<rightarrow>\<^sub>s] ss' @ [s']" by (rule listrelp_app)
   with \<open>r \<rightarrow>\<^sub>s r'\<close> have "Abs r \<degree>\<degree> (ss @ [s]) \<rightarrow>\<^sub>s Abs r' \<degree>\<degree> (ss' @ [s'])"
     by (rule sred.Abs)
   thus ?case by (simp only: app_last)
 next
   case (Beta r u ss t)
   hence "r[u/0] \<degree>\<degree> (ss @ [s]) \<rightarrow>\<^sub>s t \<degree> s'" by (simp only: app_last)
   hence "Abs r \<degree> u \<degree>\<degree> (ss @ [s]) \<rightarrow>\<^sub>s t \<degree> s'" by (rule sred.Beta)
   thus ?case by (simp only: app_last)
 qed
 
 lemma lemma1':
   assumes ts: "ts [\<rightarrow>\<^sub>s] ts'"
   shows "r \<rightarrow>\<^sub>s r' \<Longrightarrow> r \<degree>\<degree> ts \<rightarrow>\<^sub>s r' \<degree>\<degree> ts'" using ts
   by (induct arbitrary: r r') (auto intro: lemma1)
 
 lemma lemma2_1:
   assumes beta: "t \<rightarrow>\<^sub>\<beta> u"
   shows "t \<rightarrow>\<^sub>s u" using beta
 proof induct
   case (beta s t)
   have "Abs s \<degree> t \<degree>\<degree> [] \<rightarrow>\<^sub>s s[t/0] \<degree>\<degree> []" by (iprover intro: sred.Beta refl_sred)
   thus ?case by simp
 next
   case (appL s t u)
   thus ?case by (iprover intro: lemma1 refl_sred)
 next
   case (appR s t u)
   thus ?case by (iprover intro: lemma1 refl_sred)
 next
   case (abs s t)
   hence "Abs s \<degree>\<degree> [] \<rightarrow>\<^sub>s Abs t \<degree>\<degree> []" by (iprover intro: sred.Abs listrelp.Nil)
   thus ?case by simp
 qed
 
 lemma listrelp_betas:
   assumes ts: "listrelp (\<rightarrow>\<^sub>\<beta>\<^sup>*) ts ts'"
   shows "\<And>t t'. t \<rightarrow>\<^sub>\<beta>\<^sup>* t' \<Longrightarrow> t \<degree>\<degree> ts \<rightarrow>\<^sub>\<beta>\<^sup>* t' \<degree>\<degree> ts'" using ts
   by induct auto
 
 lemma lemma2_2:
   assumes t: "t \<rightarrow>\<^sub>s u"
   shows "t \<rightarrow>\<^sub>\<beta>\<^sup>* u" using t
   by induct (auto dest: listrelp_conj2
     intro: listrelp_betas apps_preserves_beta converse_rtranclp_into_rtranclp)
 
 lemma sred_lift:
   assumes s: "s \<rightarrow>\<^sub>s t"
   shows "lift s i \<rightarrow>\<^sub>s lift t i" using s
 proof (induct arbitrary: i)
   case (Var rs rs' x)
   hence "map (\<lambda>t. lift t i) rs [\<rightarrow>\<^sub>s] map (\<lambda>t. lift t i) rs'"
     by induct (auto intro: listrelp.intros)
   thus ?case by (cases "x < i") (auto intro: sred.Var)
 next
   case (Abs r r' ss ss')
   from Abs(3) have "map (\<lambda>t. lift t i) ss [\<rightarrow>\<^sub>s] map (\<lambda>t. lift t i) ss'"
     by induct (auto intro: listrelp.intros)
   thus ?case by (auto intro: sred.Abs Abs)
 next
   case (Beta r s ss t)
   thus ?case by (auto intro: sred.Beta)
 qed
 
 lemma lemma3:
   assumes r: "r \<rightarrow>\<^sub>s r'"
   shows "s \<rightarrow>\<^sub>s s' \<Longrightarrow> r[s/x] \<rightarrow>\<^sub>s r'[s'/x]" using r
 proof (induct arbitrary: s s' x)
   case (Var rs rs' y)
   hence "map (\<lambda>t. t[s/x]) rs [\<rightarrow>\<^sub>s] map (\<lambda>t. t[s'/x]) rs'"
     by induct (auto intro: listrelp.intros Var)
   moreover have "Var y[s/x] \<rightarrow>\<^sub>s Var y[s'/x]"
   proof (cases "y < x")
     case True thus ?thesis by simp (rule refl_sred)
   next
     case False
     thus ?thesis
       by (cases "y = x") (auto simp add: Var intro: refl_sred)
   qed
   ultimately show ?case by simp (rule lemma1')
 next
   case (Abs r r' ss ss')
   from Abs(4) have "lift s 0 \<rightarrow>\<^sub>s lift s' 0" by (rule sred_lift)
   hence "r[lift s 0/Suc x] \<rightarrow>\<^sub>s r'[lift s' 0/Suc x]" by (fast intro: Abs.hyps)
   moreover from Abs(3) have "map (\<lambda>t. t[s/x]) ss [\<rightarrow>\<^sub>s] map (\<lambda>t. t[s'/x]) ss'"
     by induct (auto intro: listrelp.intros Abs)
   ultimately show ?case by simp (rule sred.Abs)
 next
   case (Beta r u ss t)
   thus ?case by (auto simp add: subst_subst intro: sred.Beta)
 qed
 
 lemma lemma4_aux:
   assumes rs: "listrelp (\<lambda>t u. t \<rightarrow>\<^sub>s u \<and> (\<forall>r. u \<rightarrow>\<^sub>\<beta> r \<longrightarrow> t \<rightarrow>\<^sub>s r)) rs rs'"
   shows "rs' => ss \<Longrightarrow> rs [\<rightarrow>\<^sub>s] ss" using rs
 proof (induct arbitrary: ss)
   case Nil
   thus ?case by cases (auto intro: listrelp.Nil)
 next
   case (Cons x y xs ys)
   note Cons' = Cons
   show ?case
   proof (cases ss)
     case Nil with Cons show ?thesis by simp
   next
     case (Cons y' ys')
     hence ss: "ss = y' # ys'" by simp
     from Cons Cons' have "y \<rightarrow>\<^sub>\<beta> y' \<and> ys' = ys \<or> y' = y \<and> ys => ys'" by simp
     hence "x # xs [\<rightarrow>\<^sub>s] y' # ys'"
     proof
       assume H: "y \<rightarrow>\<^sub>\<beta> y' \<and> ys' = ys"
       with Cons' have "x \<rightarrow>\<^sub>s y'" by blast
       moreover from Cons' have "xs [\<rightarrow>\<^sub>s] ys" by (iprover dest: listrelp_conj1)
       ultimately have "x # xs [\<rightarrow>\<^sub>s] y' # ys" by (rule listrelp.Cons)
       with H show ?thesis by simp
     next
       assume H: "y' = y \<and> ys => ys'"
       with Cons' have "x \<rightarrow>\<^sub>s y'" by blast
       moreover from H have "xs [\<rightarrow>\<^sub>s] ys'" by (blast intro: Cons')
       ultimately show ?thesis by (rule listrelp.Cons)
     qed
     with ss show ?thesis by simp
   qed
 qed
 
 lemma lemma4:
   assumes r: "r \<rightarrow>\<^sub>s r'"
   shows "r' \<rightarrow>\<^sub>\<beta> r'' \<Longrightarrow> r \<rightarrow>\<^sub>s r''" using r
 proof (induct arbitrary: r'')
   case (Var rs rs' x)
   then obtain ss where rs: "rs' => ss" and r'': "r'' = Var x \<degree>\<degree> ss"
     by (blast dest: head_Var_reduction)
   from Var(1) rs have "rs [\<rightarrow>\<^sub>s] ss" by (rule lemma4_aux)
   hence "Var x \<degree>\<degree> rs \<rightarrow>\<^sub>s Var x \<degree>\<degree> ss" by (rule sred.Var)
   with r'' show ?case by simp
 next
   case (Abs r r' ss ss')
   from \<open>Abs r' \<degree>\<degree> ss' \<rightarrow>\<^sub>\<beta> r''\<close> show ?case
   proof
     fix s
     assume r'': "r'' = s \<degree>\<degree> ss'"
     assume "Abs r' \<rightarrow>\<^sub>\<beta> s"
     then obtain r''' where s: "s = Abs r'''" and r''': "r' \<rightarrow>\<^sub>\<beta> r'''" by cases auto
     from r''' have "r \<rightarrow>\<^sub>s r'''" by (blast intro: Abs)
     moreover from Abs have "ss [\<rightarrow>\<^sub>s] ss'" by (iprover dest: listrelp_conj1)
     ultimately have "Abs r \<degree>\<degree> ss \<rightarrow>\<^sub>s Abs r''' \<degree>\<degree> ss'" by (rule sred.Abs)
     with r'' s show "Abs r \<degree>\<degree> ss \<rightarrow>\<^sub>s r''" by simp
   next
     fix rs'
     assume "ss' => rs'"
     with Abs(3) have "ss [\<rightarrow>\<^sub>s] rs'" by (rule lemma4_aux)
     with \<open>r \<rightarrow>\<^sub>s r'\<close> have "Abs r \<degree>\<degree> ss \<rightarrow>\<^sub>s Abs r' \<degree>\<degree> rs'" by (rule sred.Abs)
     moreover assume "r'' = Abs r' \<degree>\<degree> rs'"
     ultimately show "Abs r \<degree>\<degree> ss \<rightarrow>\<^sub>s r''" by simp
   next
     fix t u' us'
     assume "ss' = u' # us'"
     with Abs(3) obtain u us where
       ss: "ss = u # us" and u: "u \<rightarrow>\<^sub>s u'" and us: "us [\<rightarrow>\<^sub>s] us'"
       by cases (auto dest!: listrelp_conj1)
     have "r[u/0] \<rightarrow>\<^sub>s r'[u'/0]" using Abs(1) and u by (rule lemma3)
     with us have "r[u/0] \<degree>\<degree> us \<rightarrow>\<^sub>s r'[u'/0] \<degree>\<degree> us'" by (rule lemma1')
     hence "Abs r \<degree> u \<degree>\<degree> us \<rightarrow>\<^sub>s r'[u'/0] \<degree>\<degree> us'" by (rule sred.Beta)
     moreover assume "Abs r' = Abs t" and "r'' = t[u'/0] \<degree>\<degree> us'"
     ultimately show "Abs r \<degree>\<degree> ss \<rightarrow>\<^sub>s r''" using ss by simp
   qed
 next
   case (Beta r s ss t)
   show ?case
     by (rule sred.Beta) (rule Beta)+
 qed
 
 lemma rtrancl_beta_sred:
   assumes r: "r \<rightarrow>\<^sub>\<beta>\<^sup>* r'"
   shows "r \<rightarrow>\<^sub>s r'" using r
   by induct (iprover intro: refl_sred lemma4)+
 
 
 subsection \<open>Leftmost reduction and weakly normalizing terms\<close>
 
 inductive
   lred :: "dB \<Rightarrow> dB \<Rightarrow> bool"  (infixl "\<rightarrow>\<^sub>l" 50)
   and lredlist :: "dB list \<Rightarrow> dB list \<Rightarrow> bool"  (infixl "[\<rightarrow>\<^sub>l]" 50)
 where
   "s [\<rightarrow>\<^sub>l] t \<equiv> listrelp (\<rightarrow>\<^sub>l) s t"
 | Var: "rs [\<rightarrow>\<^sub>l] rs' \<Longrightarrow> Var x \<degree>\<degree> rs \<rightarrow>\<^sub>l Var x \<degree>\<degree> rs'"
 | Abs: "r \<rightarrow>\<^sub>l r' \<Longrightarrow> Abs r \<rightarrow>\<^sub>l Abs r'"
 | Beta: "r[s/0] \<degree>\<degree> ss \<rightarrow>\<^sub>l t \<Longrightarrow> Abs r \<degree> s \<degree>\<degree> ss \<rightarrow>\<^sub>l t"
 
 lemma lred_imp_sred:
   assumes lred: "s \<rightarrow>\<^sub>l t"
   shows "s \<rightarrow>\<^sub>s t" using lred
 proof induct
   case (Var rs rs' x)
   then have "rs [\<rightarrow>\<^sub>s] rs'"
     by induct (iprover intro: listrelp.intros)+
   then show ?case by (rule sred.Var)
 next
   case (Abs r r')
   from \<open>r \<rightarrow>\<^sub>s r'\<close>
   have "Abs r \<degree>\<degree> [] \<rightarrow>\<^sub>s Abs r' \<degree>\<degree> []" using listrelp.Nil
     by (rule sred.Abs)
   then show ?case by simp
 next
   case (Beta r s ss t)
   from \<open>r[s/0] \<degree>\<degree> ss \<rightarrow>\<^sub>s t\<close>
   show ?case by (rule sred.Beta)
 qed
 
 inductive WN :: "dB => bool"
   where
     Var: "listsp WN rs \<Longrightarrow> WN (Var n \<degree>\<degree> rs)"
   | Lambda: "WN r \<Longrightarrow> WN (Abs r)"
   | Beta: "WN ((r[s/0]) \<degree>\<degree> ss) \<Longrightarrow> WN ((Abs r \<degree> s) \<degree>\<degree> ss)"
 
 lemma listrelp_imp_listsp1:
   assumes H: "listrelp (\<lambda>x y. P x) xs ys"
   shows "listsp P xs" using H
   by induct auto
 
 lemma listrelp_imp_listsp2:
   assumes H: "listrelp (\<lambda>x y. P y) xs ys"
   shows "listsp P ys" using H
   by induct auto
 
 lemma lemma5:
   assumes lred: "r \<rightarrow>\<^sub>l r'"
   shows "WN r" and "NF r'" using lred
   by induct
     (iprover dest: listrelp_conj1 listrelp_conj2
      listrelp_imp_listsp1 listrelp_imp_listsp2 intro: WN.intros
      NF.intros [simplified listall_listsp_eq])+
 
 lemma lemma6:
   assumes wn: "WN r"
   shows "\<exists>r'. r \<rightarrow>\<^sub>l r'" using wn
 proof induct
   case (Var rs n)
   then have "\<exists>rs'. rs [\<rightarrow>\<^sub>l] rs'"
     by induct (iprover intro: listrelp.intros)+
   then show ?case by (iprover intro: lred.Var)
 qed (iprover intro: lred.intros)+
 
 lemma lemma7:
   assumes r: "r \<rightarrow>\<^sub>s r'"
   shows "NF r' \<Longrightarrow> r \<rightarrow>\<^sub>l r'" using r
 proof induct
   case (Var rs rs' x)
   from \<open>NF (Var x \<degree>\<degree> rs')\<close> have "listall NF rs'"
     by cases simp_all
   with Var(1) have "rs [\<rightarrow>\<^sub>l] rs'"
   proof induct
     case Nil
     show ?case by (rule listrelp.Nil)
   next
     case (Cons x y xs ys)
     hence "x \<rightarrow>\<^sub>l y" and "xs [\<rightarrow>\<^sub>l] ys" by simp_all
     thus ?case by (rule listrelp.Cons)
   qed
   thus ?case by (rule lred.Var)
 next
   case (Abs r r' ss ss')
   from \<open>NF (Abs r' \<degree>\<degree> ss')\<close>
   have ss': "ss' = []" by (rule Abs_NF)
   from Abs(3) have ss: "ss = []" using ss'
     by cases simp_all
   from ss' Abs have "NF (Abs r')" by simp
   hence "NF r'" by cases simp_all
   with Abs have "r \<rightarrow>\<^sub>l r'" by simp
   hence "Abs r \<rightarrow>\<^sub>l Abs r'" by (rule lred.Abs)
   with ss ss' show ?case by simp
 next
   case (Beta r s ss t)
   hence "r[s/0] \<degree>\<degree> ss \<rightarrow>\<^sub>l t" by simp
   thus ?case by (rule lred.Beta)
 qed
 
 lemma WN_eq: "WN t = (\<exists>t'. t \<rightarrow>\<^sub>\<beta>\<^sup>* t' \<and> NF t')"
 proof
   assume "WN t"
   then have "\<exists>t'. t \<rightarrow>\<^sub>l t'" by (rule lemma6)
   then obtain t' where t': "t \<rightarrow>\<^sub>l t'" ..
   then have NF: "NF t'" by (rule lemma5)
   from t' have "t \<rightarrow>\<^sub>s t'" by (rule lred_imp_sred)
   then have "t \<rightarrow>\<^sub>\<beta>\<^sup>* t'" by (rule lemma2_2)
   with NF show "\<exists>t'. t \<rightarrow>\<^sub>\<beta>\<^sup>* t' \<and> NF t'" by iprover
 next
   assume "\<exists>t'. t \<rightarrow>\<^sub>\<beta>\<^sup>* t' \<and> NF t'"
   then obtain t' where t': "t \<rightarrow>\<^sub>\<beta>\<^sup>* t'" and NF: "NF t'"
     by iprover
   from t' have "t \<rightarrow>\<^sub>s t'" by (rule rtrancl_beta_sred)
   then have "t \<rightarrow>\<^sub>l t'" using NF by (rule lemma7)
   then show "WN t" by (rule lemma5)
 qed
 
 end
diff --git a/src/HOL/Proofs/Lambda/StrongNorm.thy b/src/HOL/Proofs/Lambda/StrongNorm.thy
--- a/src/HOL/Proofs/Lambda/StrongNorm.thy
+++ b/src/HOL/Proofs/Lambda/StrongNorm.thy
@@ -1,284 +1,284 @@
 (*  Title:      HOL/Proofs/Lambda/StrongNorm.thy
     Author:     Stefan Berghofer
     Copyright   2000 TU Muenchen
 *)
 
 section \<open>Strong normalization for simply-typed lambda calculus\<close>
 
 theory StrongNorm imports LambdaType InductTermi begin
 
 text \<open>
 Formalization by Stefan Berghofer. Partly based on a paper proof by
-Felix Joachimski and Ralph Matthes @{cite "Matthes-Joachimski-AML"}.
+Felix Joachimski and Ralph Matthes \<^cite>\<open>"Matthes-Joachimski-AML"\<close>.
 \<close>
 
 
 subsection \<open>Properties of \<open>IT\<close>\<close>
 
 lemma lift_IT [intro!]: "IT t \<Longrightarrow> IT (lift t i)"
   apply (induct arbitrary: i set: IT)
     apply (simp (no_asm))
     apply (rule conjI)
      apply
       (rule impI,
        rule IT.Var,
        erule listsp.induct,
        simp (no_asm),
        simp (no_asm),
        rule listsp.Cons,
        blast,
        assumption)+
      apply auto
    done
 
 lemma lifts_IT: "listsp IT ts \<Longrightarrow> listsp IT (map (\<lambda>t. lift t 0) ts)"
   by (induct ts) auto
 
 lemma subst_Var_IT: "IT r \<Longrightarrow> IT (r[Var i/j])"
   apply (induct arbitrary: i j set: IT)
     txt \<open>Case \<^term>\<open>Var\<close>:\<close>
     apply (simp (no_asm) add: subst_Var)
     apply
     ((rule conjI impI)+,
       rule IT.Var,
       erule listsp.induct,
       simp (no_asm),
       simp (no_asm),
       rule listsp.Cons,
       fast,
       assumption)+
    txt \<open>Case \<^term>\<open>Lambda\<close>:\<close>
    apply atomize
    apply simp
    apply (rule IT.Lambda)
    apply fast
   txt \<open>Case \<^term>\<open>Beta\<close>:\<close>
   apply atomize
   apply (simp (no_asm_use) add: subst_subst [symmetric])
   apply (rule IT.Beta)
    apply auto
   done
 
 lemma Var_IT: "IT (Var n)"
   apply (subgoal_tac "IT (Var n \<degree>\<degree> [])")
    apply simp
   apply (rule IT.Var)
   apply (rule listsp.Nil)
   done
 
 lemma app_Var_IT: "IT t \<Longrightarrow> IT (t \<degree> Var i)"
   apply (induct set: IT)
     apply (subst app_last)
     apply (rule IT.Var)
     apply simp
     apply (rule listsp.Cons)
      apply (rule Var_IT)
     apply (rule listsp.Nil)
    apply (rule IT.Beta [where ?ss = "[]", unfolded foldl_Nil [THEN eq_reflection]])
     apply (erule subst_Var_IT)
    apply (rule Var_IT)
   apply (subst app_last)
   apply (rule IT.Beta)
    apply (subst app_last [symmetric])
    apply assumption
   apply assumption
   done
 
 
 subsection \<open>Well-typed substitution preserves termination\<close>
 
 lemma subst_type_IT:
   "\<And>t e T u i. IT t \<Longrightarrow> e\<langle>i:U\<rangle> \<turnstile> t : T \<Longrightarrow>
     IT u \<Longrightarrow> e \<turnstile> u : U \<Longrightarrow> IT (t[u/i])"
   (is "PROP ?P U" is "\<And>t e T u i. _ \<Longrightarrow> PROP ?Q t e T u i U")
 proof (induct U)
   fix T t
   assume MI1: "\<And>T1 T2. T = T1 \<Rightarrow> T2 \<Longrightarrow> PROP ?P T1"
   assume MI2: "\<And>T1 T2. T = T1 \<Rightarrow> T2 \<Longrightarrow> PROP ?P T2"
   assume "IT t"
   thus "\<And>e T' u i. PROP ?Q t e T' u i T"
   proof induct
     fix e T' u i
     assume uIT: "IT u"
     assume uT: "e \<turnstile> u : T"
     {
       case (Var rs n e1 T'1 u1 i1)
       assume nT: "e\<langle>i:T\<rangle> \<turnstile> Var n \<degree>\<degree> rs : T'"
       let ?ty = "\<lambda>t. \<exists>T'. e\<langle>i:T\<rangle> \<turnstile> t : T'"
       let ?R = "\<lambda>t. \<forall>e T' u i.
         e\<langle>i:T\<rangle> \<turnstile> t : T' \<longrightarrow> IT u \<longrightarrow> e \<turnstile> u : T \<longrightarrow> IT (t[u/i])"
       show "IT ((Var n \<degree>\<degree> rs)[u/i])"
       proof (cases "n = i")
         case True
         show ?thesis
         proof (cases rs)
           case Nil
           with uIT True show ?thesis by simp
         next
           case (Cons a as)
           with nT have "e\<langle>i:T\<rangle> \<turnstile> Var n \<degree> a \<degree>\<degree> as : T'" by simp
           then obtain Ts
               where headT: "e\<langle>i:T\<rangle> \<turnstile> Var n \<degree> a : Ts \<Rrightarrow> T'"
               and argsT: "e\<langle>i:T\<rangle> \<tturnstile> as : Ts"
             by (rule list_app_typeE)
           from headT obtain T''
               where varT: "e\<langle>i:T\<rangle> \<turnstile> Var n : T'' \<Rightarrow> Ts \<Rrightarrow> T'"
               and argT: "e\<langle>i:T\<rangle> \<turnstile> a : T''"
             by cases simp_all
           from varT True have T: "T = T'' \<Rightarrow> Ts \<Rrightarrow> T'"
             by cases auto
           with uT have uT': "e \<turnstile> u : T'' \<Rightarrow> Ts \<Rrightarrow> T'" by simp
           from T have "IT ((Var 0 \<degree>\<degree> map (\<lambda>t. lift t 0)
             (map (\<lambda>t. t[u/i]) as))[(u \<degree> a[u/i])/0])"
           proof (rule MI2)
             from T have "IT ((lift u 0 \<degree> Var 0)[a[u/i]/0])"
             proof (rule MI1)
               have "IT (lift u 0)" by (rule lift_IT [OF uIT])
               thus "IT (lift u 0 \<degree> Var 0)" by (rule app_Var_IT)
               show "e\<langle>0:T''\<rangle> \<turnstile> lift u 0 \<degree> Var 0 : Ts \<Rrightarrow> T'"
               proof (rule typing.App)
                 show "e\<langle>0:T''\<rangle> \<turnstile> lift u 0 : T'' \<Rightarrow> Ts \<Rrightarrow> T'"
                   by (rule lift_type) (rule uT')
                 show "e\<langle>0:T''\<rangle> \<turnstile> Var 0 : T''"
                   by (rule typing.Var) simp
               qed
               from Var have "?R a" by cases (simp_all add: Cons)
               with argT uIT uT show "IT (a[u/i])" by simp
               from argT uT show "e \<turnstile> a[u/i] : T''"
                 by (rule subst_lemma) simp
             qed
             thus "IT (u \<degree> a[u/i])" by simp
             from Var have "listsp ?R as"
               by cases (simp_all add: Cons)
             moreover from argsT have "listsp ?ty as"
               by (rule lists_typings)
             ultimately have "listsp (\<lambda>t. ?R t \<and> ?ty t) as"
               by simp
             hence "listsp IT (map (\<lambda>t. lift t 0) (map (\<lambda>t. t[u/i]) as))"
               (is "listsp IT (?ls as)")
             proof induct
               case Nil
               show ?case by fastforce
             next
               case (Cons b bs)
               hence I: "?R b" by simp
               from Cons obtain U where "e\<langle>i:T\<rangle> \<turnstile> b : U" by fast
               with uT uIT I have "IT (b[u/i])" by simp
               hence "IT (lift (b[u/i]) 0)" by (rule lift_IT)
               hence "listsp IT (lift (b[u/i]) 0 # ?ls bs)"
                 by (rule listsp.Cons) (rule Cons)
               thus ?case by simp
             qed
             thus "IT (Var 0 \<degree>\<degree> ?ls as)" by (rule IT.Var)
             have "e\<langle>0:Ts \<Rrightarrow> T'\<rangle> \<turnstile> Var 0 : Ts \<Rrightarrow> T'"
               by (rule typing.Var) simp
             moreover from uT argsT have "e \<tturnstile> map (\<lambda>t. t[u/i]) as : Ts"
               by (rule substs_lemma)
             hence "e\<langle>0:Ts \<Rrightarrow> T'\<rangle> \<tturnstile> ?ls as : Ts"
               by (rule lift_types)
             ultimately show "e\<langle>0:Ts \<Rrightarrow> T'\<rangle> \<turnstile> Var 0 \<degree>\<degree> ?ls as : T'"
               by (rule list_app_typeI)
             from argT uT have "e \<turnstile> a[u/i] : T''"
               by (rule subst_lemma) (rule refl)
             with uT' show "e \<turnstile> u \<degree> a[u/i] : Ts \<Rrightarrow> T'"
               by (rule typing.App)
           qed
           with Cons True show ?thesis
             by (simp add: comp_def)
         qed
       next
         case False
         from Var have "listsp ?R rs" by simp
         moreover from nT obtain Ts where "e\<langle>i:T\<rangle> \<tturnstile> rs : Ts"
           by (rule list_app_typeE)
         hence "listsp ?ty rs" by (rule lists_typings)
         ultimately have "listsp (\<lambda>t. ?R t \<and> ?ty t) rs"
           by simp
         hence "listsp IT (map (\<lambda>x. x[u/i]) rs)"
         proof induct
           case Nil
           show ?case by fastforce
         next
           case (Cons a as)
           hence I: "?R a" by simp
           from Cons obtain U where "e\<langle>i:T\<rangle> \<turnstile> a : U" by fast
           with uT uIT I have "IT (a[u/i])" by simp
           hence "listsp IT (a[u/i] # map (\<lambda>t. t[u/i]) as)"
             by (rule listsp.Cons) (rule Cons)
           thus ?case by simp
         qed
         with False show ?thesis by (auto simp add: subst_Var)
       qed
     next
       case (Lambda r e1 T'1 u1 i1)
       assume "e\<langle>i:T\<rangle> \<turnstile> Abs r : T'"
         and "\<And>e T' u i. PROP ?Q r e T' u i T"
       with uIT uT show "IT (Abs r[u/i])"
         by fastforce
     next
       case (Beta r a as e1 T'1 u1 i1)
       assume T: "e\<langle>i:T\<rangle> \<turnstile> Abs r \<degree> a \<degree>\<degree> as : T'"
       assume SI1: "\<And>e T' u i. PROP ?Q (r[a/0] \<degree>\<degree> as) e T' u i T"
       assume SI2: "\<And>e T' u i. PROP ?Q a e T' u i T"
       have "IT (Abs (r[lift u 0/Suc i]) \<degree> a[u/i] \<degree>\<degree> map (\<lambda>t. t[u/i]) as)"
       proof (rule IT.Beta)
         have "Abs r \<degree> a \<degree>\<degree> as \<rightarrow>\<^sub>\<beta> r[a/0] \<degree>\<degree> as"
           by (rule apps_preserves_beta) (rule beta.beta)
         with T have "e\<langle>i:T\<rangle> \<turnstile> r[a/0] \<degree>\<degree> as : T'"
           by (rule subject_reduction)
         hence "IT ((r[a/0] \<degree>\<degree> as)[u/i])"
           using uIT uT by (rule SI1)
         thus "IT (r[lift u 0/Suc i][a[u/i]/0] \<degree>\<degree> map (\<lambda>t. t[u/i]) as)"
           by (simp del: subst_map add: subst_subst subst_map [symmetric])
         from T obtain U where "e\<langle>i:T\<rangle> \<turnstile> Abs r \<degree> a : U"
           by (rule list_app_typeE) fast
         then obtain T'' where "e\<langle>i:T\<rangle> \<turnstile> a : T''" by cases simp_all
         thus "IT (a[u/i])" using uIT uT by (rule SI2)
       qed
       thus "IT ((Abs r \<degree> a \<degree>\<degree> as)[u/i])" by simp
     }
   qed
 qed
 
 
 subsection \<open>Well-typed terms are strongly normalizing\<close>
 
 lemma type_implies_IT:
   assumes "e \<turnstile> t : T"
   shows "IT t"
   using assms
 proof induct
   case Var
   show ?case by (rule Var_IT)
 next
   case Abs
   show ?case by (rule IT.Lambda) (rule Abs)
 next
   case (App e s T U t)
   have "IT ((Var 0 \<degree> lift t 0)[s/0])"
   proof (rule subst_type_IT)
     have "IT (lift t 0)" using \<open>IT t\<close> by (rule lift_IT)
     hence "listsp IT [lift t 0]" by (rule listsp.Cons) (rule listsp.Nil)
     hence "IT (Var 0 \<degree>\<degree> [lift t 0])" by (rule IT.Var)
     also have "Var 0 \<degree>\<degree> [lift t 0] = Var 0 \<degree> lift t 0" by simp
     finally show "IT \<dots>" .
     have "e\<langle>0:T \<Rightarrow> U\<rangle> \<turnstile> Var 0 : T \<Rightarrow> U"
       by (rule typing.Var) simp
     moreover have "e\<langle>0:T \<Rightarrow> U\<rangle> \<turnstile> lift t 0 : T"
       by (rule lift_type) (rule App.hyps)
     ultimately show "e\<langle>0:T \<Rightarrow> U\<rangle> \<turnstile> Var 0 \<degree> lift t 0 : U"
       by (rule typing.App)
     show "IT s" by fact
     show "e \<turnstile> s : T \<Rightarrow> U" by fact
   qed
   thus ?case by simp
 qed
 
 theorem type_implies_termi: "e \<turnstile> t : T \<Longrightarrow> termip beta t"
 proof -
   assume "e \<turnstile> t : T"
   hence "IT t" by (rule type_implies_IT)
   thus ?thesis by (rule IT_implies_termi)
 qed
 
 end
diff --git a/src/HOL/Proofs/Lambda/WeakNorm.thy b/src/HOL/Proofs/Lambda/WeakNorm.thy
--- a/src/HOL/Proofs/Lambda/WeakNorm.thy
+++ b/src/HOL/Proofs/Lambda/WeakNorm.thy
@@ -1,442 +1,442 @@
 (*  Title:      HOL/Proofs/Lambda/WeakNorm.thy
     Author:     Stefan Berghofer
     Copyright   2003 TU Muenchen
 *)
 
 section \<open>Weak normalization for simply-typed lambda calculus\<close>
 
 theory WeakNorm
 imports LambdaType NormalForm "HOL-Library.Realizers" "HOL-Library.Code_Target_Int"
 begin
 
 text \<open>
 Formalization by Stefan Berghofer. Partly based on a paper proof by
-Felix Joachimski and Ralph Matthes @{cite "Matthes-Joachimski-AML"}.
+Felix Joachimski and Ralph Matthes \<^cite>\<open>"Matthes-Joachimski-AML"\<close>.
 \<close>
 
 
 subsection \<open>Main theorems\<close>
 
 lemma norm_list:
   assumes f_compat: "\<And>t t'. t \<rightarrow>\<^sub>\<beta>\<^sup>* t' \<Longrightarrow> f t \<rightarrow>\<^sub>\<beta>\<^sup>* f t'"
   and f_NF: "\<And>t. NF t \<Longrightarrow> NF (f t)"
   and uNF: "NF u" and uT: "e \<turnstile> u : T"
   shows "\<And>Us. e\<langle>i:T\<rangle> \<tturnstile> as : Us \<Longrightarrow>
     listall (\<lambda>t. \<forall>e T' u i. e\<langle>i:T\<rangle> \<turnstile> t : T' \<longrightarrow>
       NF u \<longrightarrow> e \<turnstile> u : T \<longrightarrow> (\<exists>t'. t[u/i] \<rightarrow>\<^sub>\<beta>\<^sup>* t' \<and> NF t')) as \<Longrightarrow>
     \<exists>as'. \<forall>j. Var j \<degree>\<degree> map (\<lambda>t. f (t[u/i])) as \<rightarrow>\<^sub>\<beta>\<^sup>*
       Var j \<degree>\<degree> map f as' \<and> NF (Var j \<degree>\<degree> map f as')"
   (is "\<And>Us. _ \<Longrightarrow> listall ?R as \<Longrightarrow> \<exists>as'. ?ex Us as as'")
 proof (induct as rule: rev_induct)
   case (Nil Us)
   with Var_NF have "?ex Us [] []" by simp
   thus ?case ..
 next
   case (snoc b bs Us)
   have "e\<langle>i:T\<rangle> \<tturnstile> bs  @ [b] : Us" by fact
   then obtain Vs W where Us: "Us = Vs @ [W]"
     and bs: "e\<langle>i:T\<rangle> \<tturnstile> bs : Vs" and bT: "e\<langle>i:T\<rangle> \<turnstile> b : W"
     by (rule types_snocE)
   from snoc have "listall ?R bs" by simp
   with bs have "\<exists>bs'. ?ex Vs bs bs'" by (rule snoc)
   then obtain bs' where bsred: "Var j \<degree>\<degree> map (\<lambda>t. f (t[u/i])) bs \<rightarrow>\<^sub>\<beta>\<^sup>* Var j \<degree>\<degree> map f bs'"
     and bsNF: "NF (Var j \<degree>\<degree> map f bs')" for j
     by iprover
   from snoc have "?R b" by simp
   with bT and uNF and uT have "\<exists>b'. b[u/i] \<rightarrow>\<^sub>\<beta>\<^sup>* b' \<and> NF b'"
     by iprover
   then obtain b' where bred: "b[u/i] \<rightarrow>\<^sub>\<beta>\<^sup>* b'" and bNF: "NF b'"
     by iprover
   from bsNF [of 0] have "listall NF (map f bs')"
     by (rule App_NF_D)
   moreover have "NF (f b')" using bNF by (rule f_NF)
   ultimately have "listall NF (map f (bs' @ [b']))"
     by simp
   hence "\<And>j. NF (Var j \<degree>\<degree> map f (bs' @ [b']))" by (rule NF.App)
   moreover from bred have "f (b[u/i]) \<rightarrow>\<^sub>\<beta>\<^sup>* f b'"
     by (rule f_compat)
   with bsred have
     "\<And>j. (Var j \<degree>\<degree> map (\<lambda>t. f (t[u/i])) bs) \<degree> f (b[u/i]) \<rightarrow>\<^sub>\<beta>\<^sup>*
      (Var j \<degree>\<degree> map f bs') \<degree> f b'" by (rule rtrancl_beta_App)
   ultimately have "?ex Us (bs @ [b]) (bs' @ [b'])" by simp
   thus ?case ..
 qed
 
 lemma subst_type_NF:
   "\<And>t e T u i. NF t \<Longrightarrow> e\<langle>i:U\<rangle> \<turnstile> t : T \<Longrightarrow> NF u \<Longrightarrow> e \<turnstile> u : U \<Longrightarrow> \<exists>t'. t[u/i] \<rightarrow>\<^sub>\<beta>\<^sup>* t' \<and> NF t'"
   (is "PROP ?P U" is "\<And>t e T u i. _ \<Longrightarrow> PROP ?Q t e T u i U")
 proof (induct U)
   fix T t
   let ?R = "\<lambda>t. \<forall>e T' u i.
     e\<langle>i:T\<rangle> \<turnstile> t : T' \<longrightarrow> NF u \<longrightarrow> e \<turnstile> u : T \<longrightarrow> (\<exists>t'. t[u/i] \<rightarrow>\<^sub>\<beta>\<^sup>* t' \<and> NF t')"
   assume MI1: "\<And>T1 T2. T = T1 \<Rightarrow> T2 \<Longrightarrow> PROP ?P T1"
   assume MI2: "\<And>T1 T2. T = T1 \<Rightarrow> T2 \<Longrightarrow> PROP ?P T2"
   assume "NF t"
   thus "\<And>e T' u i. PROP ?Q t e T' u i T"
   proof induct
     fix e T' u i assume uNF: "NF u" and uT: "e \<turnstile> u : T"
     {
       case (App ts x e1 T'1 u1 i1)
       assume "e\<langle>i:T\<rangle> \<turnstile> Var x \<degree>\<degree> ts : T'"
       then obtain Us
         where varT: "e\<langle>i:T\<rangle> \<turnstile> Var x : Us \<Rrightarrow> T'"
         and argsT: "e\<langle>i:T\<rangle> \<tturnstile> ts : Us"
         by (rule var_app_typesE)
       from nat_eq_dec show "\<exists>t'. (Var x \<degree>\<degree> ts)[u/i] \<rightarrow>\<^sub>\<beta>\<^sup>* t' \<and> NF t'"
       proof
         assume eq: "x = i"
         show ?thesis
         proof (cases ts)
           case Nil
           with eq have "(Var x \<degree>\<degree> [])[u/i] \<rightarrow>\<^sub>\<beta>\<^sup>* u" by simp
           with Nil and uNF show ?thesis by simp iprover
         next
           case (Cons a as)
           with argsT obtain T'' Ts where Us: "Us = T'' # Ts"
             by (cases Us) (rule FalseE, simp)
           from varT and Us have varT: "e\<langle>i:T\<rangle> \<turnstile> Var x : T'' \<Rightarrow> Ts \<Rrightarrow> T'"
             by simp
           from varT eq have T: "T = T'' \<Rightarrow> Ts \<Rrightarrow> T'" by cases auto
           with uT have uT': "e \<turnstile> u : T'' \<Rightarrow> Ts \<Rrightarrow> T'" by simp
           from argsT Us Cons have argsT': "e\<langle>i:T\<rangle> \<tturnstile> as : Ts" by simp
           from argsT Us Cons have argT: "e\<langle>i:T\<rangle> \<turnstile> a : T''" by simp
           from argT uT refl have aT: "e \<turnstile> a[u/i] : T''" by (rule subst_lemma)
           from App and Cons have "listall ?R as" by simp (iprover dest: listall_conj2)
           with lift_preserves_beta' lift_NF uNF uT argsT'
           have "\<exists>as'. \<forall>j. Var j \<degree>\<degree> map (\<lambda>t. lift (t[u/i]) 0) as \<rightarrow>\<^sub>\<beta>\<^sup>*
             Var j \<degree>\<degree> map (\<lambda>t. lift t 0) as' \<and>
             NF (Var j \<degree>\<degree> map (\<lambda>t. lift t 0) as')" by (rule norm_list)
           then obtain as' where
             asred: "Var 0 \<degree>\<degree> map (\<lambda>t. lift (t[u/i]) 0) as \<rightarrow>\<^sub>\<beta>\<^sup>*
               Var 0 \<degree>\<degree> map (\<lambda>t. lift t 0) as'"
             and asNF: "NF (Var 0 \<degree>\<degree> map (\<lambda>t. lift t 0) as')" by iprover
           from App and Cons have "?R a" by simp
           with argT and uNF and uT have "\<exists>a'. a[u/i] \<rightarrow>\<^sub>\<beta>\<^sup>* a' \<and> NF a'"
             by iprover
           then obtain a' where ared: "a[u/i] \<rightarrow>\<^sub>\<beta>\<^sup>* a'" and aNF: "NF a'" by iprover
           from uNF have "NF (lift u 0)" by (rule lift_NF)
           hence "\<exists>u'. lift u 0 \<degree> Var 0 \<rightarrow>\<^sub>\<beta>\<^sup>* u' \<and> NF u'" by (rule app_Var_NF)
           then obtain u' where ured: "lift u 0 \<degree> Var 0 \<rightarrow>\<^sub>\<beta>\<^sup>* u'" and u'NF: "NF u'"
             by iprover
           from T and u'NF have "\<exists>ua. u'[a'/0] \<rightarrow>\<^sub>\<beta>\<^sup>* ua \<and> NF ua"
           proof (rule MI1)
             have "e\<langle>0:T''\<rangle> \<turnstile> lift u 0 \<degree> Var 0 : Ts \<Rrightarrow> T'"
             proof (rule typing.App)
               from uT' show "e\<langle>0:T''\<rangle> \<turnstile> lift u 0 : T'' \<Rightarrow> Ts \<Rrightarrow> T'" by (rule lift_type)
               show "e\<langle>0:T''\<rangle> \<turnstile> Var 0 : T''" by (rule typing.Var) simp
             qed
             with ured show "e\<langle>0:T''\<rangle> \<turnstile> u' : Ts \<Rrightarrow> T'" by (rule subject_reduction')
             from ared aT show "e \<turnstile> a' : T''" by (rule subject_reduction')
             show "NF a'" by fact
           qed
           then obtain ua where uared: "u'[a'/0] \<rightarrow>\<^sub>\<beta>\<^sup>* ua" and uaNF: "NF ua"
             by iprover
           from ared have "(lift u 0 \<degree> Var 0)[a[u/i]/0] \<rightarrow>\<^sub>\<beta>\<^sup>* (lift u 0 \<degree> Var 0)[a'/0]"
             by (rule subst_preserves_beta2')
           also from ured have "(lift u 0 \<degree> Var 0)[a'/0] \<rightarrow>\<^sub>\<beta>\<^sup>* u'[a'/0]"
             by (rule subst_preserves_beta')
           also note uared
           finally have "(lift u 0 \<degree> Var 0)[a[u/i]/0] \<rightarrow>\<^sub>\<beta>\<^sup>* ua" .
           hence uared': "u \<degree> a[u/i] \<rightarrow>\<^sub>\<beta>\<^sup>* ua" by simp
           from T asNF _ uaNF have "\<exists>r. (Var 0 \<degree>\<degree> map (\<lambda>t. lift t 0) as')[ua/0] \<rightarrow>\<^sub>\<beta>\<^sup>* r \<and> NF r"
           proof (rule MI2)
             have "e\<langle>0:Ts \<Rrightarrow> T'\<rangle> \<turnstile> Var 0 \<degree>\<degree> map (\<lambda>t. lift (t[u/i]) 0) as : T'"
             proof (rule list_app_typeI)
               show "e\<langle>0:Ts \<Rrightarrow> T'\<rangle> \<turnstile> Var 0 : Ts \<Rrightarrow> T'" by (rule typing.Var) simp
               from uT argsT' have "e \<tturnstile> map (\<lambda>t. t[u/i]) as : Ts"
                 by (rule substs_lemma)
               hence "e\<langle>0:Ts \<Rrightarrow> T'\<rangle> \<tturnstile> map (\<lambda>t. lift t 0) (map (\<lambda>t. t[u/i]) as) : Ts"
                 by (rule lift_types)
               thus "e\<langle>0:Ts \<Rrightarrow> T'\<rangle> \<tturnstile> map (\<lambda>t. lift (t[u/i]) 0) as : Ts"
                 by (simp_all add: o_def)
             qed
             with asred show "e\<langle>0:Ts \<Rrightarrow> T'\<rangle> \<turnstile> Var 0 \<degree>\<degree> map (\<lambda>t. lift t 0) as' : T'"
               by (rule subject_reduction')
             from argT uT refl have "e \<turnstile> a[u/i] : T''" by (rule subst_lemma)
             with uT' have "e \<turnstile> u \<degree> a[u/i] : Ts \<Rrightarrow> T'" by (rule typing.App)
             with uared' show "e \<turnstile> ua : Ts \<Rrightarrow> T'" by (rule subject_reduction')
           qed
           then obtain r where rred: "(Var 0 \<degree>\<degree> map (\<lambda>t. lift t 0) as')[ua/0] \<rightarrow>\<^sub>\<beta>\<^sup>* r"
             and rnf: "NF r" by iprover
           from asred have
             "(Var 0 \<degree>\<degree> map (\<lambda>t. lift (t[u/i]) 0) as)[u \<degree> a[u/i]/0] \<rightarrow>\<^sub>\<beta>\<^sup>*
             (Var 0 \<degree>\<degree> map (\<lambda>t. lift t 0) as')[u \<degree> a[u/i]/0]"
             by (rule subst_preserves_beta')
           also from uared' have "(Var 0 \<degree>\<degree> map (\<lambda>t. lift t 0) as')[u \<degree> a[u/i]/0] \<rightarrow>\<^sub>\<beta>\<^sup>*
             (Var 0 \<degree>\<degree> map (\<lambda>t. lift t 0) as')[ua/0]" by (rule subst_preserves_beta2')
           also note rred
           finally have "(Var 0 \<degree>\<degree> map (\<lambda>t. lift (t[u/i]) 0) as)[u \<degree> a[u/i]/0] \<rightarrow>\<^sub>\<beta>\<^sup>* r" .
           with rnf Cons eq show ?thesis
             by (simp add: o_def) iprover
         qed
       next
         assume neq: "x \<noteq> i"
         from App have "listall ?R ts" by (iprover dest: listall_conj2)
         with uNF uT argsT
         have "\<exists>ts'. \<forall>j. Var j \<degree>\<degree> map (\<lambda>t. t[u/i]) ts \<rightarrow>\<^sub>\<beta>\<^sup>* Var j \<degree>\<degree> ts' \<and>
           NF (Var j \<degree>\<degree> ts')" (is "\<exists>ts'. ?ex ts'")
           by (rule norm_list [of "\<lambda>t. t", simplified])
         then obtain ts' where NF: "?ex ts'" ..
         from nat_le_dec show ?thesis
         proof
           assume "i < x"
           with NF show ?thesis by simp iprover
         next
           assume "\<not> (i < x)"
           with NF neq show ?thesis by (simp add: subst_Var) iprover
         qed
       qed
     next
       case (Abs r e1 T'1 u1 i1)
       assume absT: "e\<langle>i:T\<rangle> \<turnstile> Abs r : T'"
       then obtain R S where "e\<langle>0:R\<rangle>\<langle>Suc i:T\<rangle>  \<turnstile> r : S" by (rule abs_typeE) simp
       moreover have "NF (lift u 0)" using \<open>NF u\<close> by (rule lift_NF)
       moreover have "e\<langle>0:R\<rangle> \<turnstile> lift u 0 : T" using uT by (rule lift_type)
       ultimately have "\<exists>t'. r[lift u 0/Suc i] \<rightarrow>\<^sub>\<beta>\<^sup>* t' \<and> NF t'" by (rule Abs)
       thus "\<exists>t'. Abs r[u/i] \<rightarrow>\<^sub>\<beta>\<^sup>* t' \<and> NF t'"
         by simp (iprover intro: rtrancl_beta_Abs NF.Abs)
     }
   qed
 qed
 
 
 \<comment> \<open>A computationally relevant copy of @{term "e \<turnstile> t : T"}\<close>
 inductive rtyping :: "(nat \<Rightarrow> type) \<Rightarrow> dB \<Rightarrow> type \<Rightarrow> bool"  ("_ \<turnstile>\<^sub>R _ : _" [50, 50, 50] 50)
   where
     Var: "e x = T \<Longrightarrow> e \<turnstile>\<^sub>R Var x : T"
   | Abs: "e\<langle>0:T\<rangle> \<turnstile>\<^sub>R t : U \<Longrightarrow> e \<turnstile>\<^sub>R Abs t : (T \<Rightarrow> U)"
   | App: "e \<turnstile>\<^sub>R s : T \<Rightarrow> U \<Longrightarrow> e \<turnstile>\<^sub>R t : T \<Longrightarrow> e \<turnstile>\<^sub>R (s \<degree> t) : U"
 
 lemma rtyping_imp_typing: "e \<turnstile>\<^sub>R t : T \<Longrightarrow> e \<turnstile> t : T"
   apply (induct set: rtyping)
   apply (erule typing.Var)
   apply (erule typing.Abs)
   apply (erule typing.App)
   apply assumption
   done
 
 
 theorem type_NF:
   assumes "e \<turnstile>\<^sub>R t : T"
   shows "\<exists>t'. t \<rightarrow>\<^sub>\<beta>\<^sup>* t' \<and> NF t'" using assms
 proof induct
   case Var
   show ?case by (iprover intro: Var_NF)
 next
   case Abs
   thus ?case by (iprover intro: rtrancl_beta_Abs NF.Abs)
 next
   case (App e s T U t)
   from App obtain s' t' where
     sred: "s \<rightarrow>\<^sub>\<beta>\<^sup>* s'" and "NF s'"
     and tred: "t \<rightarrow>\<^sub>\<beta>\<^sup>* t'" and tNF: "NF t'" by iprover
   have "\<exists>u. (Var 0 \<degree> lift t' 0)[s'/0] \<rightarrow>\<^sub>\<beta>\<^sup>* u \<and> NF u"
   proof (rule subst_type_NF)
     have "NF (lift t' 0)" using tNF by (rule lift_NF)
     hence "listall NF [lift t' 0]" by (rule listall_cons) (rule listall_nil)
     hence "NF (Var 0 \<degree>\<degree> [lift t' 0])" by (rule NF.App)
     thus "NF (Var 0 \<degree> lift t' 0)" by simp
     show "e\<langle>0:T \<Rightarrow> U\<rangle> \<turnstile> Var 0 \<degree> lift t' 0 : U"
     proof (rule typing.App)
       show "e\<langle>0:T \<Rightarrow> U\<rangle> \<turnstile> Var 0 : T \<Rightarrow> U"
         by (rule typing.Var) simp
       from tred have "e \<turnstile> t' : T"
         by (rule subject_reduction') (rule rtyping_imp_typing, rule App.hyps)
       thus "e\<langle>0:T \<Rightarrow> U\<rangle> \<turnstile> lift t' 0 : T"
         by (rule lift_type)
     qed
     from sred show "e \<turnstile> s' : T \<Rightarrow> U"
       by (rule subject_reduction') (rule rtyping_imp_typing, rule App.hyps)
     show "NF s'" by fact
   qed
   then obtain u where ured: "s' \<degree> t' \<rightarrow>\<^sub>\<beta>\<^sup>* u" and unf: "NF u" by simp iprover
   from sred tred have "s \<degree> t \<rightarrow>\<^sub>\<beta>\<^sup>* s' \<degree> t'" by (rule rtrancl_beta_App)
   hence "s \<degree> t \<rightarrow>\<^sub>\<beta>\<^sup>* u" using ured by (rule rtranclp_trans)
   with unf show ?case by iprover
 qed
 
 
 subsection \<open>Extracting the program\<close>
 
 declare NF.induct [ind_realizer]
 declare rtranclp.induct [ind_realizer irrelevant]
 declare rtyping.induct [ind_realizer]
 lemmas [extraction_expand] = conj_assoc listall_cons_eq subst_all equal_allI
 
 extract type_NF
 
 lemma rtranclR_rtrancl_eq: "rtranclpR r a b = r\<^sup>*\<^sup>* a b"
   apply (rule iffI)
   apply (erule rtranclpR.induct)
   apply (rule rtranclp.rtrancl_refl)
   apply (erule rtranclp.rtrancl_into_rtrancl)
   apply assumption
   apply (erule rtranclp.induct)
   apply (rule rtranclpR.rtrancl_refl)
   apply (erule rtranclpR.rtrancl_into_rtrancl)
   apply assumption
   done
 
 lemma NFR_imp_NF: "NFR nf t \<Longrightarrow> NF t"
   apply (erule NFR.induct)
   apply (rule NF.intros)
   apply (simp add: listall_def)
   apply (erule NF.intros)
   done
 
 text_raw \<open>
 \begin{figure}
 \renewcommand{\isastyle}{\scriptsize\it}%
 @{thm [display,eta_contract=false,margin=100] subst_type_NF_def}
 \renewcommand{\isastyle}{\small\it}%
 \caption{Program extracted from \<open>subst_type_NF\<close>}
 \label{fig:extr-subst-type-nf}
 \end{figure}
 
 \begin{figure}
 \renewcommand{\isastyle}{\scriptsize\it}%
 @{thm [display,margin=100] subst_Var_NF_def}
 @{thm [display,margin=100] app_Var_NF_def}
 @{thm [display,margin=100] lift_NF_def}
 @{thm [display,eta_contract=false,margin=100] type_NF_def}
 \renewcommand{\isastyle}{\small\it}%
 \caption{Program extracted from lemmas and main theorem}
 \label{fig:extr-type-nf}
 \end{figure}
 \<close>
 
 text \<open>
 The program corresponding to the proof of the central lemma, which
 performs substitution and normalization, is shown in Figure
 \ref{fig:extr-subst-type-nf}. The correctness
 theorem corresponding to the program \<open>subst_type_NF\<close> is
 @{thm [display,margin=100] subst_type_NF_correctness
   [simplified rtranclR_rtrancl_eq Collect_mem_eq, no_vars]}
 where \<open>NFR\<close> is the realizability predicate corresponding to
 the datatype \<open>NFT\<close>, which is inductively defined by the rules
 \pagebreak
 @{thm [display,margin=90] NFR.App [of ts nfs x] NFR.Abs [of nf t]}
 
 The programs corresponding to the main theorem \<open>type_NF\<close>, as
 well as to some lemmas, are shown in Figure \ref{fig:extr-type-nf}.
 The correctness statement for the main function \<open>type_NF\<close> is
 @{thm [display,margin=100] type_NF_correctness
   [simplified rtranclR_rtrancl_eq Collect_mem_eq, no_vars]}
 where the realizability predicate \<open>rtypingR\<close> corresponding to the
 computationally relevant version of the typing judgement is inductively
 defined by the rules
 @{thm [display,margin=100] rtypingR.Var [no_vars]
   rtypingR.Abs [of ty, no_vars] rtypingR.App [of ty e s T U ty' t]}
 \<close>
 
 subsection \<open>Generating executable code\<close>
 
 instantiation NFT :: default
 begin
 
 definition "default = Dummy ()"
 
 instance ..
 
 end
 
 instantiation dB :: default
 begin
 
 definition "default = dB.Var 0"
 
 instance ..
 
 end
 
 instantiation prod :: (default, default) default
 begin
 
 definition "default = (default, default)"
 
 instance ..
 
 end
 
 instantiation list :: (type) default
 begin
 
 definition "default = []"
 
 instance ..
 
 end
 
 instantiation "fun" :: (type, default) default
 begin
 
 definition "default = (\<lambda>x. default)"
 
 instance ..
 
 end
 
 definition int_of_nat :: "nat \<Rightarrow> int" where
   "int_of_nat = of_nat"
 
 text \<open>
   The following functions convert between Isabelle's built-in {\tt term}
   datatype and the generated {\tt dB} datatype. This allows to
   generate example terms using Isabelle's parser and inspect
   normalized terms using Isabelle's pretty printer.
 \<close>
 
 ML \<open>
 val nat_of_integer = @{code nat} o @{code int_of_integer};
 
 fun dBtype_of_typ (Type ("fun", [T, U])) =
       @{code Fun} (dBtype_of_typ T, dBtype_of_typ U)
   | dBtype_of_typ (TFree (s, _)) = (case raw_explode s of
         ["'", a] => @{code Atom} (nat_of_integer (ord a - 97))
       | _ => error "dBtype_of_typ: variable name")
   | dBtype_of_typ _ = error "dBtype_of_typ: bad type";
 
 fun dB_of_term (Bound i) = @{code dB.Var} (nat_of_integer i)
   | dB_of_term (t $ u) = @{code dB.App} (dB_of_term t, dB_of_term u)
   | dB_of_term (Abs (_, _, t)) = @{code dB.Abs} (dB_of_term t)
   | dB_of_term _ = error "dB_of_term: bad term";
 
 fun term_of_dB Ts (Type ("fun", [T, U])) (@{code dB.Abs} dBt) =
       Abs ("x", T, term_of_dB (T :: Ts) U dBt)
   | term_of_dB Ts _ dBt = term_of_dB' Ts dBt
 and term_of_dB' Ts (@{code dB.Var} n) = Bound (@{code integer_of_nat} n)
   | term_of_dB' Ts (@{code dB.App} (dBt, dBu)) =
       let val t = term_of_dB' Ts dBt
       in case fastype_of1 (Ts, t) of
           Type ("fun", [T, _]) => t $ term_of_dB Ts T dBu
         | _ => error "term_of_dB: function type expected"
       end
   | term_of_dB' _ _ = error "term_of_dB: term not in normal form";
 
 fun typing_of_term Ts e (Bound i) =
       @{code Var} (e, nat_of_integer i, dBtype_of_typ (nth Ts i))
   | typing_of_term Ts e (t $ u) = (case fastype_of1 (Ts, t) of
         Type ("fun", [T, U]) => @{code App} (e, dB_of_term t,
           dBtype_of_typ T, dBtype_of_typ U, dB_of_term u,
           typing_of_term Ts e t, typing_of_term Ts e u)
       | _ => error "typing_of_term: function type expected")
   | typing_of_term Ts e (Abs (_, T, t)) =
       let val dBT = dBtype_of_typ T
       in @{code Abs} (e, dBT, dB_of_term t,
         dBtype_of_typ (fastype_of1 (T :: Ts, t)),
         typing_of_term (T :: Ts) (@{code shift} e @{code "0::nat"} dBT) t)
       end
   | typing_of_term _ _ _ = error "typing_of_term: bad term";
 
 fun dummyf _ = error "dummy";
 
 val ct1 = @{cterm "%f. ((%f x. f (f (f x))) ((%f x. f (f (f (f x)))) f))"};
 val (dB1, _) = @{code type_NF} (typing_of_term [] dummyf (Thm.term_of ct1));
 val ct1' = Thm.cterm_of @{context} (term_of_dB [] (Thm.typ_of_cterm ct1) dB1);
 
 val ct2 = @{cterm "%f x. (%x. f x x) ((%x. f x x) ((%x. f x x) ((%x. f x x) ((%x. f x x) ((%x. f x x) x)))))"};
 val (dB2, _) = @{code type_NF} (typing_of_term [] dummyf (Thm.term_of ct2));
 val ct2' = Thm.cterm_of @{context} (term_of_dB [] (Thm.typ_of_cterm ct2) dB2);
 \<close>
 
 end
diff --git a/src/HOL/SPARK/Manual/Example_Verification.thy b/src/HOL/SPARK/Manual/Example_Verification.thy
--- a/src/HOL/SPARK/Manual/Example_Verification.thy
+++ b/src/HOL/SPARK/Manual/Example_Verification.thy
@@ -1,250 +1,250 @@
 (*<*)
 theory Example_Verification
 imports "HOL-SPARK-Examples.Greatest_Common_Divisor" Simple_Greatest_Common_Divisor
 begin
 (*>*)
 
 chapter \<open>Verifying an Example Program\<close>
 
 text \<open>
 \label{sec:example-verification}
 \begin{figure}
 \lstinputlisting{Gcd.ads}
 \lstinputlisting{Gcd.adb}
 \caption{\SPARK{} program for computing the greatest common divisor}
 \label{fig:gcd-prog}
 \end{figure}
 
 \begin{figure}
 \input{Greatest_Common_Divisor}
 \caption{Correctness proof for the greatest common divisor program}
 \label{fig:gcd-proof}
 \end{figure}
 We will now explain the usage of the \SPARK{} verification environment by proving
 the correctness of an example program. As an example, we use a program for computing
 the \emph{greatest common divisor} of two natural numbers shown in \figref{fig:gcd-prog},
-which has been taken from the book about \SPARK{} by Barnes @{cite \<open>\S 11.6\<close> Barnes}.
+which has been taken from the book about \SPARK{} by Barnes \<^cite>\<open>\<open>\S 11.6\<close> in Barnes\<close>.
 \<close>
 
 section \<open>Importing \SPARK{} VCs into Isabelle\<close>
 
 text \<open>
 In order to specify that the \SPARK{} procedure \texttt{G\_C\_D} behaves like its
 mathematical counterpart, Barnes introduces a \emph{proof function} \texttt{Gcd}
 in the package specification. Invoking the \SPARK{} Examiner and Simplifier on
 this program yields a file \texttt{g\_c\_d.siv} containing the simplified VCs,
 as well as files \texttt{g\_c\_d.fdl} and \texttt{g\_c\_d.rls}, containing FDL
 declarations and rules, respectively. The files generated by \SPARK{} are assumed to reside in the
 subdirectory \texttt{greatest\_common\_divisor}. For \texttt{G\_C\_D} the
 Examiner generates ten VCs, eight of which are proved automatically by
 the Simplifier. We now show how to prove the remaining two VCs
 interactively using HOL-\SPARK{}. For this purpose, we create a \emph{theory}
 \texttt{Greatest\_Common\_Divisor}, which is shown in \figref{fig:gcd-proof}.
 A theory file always starts with the keyword \isa{\isacommand{theory}} followed
 by the name of the theory, which must be the same as the file name. The theory
 name is followed by the keyword \isa{\isacommand{imports}} and a list of theories
 imported by the current theory. All theories using the HOL-\SPARK{} verification
 environment must import the theory \texttt{SPARK}. In addition, we also include
 the \texttt{GCD} theory. The list of imported theories is followed by the
 \isa{\isacommand{begin}} keyword. In order to interactively process the theory
 shown in \figref{fig:gcd-proof}, we start Isabelle with the command
 \begin{verbatim}
   isabelle jedit -l HOL-SPARK Greatest_Common_Divisor.thy
 \end{verbatim}
 The option ``\texttt{-l HOL-SPARK}'' instructs Isabelle to load the right
 object logic image containing the verification environment. Each proof function
 occurring in the specification of a \SPARK{} program must be linked with a
 corresponding Isabelle function. This is accomplished by the command
 \isa{\isacommand{spark\_proof\_functions}}, which expects a list of equations
 of the form \emph{name}\texttt{\ =\ }\emph{term}, where \emph{name} is the
 name of the proof function and \emph{term} is the corresponding Isabelle term.
 In the case of \texttt{gcd}, both the \SPARK{} proof function and its Isabelle
 counterpart happen to have the same name. Isabelle checks that the type of the
 term linked with a proof function agrees with the type of the function declared
 in the \texttt{*.fdl} file.
 It is worth noting that the
 \isa{\isacommand{spark\_proof\_functions}} command can be invoked both outside,
 i.e.\ before \isa{\isacommand{spark\_open}}, and inside the environment, i.e.\ after
 \isa{\isacommand{spark\_open}}, but before any \isa{\isacommand{spark\_vc}} command. The
 former variant is useful when having to declare proof functions that are shared by several
 procedures, whereas the latter has the advantage that the type of the proof function
 can be checked immediately, since the VCs, and hence also the declarations of proof
 functions in the \texttt{*.fdl} file have already been loaded.
 \begin{figure}
 \begin{flushleft}
 \tt
 Context: \\
 \ \\
 \begin{tabular}{ll}
 fixes & \<open>m ::\<close>\ "\<open>int\<close>" \\
 and   & \<open>n ::\<close>\ "\<open>int\<close>" \\
 and   & \<open>c ::\<close>\ "\<open>int\<close>" \\
 and   & \<open>d ::\<close>\ "\<open>int\<close>" \\
 assumes & \<open>g_c_d_rules1:\<close>\ "\<open>0 \<le> integer__size\<close>" \\
 and     & \<open>g_c_d_rules6:\<close>\ "\<open>0 \<le> natural__size\<close>" \\
 \multicolumn{2}{l}{notes definition} \\
 \multicolumn{2}{l}{\hspace{2ex}\<open>defns =\<close>\ `\<open>integer__first = - 2147483648\<close>`} \\
 \multicolumn{2}{l}{\hspace{4ex}`\<open>integer__last = 2147483647\<close>`} \\
 \multicolumn{2}{l}{\hspace{4ex}\dots}
 \end{tabular}\ \\[1.5ex]
 \ \\
 Definitions: \\
 \ \\
 \begin{tabular}{ll}
 \<open>g_c_d_rules2:\<close> & \<open>integer__first = - 2147483648\<close> \\
 \<open>g_c_d_rules3:\<close> & \<open>integer__last = 2147483647\<close> \\
 \dots
 \end{tabular}\ \\[1.5ex]
 \ \\
 Verification conditions: \\
 \ \\
 path(s) from assertion of line 10 to assertion of line 10 \\
 \ \\
 \<open>procedure_g_c_d_4\<close>\ (unproved) \\
 \ \ \begin{tabular}{ll}
 assumes & \<open>H1:\<close>\ "\<open>0 \<le> c\<close>" \\
 and     & \<open>H2:\<close>\ "\<open>0 < d\<close>" \\
 and     & \<open>H3:\<close>\ "\<open>gcd c d = gcd m n\<close>" \\
 \dots \\
 shows & "\<open>0 < c - c sdiv d * d\<close>" \\
 and   & "\<open>gcd d (c - c sdiv d * d) = gcd m n\<close>
 \end{tabular}\ \\[1.5ex]
 \ \\
 path(s) from assertion of line 10 to finish \\
 \ \\
 \<open>procedure_g_c_d_11\<close>\ (unproved) \\
 \ \ \begin{tabular}{ll}
 assumes & \<open>H1:\<close>\ "\<open>0 \<le> c\<close>" \\
 and     & \<open>H2:\<close>\ "\<open>0 < d\<close>" \\
 and     & \<open>H3:\<close>\ "\<open>gcd c d = gcd m n\<close>" \\
 \dots \\
 shows & "\<open>d = gcd m n\<close>"
 \end{tabular}
 \end{flushleft}
 \caption{Output of \isa{\isacommand{spark\_status}} for \texttt{g\_c\_d.siv}}
 \label{fig:gcd-status}
 \end{figure}
 We now instruct Isabelle to open
 a new verification environment and load a set of VCs. This is done using the
 command \isa{\isacommand{spark\_open}}, which must be given the name of a
 \texttt{*.siv} file as an argument. Behind the scenes, Isabelle
 parses this file and the corresponding \texttt{*.fdl} and \texttt{*.rls} files,
 and converts the VCs to Isabelle terms. Using the command \isa{\isacommand{spark\_status}},
 the user can display the current VCs together with their status (proved, unproved).
 The variants \isa{\isacommand{spark\_status}\ (proved)}
 and \isa{\isacommand{spark\_status}\ (unproved)} show only proved and unproved
 VCs, respectively. For \texttt{g\_c\_d.siv}, the output of
 \isa{\isacommand{spark\_status}} is shown in \figref{fig:gcd-status}.
 To minimize the number of assumptions, and hence the size of the VCs,
 FDL rules of the form ``\dots\ \texttt{may\_be\_replaced\_by}\ \dots'' are
 turned into native Isabelle definitions, whereas other rules are modelled
 as assumptions.
 \<close>
 
 section \<open>Proving the VCs\<close>
 
 text \<open>
 \label{sec:proving-vcs}
 The two open VCs are \<open>procedure_g_c_d_4\<close> and \<open>procedure_g_c_d_11\<close>,
 both of which contain the \<open>gcd\<close> proof function that the \SPARK{} Simplifier
 does not know anything about. The proof of a particular VC can be started with
 the \isa{\isacommand{spark\_vc}} command, which is similar to the standard
 \isa{\isacommand{lemma}} and \isa{\isacommand{theorem}} commands, with the
 difference that it only takes a name of a VC but no formula as an argument.
 A VC can have several conclusions that can be referenced by the identifiers
 \<open>?C1\<close>, \<open>?C2\<close>, etc. If there is just one conclusion, it can
 also be referenced by \<open>?thesis\<close>. It is important to note that the
 \texttt{div} operator of FDL behaves differently from the \<open>div\<close> operator
 of Isabelle/HOL on negative numbers. The former always truncates towards zero,
 whereas the latter truncates towards minus infinity. This is why the FDL
 \texttt{div} operator is mapped to the \<open>sdiv\<close> operator in Isabelle/HOL,
 which is defined as
 @{thm [display] sdiv_def}
 For example, we have that
 @{lemma "-5 sdiv 4 = -1" by (simp add: sdiv_neg_pos)}, but
 @{lemma "(-5::int) div 4 = -2" by simp}.
 For non-negative dividend and divisor, \<open>sdiv\<close> is equivalent to \<open>div\<close>,
 as witnessed by theorem \<open>sdiv_pos_pos\<close>:
 @{thm [display,mode=no_brackets] sdiv_pos_pos}
 In contrast, the behaviour of the FDL \texttt{mod} operator is equivalent to
 the one of Isabelle/HOL. Moreover, since FDL has no counterpart of the \SPARK{}
 operator \textbf{rem}, the \SPARK{} expression \texttt{c}\ \textbf{rem}\ \texttt{d}
 just becomes \<open>c - c sdiv d * d\<close> in Isabelle. The first conclusion of
 \<open>procedure_g_c_d_4\<close> requires us to prove that the remainder of \<open>c\<close>
 and \<open>d\<close> is greater than \<open>0\<close>. To do this, we use the theorem
 \<open>minus_div_mult_eq_mod [symmetric]\<close> describing the correspondence between \<open>div\<close>
 and \<open>mod\<close>
 @{thm [display] minus_div_mult_eq_mod [symmetric]}
 together with the theorem \<open>pos_mod_sign\<close> saying that the result of the
 \<open>mod\<close> operator is non-negative when applied to a non-negative divisor:
 @{thm [display] pos_mod_sign}
 We will also need the aforementioned theorem \<open>sdiv_pos_pos\<close> in order for
 the standard Isabelle/HOL theorems about \<open>div\<close> to be applicable
 to the VC, which is formulated using \<open>sdiv\<close> rather that \<open>div\<close>.
 Note that the proof uses \texttt{`\<open>0 \<le> c\<close>`} and \texttt{`\<open>0 < d\<close>`}
 rather than \<open>H1\<close> and \<open>H2\<close> to refer to the hypotheses of the current
 VC. While the latter variant seems more compact, it is not particularly robust,
 since the numbering of hypotheses can easily change if the corresponding
 program is modified, making the proof script hard to adjust when there are many hypotheses.
 Moreover, proof scripts using abbreviations like \<open>H1\<close> and \<open>H2\<close>
 are hard to read without assistance from Isabelle.
 The second conclusion of \<open>procedure_g_c_d_4\<close> requires us to prove that
 the \<open>gcd\<close> of \<open>d\<close> and the remainder of \<open>c\<close> and \<open>d\<close>
 is equal to the \<open>gcd\<close> of the original input values \<open>m\<close> and \<open>n\<close>,
 which is the actual \emph{invariant} of the procedure. This is a consequence
 of theorem \<open>gcd_non_0_int\<close>
 @{thm [display] gcd_non_0_int}
 Again, we also need theorems \<open>minus_div_mult_eq_mod [symmetric]\<close> and \<open>sdiv_pos_pos\<close>
 to justify that \SPARK{}'s \textbf{rem} operator is equivalent to Isabelle's
 \<open>mod\<close> operator for non-negative operands.
 The VC \<open>procedure_g_c_d_11\<close> says that if the loop invariant holds before
 the last iteration of the loop, the postcondition of the procedure will hold
 after execution of the loop body. To prove this, we observe that the remainder
 of \<open>c\<close> and \<open>d\<close>, and hence \<open>c mod d\<close> is \<open>0\<close> when exiting
 the loop. This implies that \<open>gcd c d = d\<close>, since \<open>c\<close> is divisible
 by \<open>d\<close>, so the conclusion follows using the assumption \<open>gcd c d = gcd m n\<close>.
 This concludes the proofs of the open VCs, and hence the \SPARK{} verification
 environment can be closed using the command \isa{\isacommand{spark\_end}}.
 This command checks that all VCs have been proved and issues an error message
 if there are remaining unproved VCs. Moreover, Isabelle checks that there is
 no open \SPARK{} verification environment when the final \isa{\isacommand{end}}
 command of a theory is encountered.
 \<close>
 
 section \<open>Optimizing the proof\<close>
 
 text \<open>
 \begin{figure}
 \lstinputlisting{Simple_Gcd.adb}
 \input{Simple_Greatest_Common_Divisor}
 \caption{Simplified greatest common divisor program and proof}
 \label{fig:simple-gcd-proof}
 \end{figure}
 When looking at the program from \figref{fig:gcd-prog} once again, several
 optimizations come to mind. First of all, like the input parameters of the
 procedure, the local variables \texttt{C}, \texttt{D}, and \texttt{R} can
 be declared as \texttt{Natural} rather than \texttt{Integer}. Since natural
 numbers are non-negative by construction, the values computed by the algorithm
 are trivially proved to be non-negative. Since we are working with non-negative
 numbers, we can also just use \SPARK{}'s \textbf{mod} operator instead of
 \textbf{rem}, which spares us an application of theorems \<open>minus_div_mult_eq_mod [symmetric]\<close>
-and \<open>sdiv_pos_pos\<close>. Finally, as noted by Barnes @{cite \<open>\S 11.5\<close> Barnes},
+and \<open>sdiv_pos_pos\<close>. Finally, as noted by Barnes \<^cite>\<open>\<open>\S 11.5\<close> in Barnes\<close>,
 we can simplify matters by placing the \textbf{assert} statement between
 \textbf{while} and \textbf{loop} rather than directly after the \textbf{loop}.
 In the former case, the loop invariant has to be proved only once, whereas in
 the latter case, it has to be proved twice: since the \textbf{assert} occurs after
 the check of the exit condition, the invariant has to be proved for the path
 from the \textbf{assert} statement to the \textbf{assert} statement, and for
 the path from the \textbf{assert} statement to the postcondition. In the case
 of the \texttt{G\_C\_D} procedure, this might not seem particularly problematic,
 since the proof of the invariant is very simple, but it can unnecessarily
 complicate matters if the proof of the invariant is non-trivial. The simplified
 program for computing the greatest common divisor, together with its correctness
 proof, is shown in \figref{fig:simple-gcd-proof}. Since the package specification
 has not changed, we only show the body of the packages. The two VCs can now be
 proved by a single application of Isabelle's proof method \<open>simp\<close>.
 \<close>
 
 (*<*)
 end
 (*>*)
diff --git a/src/HOL/SPARK/Manual/VC_Principles.thy b/src/HOL/SPARK/Manual/VC_Principles.thy
--- a/src/HOL/SPARK/Manual/VC_Principles.thy
+++ b/src/HOL/SPARK/Manual/VC_Principles.thy
@@ -1,152 +1,152 @@
 (*<*)
 theory VC_Principles
 imports Proc1 Proc2
 begin
 (*>*)
 
 chapter \<open>Principles of VC generation\<close>
 
 text \<open>
 \label{sec:vc-principles}
 In this section, we will discuss some aspects of VC generation that are
 useful for understanding and optimizing the VCs produced by the \SPARK{}
 Examiner.
 
 \begin{figure}
 \lstinputlisting{loop_invariant.ads}
 \lstinputlisting{loop_invariant.adb}
 \caption{Assertions in for-loops}
 \label{fig:loop-invariant-ex}
 \end{figure}
 \begin{figure}
 \begin{tikzpicture}
 \tikzstyle{box}=[draw, drop shadow, fill=white, rounded corners]
 \node[box] (pre) at (0,0) {precondition};
 \node[box] (assn) at (0,-3) {assertion};
 \node[box] (post) at (0,-6) {postcondition};
 \draw[-latex] (pre) -- node [right] {\small$(1 - 1) * b \mod 2^{32} = 0$} (assn);
 \draw[-latex] (assn) .. controls (2.5,-4.5) and (2.5,-1.5) .. %
 node [right] {\small$\begin{array}{l} %
 (i - 1) * b \mod 2^{32} = c ~\longrightarrow \\ %
 (i + 1 - 1) * b \mod 2^{32} ~= \\ %
 (c + b) \mod 2^{32} %
 \end{array}$} (assn);
 \draw[-latex] (assn) -- node [right] {\small$\begin{array}{l} %
 (a - 1) * b \mod 2^{32} = c ~\longrightarrow \\ %
 a * b \mod 2^{32} = (c + b) \mod 2^{32} %
 \end{array}$} (post);
 \draw[-latex] (pre) .. controls (-2,-3) .. %
 node [left] {\small$\begin{array}{l} %
 \neg 1 \le a ~\longrightarrow \\ %
 a * b \mod 2^{32} = 0 %
 \end{array}$} (post);
 \end{tikzpicture}
 \caption{Control flow graph for procedure \texttt{Proc1}}
 \label{fig:proc1-graph}
 \end{figure}
 \begin{figure}
 \begin{tikzpicture}
 \tikzstyle{box}=[draw, drop shadow, fill=white, rounded corners]
 \node[box] (pre) at (0,0) {precondition};
 \node[box] (assn1) at (2,-3) {assertion 1};
 \node[box] (assn2) at (2,-6) {assertion 2};
 \node[box] (post) at (0,-9) {postcondition};
 \draw[-latex] (pre) -- node [right] {\small$(1 - 1) * b \mod 2^{32} = 0$} (assn1);
 \draw[-latex] (assn1) -- node [left] {\small$\begin{array}{l} %
 (i - 1) * b \mod 2^{32} = c \\ %
 \longrightarrow \\ %
 i * b \mod 2^{32} = \\ %
 (c + b) \mod 2^{32} %
 \end{array}$} (assn2);
 \draw[-latex] (assn2) .. controls (4.5,-7.5) and (4.5,-1.5) .. %
 node [right] {\small$\begin{array}{l} %
 i * b \mod 2^{32} = c ~\longrightarrow \\ %
 (i + 1 - 1) * b \mod 2^{32} = c %
 \end{array}$} (assn1);
 \draw[-latex] (assn2) -- node [right] {\small$\begin{array}{l} %
 a * b \mod 2^{32} = c ~\longrightarrow \\ %
 a * b \mod 2^{32} = c %
 \end{array}$} (post);
 \draw[-latex] (pre) .. controls (-3,-3) and (-3,-6) .. %
 node [left,very near start] {\small$\begin{array}{l} %
 \neg 1 \le a ~\longrightarrow \\ %
 a * b \mod 2^{32} = 0 %
 \end{array}$} (post);
 \end{tikzpicture}
 \caption{Control flow graph for procedure \texttt{Proc2}}
 \label{fig:proc2-graph}
 \end{figure}
-As explained by Barnes @{cite \<open>\S 11.5\<close> Barnes}, the \SPARK{} Examiner unfolds the loop
+As explained by Barnes \<^cite>\<open>\<open>\S 11.5\<close> in Barnes\<close>, the \SPARK{} Examiner unfolds the loop
 \begin{lstlisting}
 for I in T range L .. U loop
   --# assert P (I);
   S;
 end loop;
 \end{lstlisting}
 to
 \begin{lstlisting}
 if L <= U then
   I := L;
   loop
     --# assert P (I);
     S;
     exit when I = U;
     I := I + 1;
   end loop;
 end if;
 \end{lstlisting}
 Due to this treatment of for-loops, the user essentially has to prove twice that
 \texttt{S} preserves the invariant \textit{\texttt{P}}, namely for
 the path from the assertion to the assertion and from the assertion to the next cut
 point following the loop. The preservation of the invariant has to be proved even
 more often when the loop is followed by an if-statement. For trivial invariants,
 this might not seem like a big problem, but in realistic applications, where invariants
 are complex, this can be a major inconvenience. Often, the proofs of the invariant differ
 only in a few variables, so it is tempting to just copy and modify existing proof scripts,
 but this leads to proofs that are hard to maintain.
 The problem of having to prove the invariant several times can be avoided by rephrasing
 the above for-loop to
 \begin{lstlisting}
 for I in T range L .. U loop
   --# assert P (I);
   S;
   --# assert P (I + 1)
 end loop;
 \end{lstlisting}
 The VC for the path from the second assertion to the first assertion is trivial and can
 usually be proved automatically by the \SPARK{} Simplifier, whereas the VC for the path
 from the first assertion to the second assertion actually expresses the fact that
 \texttt{S} preserves the invariant.
 
 We illustrate this technique using the example package shown in \figref{fig:loop-invariant-ex}.
 It contains two procedures \texttt{Proc1} and \texttt{Proc2}, both of which implement
 multiplication via addition. The procedures have the same specification, but in \texttt{Proc1},
 only one \textbf{assert} statement is placed at the beginning of the loop, whereas \texttt{Proc2}
 employs the trick explained above.
 After applying the \SPARK{} Simplifier to the VCs generated for \texttt{Proc1}, two very
 similar VCs
 @{thm [display] (concl) procedure_proc1_5 [simplified pow_2_32_simp]}
 and
 @{thm [display,margin=60] (concl) procedure_proc1_8 [simplified pow_2_32_simp]}
 remain, whereas for \texttt{Proc2}, only the first of the above VCs remains.
 Why placing \textbf{assert} statements both at the beginning and at the end of the loop body
 simplifies the proof of the invariant should become obvious when looking at \figref{fig:proc1-graph}
 and \figref{fig:proc2-graph} showing the \emph{control flow graphs} for \texttt{Proc1} and
 \texttt{Proc2}, respectively. The nodes in the graph correspond to cut points in the program,
 and the paths between the cut points are annotated with the corresponding VCs. To reduce the
 size of the graphs, we do not show nodes and edges corresponding to runtime checks.
 The VCs for the path bypassing the loop and for the path from the precondition to the
 (first) assertion are the same for both procedures. The graph for \texttt{Proc1} contains
 two VCs expressing that the invariant is preserved by the execution of the loop body: one
 for the path from the assertion to the assertion, and another one for the path from the
 assertion to the conclusion, which corresponds to the last iteration of the loop. The latter
 VC can be obtained from the former by simply replacing $i$ by $a$. In contrast, the graph
 for \texttt{Proc2} contains only one such VC for the path from assertion 1 to assertion 2.
 The VC for the path from assertion 2 to assertion 1 is trivial, and so is the VC for the
 path from assertion 2 to the postcondition, expressing that the loop invariant implies
 the postcondition when the loop has terminated.
 \<close>
 
 (*<*)
 end
 (*>*)
diff --git a/src/HOL/Unix/Unix.thy b/src/HOL/Unix/Unix.thy
--- a/src/HOL/Unix/Unix.thy
+++ b/src/HOL/Unix/Unix.thy
@@ -1,1047 +1,1044 @@
 (*  Title:      HOL/Unix/Unix.thy
     Author:     Markus Wenzel, TU Muenchen
 *)
 
 section \<open>Unix file-systems \label{sec:unix-file-system}\<close>
 
 theory Unix
   imports
     Nested_Environment
     "HOL-Library.Sublist"
 begin
 
 text \<open>
   We give a simple mathematical model of the basic structures underlying the
   Unix file-system, together with a few fundamental operations that could be
   imagined to be performed internally by the Unix kernel. This forms the basis
   for the set of Unix system-calls to be introduced later (see
   \secref{sec:unix-trans}), which are the actual interface offered to
   processes running in user-space.
 
   \<^medskip>
   Basically, any Unix file is either a \<^emph>\<open>plain file\<close> or a \<^emph>\<open>directory\<close>,
   consisting of some \<^emph>\<open>content\<close> plus \<^emph>\<open>attributes\<close>. The content of a plain
   file is plain text. The content of a directory is a mapping from names to
   further files.\<^footnote>\<open>In fact, this is the only way that names get associated with
   files. In Unix files do \<^emph>\<open>not\<close> have a name in itself. Even more, any number
   of names may be associated with the very same file due to \<^emph>\<open>hard links\<close>
   (although this is excluded from our model).\<close> Attributes include information
   to control various ways to access the file (read, write etc.).
 
   Our model will be quite liberal in omitting excessive detail that is easily
   seen to be ``irrelevant'' for the aspects of Unix file-systems to be
   discussed here. First of all, we ignore character and block special files,
   pipes, sockets, hard links, symbolic links, and mount points.
 \<close>
 
 
 subsection \<open>Names\<close>
 
 text \<open>
   User ids and file name components shall be represented by natural numbers
   (without loss of generality). We do not bother about encoding of actual
   names (e.g.\ strings), nor a mapping between user names and user ids as
   would be present in a reality.
 \<close>
 
 type_synonym uid = nat
 type_synonym name = nat
 type_synonym path = "name list"
 
 
 subsection \<open>Attributes\<close>
 
 text \<open>
   Unix file attributes mainly consist of \<^emph>\<open>owner\<close> information and a number of
   \<^emph>\<open>permission\<close> bits which control access for ``user'', ``group'', and
   ``others'' (see the Unix man pages \<open>chmod(2)\<close> and \<open>stat(2)\<close> for more
   details).
 
   \<^medskip>
   Our model of file permissions only considers the ``others'' part. The
   ``user'' field may be omitted without loss of overall generality, since the
   owner is usually able to change it anyway by performing \<open>chmod\<close>.\<^footnote>\<open>The
   inclined Unix expert may try to figure out some exotic arrangements of a
   real-world Unix file-system such that the owner of a file is unable to apply
   the \<open>chmod\<close> system call.\<close> We omit ``group'' permissions as a genuine
   simplification as we just do not intend to discuss a model of multiple
   groups and group membership, but pretend that everyone is member of a single
   global group.\<^footnote>\<open>A general HOL model of user group structures and related
-  issues is given in @{cite "Naraschewski:2001"}.\<close>
+  issues is given in \<^cite>\<open>"Naraschewski:2001"\<close>.\<close>
 \<close>
 
 datatype perm =
     Readable
   | Writable
   | Executable    \<comment> \<open>(ignored)\<close>
 
 type_synonym perms = "perm set"
 
 record att =
   owner :: uid
   others :: perms
 
 text \<open>
   For plain files \<^term>\<open>Readable\<close> and \<^term>\<open>Writable\<close> specify read and write
   access to the actual content, i.e.\ the string of text stored here. For
   directories \<^term>\<open>Readable\<close> determines if the set of entry names may be
   accessed, and \<^term>\<open>Writable\<close> controls the ability to create or delete any
   entries (both plain files or sub-directories).
 
   As another simplification, we ignore the \<^term>\<open>Executable\<close> permission
   altogether. In reality it would indicate executable plain files (also known
   as ``binaries''), or control actual lookup of directory entries (recall that
   mere directory browsing is controlled via \<^term>\<open>Readable\<close>). Note that the
   latter means that in order to perform any file-system operation whatsoever,
   all directories encountered on the path would have to grant
   \<^term>\<open>Executable\<close>. We ignore this detail and pretend that all directories
   give \<^term>\<open>Executable\<close> permission to anybody.
 \<close>
 
 
 subsection \<open>Files\<close>
 
 text \<open>
   In order to model the general tree structure of a Unix file-system we use
   the arbitrarily branching datatype \<^typ>\<open>('a, 'b, 'c) env\<close> from the
-  standard library of Isabelle/HOL @{cite "Bauer-et-al:2002:HOL-Library"}.
+  standard library of Isabelle/HOL \<^cite>\<open>"Bauer-et-al:2002:HOL-Library"\<close>.
   This type provides constructors \<^term>\<open>Val\<close> and \<^term>\<open>Env\<close> as follows:
 
   \<^medskip>
   {\def\isastyleminor{\isastyle}
   \begin{tabular}{l}
   @{term [source] "Val :: 'a \<Rightarrow> ('a, 'b, 'c) env"} \\
   @{term [source] "Env :: 'b \<Rightarrow> ('c \<Rightarrow> ('a, 'b, 'c) env option) \<Rightarrow> ('a, 'b, 'c) env"} \\
   \end{tabular}}
   \<^medskip>
 
   Here the parameter \<^typ>\<open>'a\<close> refers to plain values occurring at leaf
   positions, parameter \<^typ>\<open>'b\<close> to information kept with inner branch
   nodes, and parameter \<^typ>\<open>'c\<close> to the branching type of the tree
   structure. For our purpose we use the type instance with \<^typ>\<open>att \<times>
   string\<close> (representing plain files), \<^typ>\<open>att\<close> (for attributes of
   directory nodes), and \<^typ>\<open>name\<close> (for the index type of directory nodes).
 \<close>
 
 type_synonym "file" = "(att \<times> string, att, name) env"
 
 text \<open>
   \<^medskip>
   The HOL library also provides \<^term>\<open>lookup\<close> and \<^term>\<open>update\<close> operations
   for general tree structures with the subsequent primitive recursive
   characterizations.
 
   \<^medskip>
   {\def\isastyleminor{\isastyle}
   \begin{tabular}{l}
   @{term [source] "lookup :: ('a, 'b, 'c) env \<Rightarrow> 'c list \<Rightarrow> ('a, 'b, 'c) env option"} \\
   @{term [source]
   "update :: 'c list \<Rightarrow> ('a, 'b, 'c) env option \<Rightarrow> ('a, 'b, 'c) env \<Rightarrow> ('a, 'b, 'c) env"} \\
   \end{tabular}}
 
   @{thm [display, indent = 2, eta_contract = false] lookup_eq [no_vars]}
   @{thm [display, indent = 2, eta_contract = false] update_eq [no_vars]}
 
-  Several further properties of these operations are proven in @{cite
-  "Bauer-et-al:2002:HOL-Library"}. These will be routinely used later on
+  Several further properties of these operations are proven in \<^cite>\<open>"Bauer-et-al:2002:HOL-Library"\<close>. These will be routinely used later on
   without further notice.
 
   \<^bigskip>
   Apparently, the elements of type \<^typ>\<open>file\<close> contain an \<^typ>\<open>att\<close>
   component in either case. We now define a few auxiliary operations to
   manipulate this field uniformly, following the conventions for record types
-  in Isabelle/HOL @{cite "Nipkow-et-al:2000:HOL"}.
+  in Isabelle/HOL \<^cite>\<open>"Nipkow-et-al:2000:HOL"\<close>.
 \<close>
 
 definition
   "attributes file =
     (case file of
       Val (att, text) \<Rightarrow> att
     | Env att dir \<Rightarrow> att)"
 
 definition
   "map_attributes f file =
     (case file of
       Val (att, text) \<Rightarrow> Val (f att, text)
     | Env att dir \<Rightarrow> Env (f att) dir)"
 
 lemma [simp]: "attributes (Val (att, text)) = att"
   by (simp add: attributes_def)
 
 lemma [simp]: "attributes (Env att dir) = att"
   by (simp add: attributes_def)
 
 lemma [simp]: "attributes (map_attributes f file) = f (attributes file)"
   by (cases "file") (simp_all add: attributes_def map_attributes_def
     split_tupled_all)
 
 lemma [simp]: "map_attributes f (Val (att, text)) = Val (f att, text)"
   by (simp add: map_attributes_def)
 
 lemma [simp]: "map_attributes f (Env att dir) = Env (f att) dir"
   by (simp add: map_attributes_def)
 
 
 subsection \<open>Initial file-systems\<close>
 
 text \<open>
   Given a set of \<^emph>\<open>known users\<close> a file-system shall be initialized by
   providing an empty home directory for each user, with read-only access for
   everyone else. (Note that we may directly use the user id as home directory
   name, since both types have been identified.) Certainly, the very root
   directory is owned by the super user (who has user id 0).
 \<close>
 
 definition
   "init users =
     Env \<lparr>owner = 0, others = {Readable}\<rparr>
       (\<lambda>u. if u \<in> users then Some (Env \<lparr>owner = u, others = {Readable}\<rparr> Map.empty)
         else None)"
 
 
 subsection \<open>Accessing file-systems\<close>
 
 text \<open>
   The main internal file-system operation is access of a file by a user,
   requesting a certain set of permissions. The resulting \<^typ>\<open>file option\<close>
   indicates if a file had been present at the corresponding \<^typ>\<open>path\<close> and if
   access was granted according to the permissions recorded within the
   file-system.
 
-  Note that by the rules of Unix file-system security (e.g.\ @{cite
-  "Tanenbaum:1992"}) both the super-user and owner may always access a file
+  Note that by the rules of Unix file-system security (e.g.\ \<^cite>\<open>"Tanenbaum:1992"\<close>) both the super-user and owner may always access a file
   unconditionally (in our simplified model).
 \<close>
 
 definition
   "access root path uid perms =
     (case lookup root path of
       None \<Rightarrow> None
     | Some file \<Rightarrow>
         if uid = 0
           \<or> uid = owner (attributes file)
           \<or> perms \<subseteq> others (attributes file)
         then Some file
         else None)"
 
 text \<open>
   \<^medskip>
   Successful access to a certain file is the main prerequisite for
   system-calls to be applicable (cf.\ \secref{sec:unix-trans}). Any
   modification of the file-system is then performed using the basic
   \<^term>\<open>update\<close> operation.
 
   \<^medskip>
   We see that \<^term>\<open>access\<close> is just a wrapper for the basic \<^term>\<open>lookup\<close>
   function, with additional checking of attributes. Subsequently we establish
   a few auxiliary facts that stem from the primitive \<^term>\<open>lookup\<close> used
   within \<^term>\<open>access\<close>.
 \<close>
 
 lemma access_empty_lookup: "access root path uid {} = lookup root path"
   by (simp add: access_def split: option.splits)
 
 lemma access_some_lookup:
   "access root path uid perms = Some file \<Longrightarrow>
     lookup root path = Some file"
   by (simp add: access_def split: option.splits if_splits)
 
 lemma access_update_other:
   assumes parallel: "path' \<parallel> path"
   shows "access (update path' opt root) path uid perms = access root path uid perms"
 proof -
   from parallel obtain y z xs ys zs where
       "y \<noteq> z" and "path' = xs @ y # ys" and "path = xs @ z # zs"
     by (blast dest: parallel_decomp)
   then have "lookup (update path' opt root) path = lookup root path"
     by (blast intro: lookup_update_other)
   then show ?thesis by (simp only: access_def)
 qed
 
 
 section \<open>File-system transitions \label{sec:unix-trans}\<close>
 
 subsection \<open>Unix system calls \label{sec:unix-syscall}\<close>
 
 text \<open>
-  According to established operating system design (cf.\ @{cite
-  "Tanenbaum:1992"}) user space processes may only initiate system operations
+  According to established operating system design (cf.\ \<^cite>\<open>"Tanenbaum:1992"\<close>) user space processes may only initiate system operations
   by a fixed set of \<^emph>\<open>system-calls\<close>. This enables the kernel to enforce
   certain security policies in the first place.\<^footnote>\<open>Incidently, this is the very
   same principle employed by any ``LCF-style'' theorem proving system
   according to Milner's principle of ``correctness by construction'', such as
   Isabelle/HOL itself.\<close>
 
   \<^medskip>
   In our model of Unix we give a fixed datatype \<open>operation\<close> for the syntax of
   system-calls, together with an inductive definition of file-system state
   transitions of the form \<open>root \<midarrow>x\<rightarrow> root'\<close> for the operational semantics.
 \<close>
 
 datatype operation =
     Read uid string path
   | Write uid string path
   | Chmod uid perms path
   | Creat uid perms path
   | Unlink uid path
   | Mkdir uid perms path
   | Rmdir uid path
   | Readdir uid "name set" path
 
 text \<open>
   The \<^typ>\<open>uid\<close> field of an operation corresponds to the \<^emph>\<open>effective user id\<close>
   of the underlying process, although our model never mentions processes
   explicitly. The other parameters are provided as arguments by the caller;
   the \<^term>\<open>path\<close> one is common to all kinds of system-calls.
 \<close>
 
 primrec uid_of :: "operation \<Rightarrow> uid"
   where
     "uid_of (Read uid text path) = uid"
   | "uid_of (Write uid text path) = uid"
   | "uid_of (Chmod uid perms path) = uid"
   | "uid_of (Creat uid perms path) = uid"
   | "uid_of (Unlink uid path) = uid"
   | "uid_of (Mkdir uid path perms) = uid"
   | "uid_of (Rmdir uid path) = uid"
   | "uid_of (Readdir uid names path) = uid"
 
 primrec path_of :: "operation \<Rightarrow> path"
   where
     "path_of (Read uid text path) = path"
   | "path_of (Write uid text path) = path"
   | "path_of (Chmod uid perms path) = path"
   | "path_of (Creat uid perms path) = path"
   | "path_of (Unlink uid path) = path"
   | "path_of (Mkdir uid perms path) = path"
   | "path_of (Rmdir uid path) = path"
   | "path_of (Readdir uid names path) = path"
 
 text \<open>
   \<^medskip>
   Note that we have omitted explicit \<open>Open\<close> and \<open>Close\<close> operations, pretending
   that \<^term>\<open>Read\<close> and \<^term>\<open>Write\<close> would already take care of this behind
   the scenes. Thus we have basically treated actual sequences of real
   system-calls \<open>open\<close>--\<open>read\<close>/\<open>write\<close>--\<open>close\<close> as atomic.
 
   In principle, this could make big a difference in a model with explicit
   concurrent processes. On the other hand, even on a real Unix system the
   exact scheduling of concurrent \<open>open\<close> and \<open>close\<close> operations does \<^emph>\<open>not\<close>
   directly affect the success of corresponding \<open>read\<close> or \<open>write\<close>. Unix allows
   several processes to have files opened at the same time, even for writing!
   Certainly, the result from reading the contents later may be hard to
   predict, but the system-calls involved here will succeed in any case.
 
   \<^bigskip>
   The operational semantics of system calls is now specified via transitions
   of the file-system configuration. This is expressed as an inductive relation
   (although there is no actual recursion involved here).
 \<close>
 
 inductive transition :: "file \<Rightarrow> operation \<Rightarrow> file \<Rightarrow> bool"
   ("_ \<midarrow>_\<rightarrow> _" [90, 1000, 90] 100)
   where
     read:
       "root \<midarrow>(Read uid text path)\<rightarrow> root"
       if "access root path uid {Readable} = Some (Val (att, text))"
   | "write":
       "root \<midarrow>(Write uid text path)\<rightarrow> update path (Some (Val (att, text))) root"
       if "access root path uid {Writable} = Some (Val (att, text'))"
   | chmod:
       "root \<midarrow>(Chmod uid perms path)\<rightarrow>
         update path (Some (map_attributes (others_update (\<lambda>_. perms)) file)) root"
       if "access root path uid {} = Some file" and "uid = 0 \<or> uid = owner (attributes file)"
   | creat:
       "root \<midarrow>(Creat uid perms path)\<rightarrow>
         update path (Some (Val (\<lparr>owner = uid, others = perms\<rparr>, []))) root"
       if "path = parent_path @ [name]"
       and "access root parent_path uid {Writable} = Some (Env att parent)"
       and "access root path uid {} = None"
   | unlink:
       "root \<midarrow>(Unlink uid path)\<rightarrow> update path None root"
       if "path = parent_path @ [name]"
       and "access root parent_path uid {Writable} = Some (Env att parent)"
       and "access root path uid {} = Some (Val plain)"
   | mkdir:
       "root \<midarrow>(Mkdir uid perms path)\<rightarrow>
         update path (Some (Env \<lparr>owner = uid, others = perms\<rparr> Map.empty)) root"
       if "path = parent_path @ [name]"
       and "access root parent_path uid {Writable} = Some (Env att parent)"
       and "access root path uid {} = None"
   | rmdir:
       "root \<midarrow>(Rmdir uid path)\<rightarrow> update path None root"
       if "path = parent_path @ [name]"
       and "access root parent_path uid {Writable} = Some (Env att parent)"
       and "access root path uid {} = Some (Env att' Map.empty)"
   | readdir:
       "root \<midarrow>(Readdir uid names path)\<rightarrow> root"
       if "access root path uid {Readable} = Some (Env att dir)"
       and "names = dom dir"
 
 text \<open>
   \<^medskip>
   Certainly, the above specification is central to the whole formal
   development. Any of the results to be established later on are only
   meaningful to the outside world if this transition system provides an
   adequate model of real Unix systems. This kind of ``reality-check'' of a
   formal model is the well-known problem of \<^emph>\<open>validation\<close>.
 
   If in doubt, one may consider to compare our definition with the informal
   specifications given the corresponding Unix man pages, or even peek at an
-  actual implementation such as @{cite "Torvalds-et-al:Linux"}. Another common
+  actual implementation such as \<^cite>\<open>"Torvalds-et-al:Linux"\<close>. Another common
   way to gain confidence into the formal model is to run simple simulations
   (see \secref{sec:unix-examples}), and check the results with that of
   experiments performed on a real Unix system.
 \<close>
 
 
 subsection \<open>Basic properties of single transitions \label{sec:unix-single-trans}\<close>
 
 text \<open>
   The transition system \<open>root \<midarrow>x\<rightarrow> root'\<close> defined above determines a unique
   result \<^term>\<open>root'\<close> from given \<^term>\<open>root\<close> and \<^term>\<open>x\<close> (this is
   holds rather trivially, since there is even only one clause for each
   operation). This uniqueness statement will simplify our subsequent
   development to some extent, since we only have to reason about a partial
   function rather than a general relation.
 \<close>
 
 theorem transition_uniq:
   assumes root': "root \<midarrow>x\<rightarrow> root'"
     and root'': "root \<midarrow>x\<rightarrow> root''"
   shows "root' = root''"
   using root''
 proof cases
   case read
   with root' show ?thesis by cases auto
 next
   case "write"
   with root' show ?thesis by cases auto
 next
   case chmod
   with root' show ?thesis by cases auto
 next
   case creat
   with root' show ?thesis by cases auto
 next
   case unlink
   with root' show ?thesis by cases auto
 next
   case mkdir
   with root' show ?thesis by cases auto
 next
   case rmdir
   with root' show ?thesis by cases auto
 next
   case readdir
   with root' show ?thesis by cases blast+
 qed
 
 text \<open>
   \<^medskip>
   Apparently, file-system transitions are \<^emph>\<open>type-safe\<close> in the sense that the
   result of transforming an actual directory yields again a directory.
 \<close>
 
 theorem transition_type_safe:
   assumes tr: "root \<midarrow>x\<rightarrow> root'"
     and inv: "\<exists>att dir. root = Env att dir"
   shows "\<exists>att dir. root' = Env att dir"
 proof (cases "path_of x")
   case Nil
   with tr inv show ?thesis
     by cases (auto simp add: access_def split: if_splits)
 next
   case Cons
   from tr obtain opt where
       "root' = root \<or> root' = update (path_of x) opt root"
     by cases auto
   with inv Cons show ?thesis
     by (auto simp add: update_eq split: list.splits)
 qed
 
 text \<open>
   The previous result may be seen as the most basic invariant on the
   file-system state that is enforced by any proper kernel implementation. So
   user processes --- being bound to the system-call interface --- may never
   mess up a file-system such that the root becomes a plain file instead of a
   directory, which would be a strange situation indeed.
 \<close>
 
 
 subsection \<open>Iterated transitions\<close>
 
 text \<open>
   Iterated system transitions via finite sequences of system operations are
   modeled inductively as follows. In a sense, this relation describes the
   cumulative effect of the sequence of system-calls issued by a number of
   running processes over a finite amount of time.
 \<close>
 
 inductive transitions :: "file \<Rightarrow> operation list \<Rightarrow> file \<Rightarrow> bool"  ("_ \<Midarrow>_\<Rightarrow> _" [90, 1000, 90] 100)
   where
     nil: "root \<Midarrow>[]\<Rightarrow> root"
   | cons: "root \<Midarrow>(x # xs)\<Rightarrow> root''" if "root \<midarrow>x\<rightarrow> root'" and "root' \<Midarrow>xs\<Rightarrow> root''"
 
 text \<open>
   \<^medskip>
   We establish a few basic facts relating iterated transitions with single
   ones, according to the recursive structure of lists.
 \<close>
 
 lemma transitions_nil_eq: "root \<Midarrow>[]\<Rightarrow> root' \<longleftrightarrow> root = root'"
 proof
   assume "root \<Midarrow>[]\<Rightarrow> root'"
   then show "root = root'" by cases simp_all
 next
   assume "root = root'"
   then show "root \<Midarrow>[]\<Rightarrow> root'" by (simp only: transitions.nil)
 qed
 
 lemma transitions_cons_eq:
   "root \<Midarrow>(x # xs)\<Rightarrow> root'' \<longleftrightarrow> (\<exists>root'. root \<midarrow>x\<rightarrow> root' \<and> root' \<Midarrow>xs\<Rightarrow> root'')"
 proof
   assume "root \<Midarrow>(x # xs)\<Rightarrow> root''"
   then show "\<exists>root'. root \<midarrow>x\<rightarrow> root' \<and> root' \<Midarrow>xs\<Rightarrow> root''"
     by cases auto
 next
   assume "\<exists>root'. root \<midarrow>x\<rightarrow> root' \<and> root' \<Midarrow>xs\<Rightarrow> root''"
   then show "root \<Midarrow>(x # xs)\<Rightarrow> root''"
     by (blast intro: transitions.cons)
 qed
 
 text \<open>
   The next two rules show how to ``destruct'' known transition sequences. Note
   that the second one actually relies on the uniqueness property of the basic
   transition system (see \secref{sec:unix-single-trans}).
 \<close>
 
 lemma transitions_nilD: "root \<Midarrow>[]\<Rightarrow> root' \<Longrightarrow> root' = root"
   by (simp add: transitions_nil_eq)
 
 lemma transitions_consD:
   assumes list: "root \<Midarrow>(x # xs)\<Rightarrow> root''"
     and hd: "root \<midarrow>x\<rightarrow> root'"
   shows "root' \<Midarrow>xs\<Rightarrow> root''"
 proof -
   from list obtain r' where r': "root \<midarrow>x\<rightarrow> r'" and root'': "r' \<Midarrow>xs\<Rightarrow> root''"
     by cases simp_all
   from r' hd have "r' = root'" by (rule transition_uniq)
   with root'' show "root' \<Midarrow>xs\<Rightarrow> root''" by simp
 qed
 
 text \<open>
   \<^medskip>
   The following fact shows how an invariant \<^term>\<open>Q\<close> of single transitions
   with property \<^term>\<open>P\<close> may be transferred to iterated transitions. The
   proof is rather obvious by rule induction over the definition of
   \<^term>\<open>root \<Midarrow>xs\<Rightarrow> root'\<close>.
 \<close>
 
 lemma transitions_invariant:
   assumes r: "\<And>r x r'. r \<midarrow>x\<rightarrow> r' \<Longrightarrow> Q r \<Longrightarrow> P x \<Longrightarrow> Q r'"
     and trans: "root \<Midarrow>xs\<Rightarrow> root'"
   shows "Q root \<Longrightarrow> \<forall>x \<in> set xs. P x \<Longrightarrow> Q root'"
   using trans
 proof induct
   case nil
   show ?case by (rule nil.prems)
 next
   case (cons root x root' xs root'')
   note P = \<open>\<forall>x \<in> set (x # xs). P x\<close>
   then have "P x" by simp
   with \<open>root \<midarrow>x\<rightarrow> root'\<close> and \<open>Q root\<close> have Q': "Q root'" by (rule r)
   from P have "\<forall>x \<in> set xs. P x" by simp
   with Q' show "Q root''" by (rule cons.hyps)
 qed
 
 text \<open>
   As an example of applying the previous result, we transfer the basic
   type-safety property (see \secref{sec:unix-single-trans}) from single
   transitions to iterated ones, which is a rather obvious result indeed.
 \<close>
 
 theorem transitions_type_safe:
   assumes "root \<Midarrow>xs\<Rightarrow> root'"
     and "\<exists>att dir. root = Env att dir"
   shows "\<exists>att dir. root' = Env att dir"
   using transition_type_safe and assms
 proof (rule transitions_invariant)
   show "\<forall>x \<in> set xs. True" by blast
 qed
 
 
 section \<open>Executable sequences\<close>
 
 text \<open>
   An inductively defined relation such as the one of \<open>root \<midarrow>x\<rightarrow> root'\<close> (see
   \secref{sec:unix-syscall}) has two main aspects. First of all, the resulting
   system admits a certain set of transition rules (introductions) as given in
   the specification. Furthermore, there is an explicit least-fixed-point
   construction involved, which results in induction (and case-analysis) rules
   to eliminate known transitions in an exhaustive manner.
 
   \<^medskip>
   Subsequently, we explore our transition system in an experimental style,
   mainly using the introduction rules with basic algebraic properties of the
   underlying structures. The technique closely resembles that of Prolog
   combined with functional evaluation in a very simple manner.
 
   Just as the ``closed-world assumption'' is left implicit in Prolog, we do
   not refer to induction over the whole transition system here. So this is
   still purely positive reasoning about possible executions; exhaustive
   reasoning will be employed only later on (see \secref{sec:unix-bogosity}),
   when we shall demonstrate that certain behavior is \<^emph>\<open>not\<close> possible.
 \<close>
 
 
 subsection \<open>Possible transitions\<close>
 
 text \<open>
   Rather obviously, a list of system operations can be executed within a
   certain state if there is a result state reached by an iterated transition.
 \<close>
 
 definition "can_exec root xs \<longleftrightarrow> (\<exists>root'. root \<Midarrow>xs\<Rightarrow> root')"
 
 lemma can_exec_nil: "can_exec root []"
   unfolding can_exec_def by (blast intro: transitions.intros)
 
 lemma can_exec_cons:
     "root \<midarrow>x\<rightarrow> root' \<Longrightarrow> can_exec root' xs \<Longrightarrow> can_exec root (x # xs)"
   unfolding can_exec_def by (blast intro: transitions.intros)
 
 text \<open>
   \<^medskip>
   In case that we already know that a certain sequence can be executed we may
   destruct it backwardly into individual transitions.
 \<close>
 
 lemma can_exec_snocD: "can_exec root (xs @ [y])
     \<Longrightarrow> \<exists>root' root''. root \<Midarrow>xs\<Rightarrow> root' \<and> root' \<midarrow>y\<rightarrow> root''"
 proof (induct xs arbitrary: root)
   case Nil
   then show ?case
     by (simp add: can_exec_def transitions_nil_eq transitions_cons_eq)
 next
   case (Cons x xs)
   from \<open>can_exec root ((x # xs) @ [y])\<close> obtain r root'' where
       x: "root \<midarrow>x\<rightarrow> r" and
       xs_y: "r \<Midarrow>(xs @ [y])\<Rightarrow> root''"
     by (auto simp add: can_exec_def transitions_nil_eq transitions_cons_eq)
   from xs_y Cons.hyps obtain root' r'
     where xs: "r \<Midarrow>xs\<Rightarrow> root'" and y: "root' \<midarrow>y\<rightarrow> r'"
     unfolding can_exec_def by blast
   from x xs have "root \<Midarrow>(x # xs)\<Rightarrow> root'"
     by (rule transitions.cons)
   with y show ?case by blast
 qed
 
 
 subsection \<open>Example executions \label{sec:unix-examples}\<close>
 
 text \<open>
   We are now ready to perform a few experiments within our formal model of
   Unix system-calls. The common technique is to alternate introduction rules
   of the transition system (see \secref{sec:unix-trans}), and steps to solve
   any emerging side conditions using algebraic properties of the underlying
   file-system structures (see \secref{sec:unix-file-system}).
 \<close>
 
 lemmas eval = access_def init_def
 
 theorem "u \<in> users \<Longrightarrow> can_exec (init users)
     [Mkdir u perms [u, name]]"
   apply (rule can_exec_cons)
     \<comment> \<open>back-chain \<^term>\<open>can_exec\<close> (of @{term [source] Cons})\<close>
   apply (rule mkdir)
     \<comment> \<open>back-chain \<^term>\<open>Mkdir\<close>\<close>
   apply (force simp add: eval)+
     \<comment> \<open>solve preconditions of \<^term>\<open>Mkdir\<close>\<close>
   apply (simp add: eval)
     \<comment> \<open>peek at resulting dir (optional)\<close>
   txt \<open>@{subgoals [display]}\<close>
   apply (rule can_exec_nil)
     \<comment> \<open>back-chain \<^term>\<open>can_exec\<close> (of @{term [source] Nil})\<close>
   done
 
 text \<open>
   By inspecting the result shown just before the final step above, we may gain
   confidence that our specification of Unix system-calls actually makes sense.
   Further common errors are usually exhibited when preconditions of transition
   rules fail unexpectedly.
 
   \<^medskip>
   Here are a few further experiments, using the same techniques as before.
 \<close>
 
 theorem "u \<in> users \<Longrightarrow> can_exec (init users)
    [Creat u perms [u, name],
     Unlink u [u, name]]"
   apply (rule can_exec_cons)
   apply (rule creat)
   apply (force simp add: eval)+
   apply (simp add: eval)
   apply (rule can_exec_cons)
   apply (rule unlink)
   apply (force simp add: eval)+
   apply (simp add: eval)
   txt \<open>peek at result: @{subgoals [display]}\<close>
   apply (rule can_exec_nil)
   done
 
 theorem "u \<in> users \<Longrightarrow> Writable \<in> perms\<^sub>1 \<Longrightarrow>
   Readable \<in> perms\<^sub>2 \<Longrightarrow> name\<^sub>3 \<noteq> name\<^sub>4 \<Longrightarrow>
   can_exec (init users)
    [Mkdir u perms\<^sub>1 [u, name\<^sub>1],
     Mkdir u' perms\<^sub>2 [u, name\<^sub>1, name\<^sub>2],
     Creat u' perms\<^sub>3 [u, name\<^sub>1, name\<^sub>2, name\<^sub>3],
     Creat u' perms\<^sub>3 [u, name\<^sub>1, name\<^sub>2, name\<^sub>4],
     Readdir u {name\<^sub>3, name\<^sub>4} [u, name\<^sub>1, name\<^sub>2]]"
   apply (rule can_exec_cons, rule transition.intros,
     (force simp add: eval)+, (simp add: eval)?)+
   txt \<open>peek at result: @{subgoals [display]}\<close>
   apply (rule can_exec_nil)
   done
 
 theorem "u \<in> users \<Longrightarrow> Writable \<in> perms\<^sub>1 \<Longrightarrow> Readable \<in> perms\<^sub>3 \<Longrightarrow>
   can_exec (init users)
    [Mkdir u perms\<^sub>1 [u, name\<^sub>1],
     Mkdir u' perms\<^sub>2 [u, name\<^sub>1, name\<^sub>2],
     Creat u' perms\<^sub>3 [u, name\<^sub>1, name\<^sub>2, name\<^sub>3],
     Write u' ''foo'' [u, name\<^sub>1, name\<^sub>2, name\<^sub>3],
     Read u ''foo'' [u, name\<^sub>1, name\<^sub>2, name\<^sub>3]]"
   apply (rule can_exec_cons, rule transition.intros,
     (force simp add: eval)+, (simp add: eval)?)+
   txt \<open>peek at result: @{subgoals [display]}\<close>
   apply (rule can_exec_nil)
   done
 
 
 section \<open>Odd effects --- treated formally \label{sec:unix-bogosity}\<close>
 
 text \<open>
   We are now ready to give a completely formal treatment of the slightly odd
   situation discussed in the introduction (see \secref{sec:unix-intro}): the
   file-system can easily reach a state where a user is unable to remove his
   very own directory, because it is still populated by items placed there by
   another user in an uncouth manner.
 \<close>
 
 
 subsection \<open>The general procedure \label{sec:unix-inv-procedure}\<close>
 
 text \<open>
   The following theorem expresses the general procedure we are following to
   achieve the main result.
 \<close>
 
 theorem general_procedure:
   assumes cannot_y: "\<And>r r'. Q r \<Longrightarrow> r \<midarrow>y\<rightarrow> r' \<Longrightarrow> False"
     and init_inv: "\<And>root. init users \<Midarrow>bs\<Rightarrow> root \<Longrightarrow> Q root"
     and preserve_inv: "\<And>r x r'. r \<midarrow>x\<rightarrow> r' \<Longrightarrow> Q r \<Longrightarrow> P x \<Longrightarrow> Q r'"
     and init_result: "init users \<Midarrow>bs\<Rightarrow> root"
   shows "\<not> (\<exists>xs. (\<forall>x \<in> set xs. P x) \<and> can_exec root (xs @ [y]))"
 proof -
   {
     fix xs
     assume Ps: "\<forall>x \<in> set xs. P x"
     assume can_exec: "can_exec root (xs @ [y])"
     then obtain root' root'' where xs: "root \<Midarrow>xs\<Rightarrow> root'" and y: "root' \<midarrow>y\<rightarrow> root''"
       by (blast dest: can_exec_snocD)
     from init_result have "Q root" by (rule init_inv)
     from preserve_inv xs this Ps have "Q root'"
       by (rule transitions_invariant)
     from this y have False by (rule cannot_y)
   }
   then show ?thesis by blast
 qed
 
 text \<open>
   Here \<^prop>\<open>P x\<close> refers to the restriction on file-system operations that
   are admitted after having reached the critical configuration; according to
   the problem specification this will become \<^prop>\<open>uid_of x = user\<^sub>1\<close> later
   on. Furthermore, \<^term>\<open>y\<close> refers to the operations we claim to be
   impossible to perform afterwards, we will take \<^term>\<open>Rmdir\<close> later. Moreover
   \<^term>\<open>Q\<close> is a suitable (auxiliary) invariant over the file-system; choosing
   \<^term>\<open>Q\<close> adequately is very important to make the proof work (see
   \secref{sec:unix-inv-lemmas}).
 \<close>
 
 
 subsection \<open>The particular situation\<close>
 
 text \<open>
   We introduce a few global declarations and axioms to describe our particular
   situation considered here. Thus we avoid excessive use of local parameters
   in the subsequent development.
 \<close>
 
 context
   fixes users :: "uid set"
     and user\<^sub>1 :: uid
     and user\<^sub>2 :: uid
     and name\<^sub>1 :: name
     and name\<^sub>2 :: name
     and name\<^sub>3 :: name
     and perms\<^sub>1 :: perms
     and perms\<^sub>2 :: perms
   assumes user\<^sub>1_known: "user\<^sub>1 \<in> users"
     and user\<^sub>1_not_root: "user\<^sub>1 \<noteq> 0"
     and users_neq: "user\<^sub>1 \<noteq> user\<^sub>2"
     and perms\<^sub>1_writable: "Writable \<in> perms\<^sub>1"
     and perms\<^sub>2_not_writable: "Writable \<notin> perms\<^sub>2"
   notes facts = user\<^sub>1_known user\<^sub>1_not_root users_neq
     perms\<^sub>1_writable perms\<^sub>2_not_writable
 begin
 
 definition
   "bogus =
      [Mkdir user\<^sub>1 perms\<^sub>1 [user\<^sub>1, name\<^sub>1],
       Mkdir user\<^sub>2 perms\<^sub>2 [user\<^sub>1, name\<^sub>1, name\<^sub>2],
       Creat user\<^sub>2 perms\<^sub>2 [user\<^sub>1, name\<^sub>1, name\<^sub>2, name\<^sub>3]]"
 
 definition "bogus_path = [user\<^sub>1, name\<^sub>1, name\<^sub>2]"
 
 text \<open>
   The \<^term>\<open>bogus\<close> operations are the ones that lead into the uncouth
   situation; \<^term>\<open>bogus_path\<close> is the key position within the file-system
   where things go awry.
 \<close>
 
 
 subsection \<open>Invariance lemmas \label{sec:unix-inv-lemmas}\<close>
 
 text \<open>
   The following invariant over the root file-system describes the bogus
   situation in an abstract manner: located at a certain \<^term>\<open>path\<close> within
   the file-system is a non-empty directory that is neither owned nor writable
   by \<^term>\<open>user\<^sub>1\<close>.
 \<close>
 
 definition
   "invariant root path \<longleftrightarrow>
     (\<exists>att dir.
       access root path user\<^sub>1 {} = Some (Env att dir) \<and> dir \<noteq> Map.empty \<and>
       user\<^sub>1 \<noteq> owner att \<and>
       access root path user\<^sub>1 {Writable} = None)"
 
 text \<open>
   Following the general procedure (see \secref{sec:unix-inv-procedure}) we
   will now establish the three key lemmas required to yield the final result.
 
     \<^enum> The invariant is sufficiently strong to entail the pathological case
     that \<^term>\<open>user\<^sub>1\<close> is unable to remove the (owned) directory at
     \<^term>\<open>[user\<^sub>1, name\<^sub>1]\<close>.
 
     \<^enum> The invariant does hold after having executed the \<^term>\<open>bogus\<close> list of
     operations (starting with an initial file-system configuration).
 
     \<^enum> The invariant is preserved by any file-system operation performed by
     \<^term>\<open>user\<^sub>1\<close> alone, without any help by other users.
 
   As the invariant appears both as assumptions and conclusions in the course
   of proof, its formulation is rather critical for the whole development to
   work out properly. In particular, the third step is very sensitive to the
   invariant being either too strong or too weak. Moreover the invariant has to
   be sufficiently abstract, lest the proof become cluttered by confusing
   detail.
 
   \<^medskip>
   The first two lemmas are technically straight forward --- we just have to
   inspect rather special cases.
 \<close>
 
 lemma cannot_rmdir:
   assumes inv: "invariant root bogus_path"
     and rmdir: "root \<midarrow>(Rmdir user\<^sub>1 [user\<^sub>1, name\<^sub>1])\<rightarrow> root'"
   shows False
 proof -
   from inv obtain "file" where "access root bogus_path user\<^sub>1 {} = Some file"
     unfolding invariant_def by blast
   moreover
   from rmdir obtain att where "access root [user\<^sub>1, name\<^sub>1] user\<^sub>1 {} = Some (Env att Map.empty)"
     by cases auto
   then have "access root ([user\<^sub>1, name\<^sub>1] @ [name\<^sub>2]) user\<^sub>1 {} = Map.empty name\<^sub>2"
     by (simp only: access_empty_lookup lookup_append_some) simp
   ultimately show False by (simp add: bogus_path_def)
 qed
 
 lemma
   assumes init: "init users \<Midarrow>bogus\<Rightarrow> root"
   shows init_invariant: "invariant root bogus_path"
   supply eval = facts access_def init_def
   using init
   apply (unfold bogus_def bogus_path_def)
   apply (drule transitions_consD, rule transition.intros,
       (force simp add: eval)+, (simp add: eval)?)+
     \<comment> \<open>evaluate all operations\<close>
   apply (drule transitions_nilD)
     \<comment> \<open>reach final result\<close>
   apply (simp add: invariant_def eval)
     \<comment> \<open>check the invariant\<close>
   done
 
 text \<open>
   \<^medskip>
   At last we are left with the main effort to show that the ``bogosity''
   invariant is preserved by any file-system operation performed by
   \<^term>\<open>user\<^sub>1\<close> alone. Note that this holds for any \<^term>\<open>path\<close> given,
   the particular \<^term>\<open>bogus_path\<close> is not required here.
 \<close>
 
 lemma preserve_invariant:
   assumes tr: "root \<midarrow>x\<rightarrow> root'"
     and inv: "invariant root path"
     and uid: "uid_of x = user\<^sub>1"
   shows "invariant root' path"
 proof -
   from inv obtain att dir where
       inv1: "access root path user\<^sub>1 {} = Some (Env att dir)" and
       inv2: "dir \<noteq> Map.empty" and
       inv3: "user\<^sub>1 \<noteq> owner att" and
       inv4: "access root path user\<^sub>1 {Writable} = None"
     by (auto simp add: invariant_def)
 
   from inv1 have lookup: "lookup root path = Some (Env att dir)"
     by (simp only: access_empty_lookup)
 
   from inv1 inv3 inv4 and user\<^sub>1_not_root
   have not_writable: "Writable \<notin> others att"
     by (auto simp add: access_def split: option.splits)
 
   show ?thesis
   proof cases
     assume "root' = root"
     with inv show "invariant root' path" by (simp only:)
   next
     assume changed: "root' \<noteq> root"
     with tr obtain opt where root': "root' = update (path_of x) opt root"
       by cases auto
     show ?thesis
     proof (rule prefix_cases)
       assume "path_of x \<parallel> path"
       with inv root'
       have "\<And>perms. access root' path user\<^sub>1 perms = access root path user\<^sub>1 perms"
         by (simp only: access_update_other)
       with inv show "invariant root' path"
         by (simp only: invariant_def)
     next
       assume "prefix (path_of x) path"
       then obtain ys where path: "path = path_of x @ ys" ..
 
       show ?thesis
       proof (cases ys)
         assume "ys = []"
         with tr uid inv2 inv3 lookup changed path and user\<^sub>1_not_root
         have False
           by cases (auto simp add: access_empty_lookup dest: access_some_lookup)
         then show ?thesis ..
       next
         fix z zs assume ys: "ys = z # zs"
         have "lookup root' path = lookup root path"
         proof -
           from inv2 lookup path ys
           have look: "lookup root (path_of x @ z # zs) = Some (Env att dir)"
             by (simp only:)
           then obtain att' dir' file' where
               look': "lookup root (path_of x) = Some (Env att' dir')" and
               dir': "dir' z = Some file'" and
               file': "lookup file' zs = Some (Env att dir)"
             by (blast dest: lookup_some_upper)
 
           from tr uid changed look' dir' obtain att'' where
               look'': "lookup root' (path_of x) = Some (Env att'' dir')"
             by cases (auto simp add: access_empty_lookup lookup_update_some
               dest: access_some_lookup)
           with dir' file' have "lookup root' (path_of x @ z # zs) =
               Some (Env att dir)"
             by (simp add: lookup_append_some)
           with look path ys show ?thesis
             by simp
         qed
         with inv show "invariant root' path"
           by (simp only: invariant_def access_def)
       qed
     next
       assume "strict_prefix path (path_of x)"
       then obtain y ys where path: "path_of x = path @ y # ys" ..
 
       obtain dir' where
         lookup': "lookup root' path = Some (Env att dir')" and
         inv2': "dir' \<noteq> Map.empty"
       proof (cases ys)
         assume "ys = []"
         with path have parent: "path_of x = path @ [y]" by simp
         with tr uid inv4 changed obtain "file" where
             "root' = update (path_of x) (Some file) root"
           by cases auto
         with lookup parent have "lookup root' path = Some (Env att (dir(y\<mapsto>file)))"
           by (simp only: update_append_some update_cons_nil_env)
         moreover have "dir(y\<mapsto>file) \<noteq> Map.empty" by simp
         ultimately show ?thesis ..
       next
         fix z zs assume ys: "ys = z # zs"
         with lookup root' path
         have "lookup root' path = Some (update (y # ys) opt (Env att dir))"
           by (simp only: update_append_some)
         also obtain file' where
           "update (y # ys) opt (Env att dir) = Env att (dir(y\<mapsto>file'))"
         proof -
           have "dir y \<noteq> None"
           proof -
             have "dir y = lookup (Env att dir) [y]"
               by (simp split: option.splits)
             also from lookup have "\<dots> = lookup root (path @ [y])"
               by (simp only: lookup_append_some)
             also have "\<dots> \<noteq> None"
             proof -
               from ys obtain us u where rev_ys: "ys = us @ [u]"
                 by (cases ys rule: rev_cases) simp
               with tr path
               have "lookup root ((path @ [y]) @ (us @ [u])) \<noteq> None \<or>
                   lookup root ((path @ [y]) @ us) \<noteq> None"
                 by cases (auto dest: access_some_lookup)
               then show ?thesis
                 by (fastforce dest!: lookup_some_append)
             qed
             finally show ?thesis .
           qed
           with ys show ?thesis using that by auto
         qed
         also have "dir(y\<mapsto>file') \<noteq> Map.empty" by simp
         ultimately show ?thesis ..
       qed
 
       from lookup' have inv1': "access root' path user\<^sub>1 {} = Some (Env att dir')"
         by (simp only: access_empty_lookup)
 
       from inv3 lookup' and not_writable user\<^sub>1_not_root
       have "access root' path user\<^sub>1 {Writable} = None"
         by (simp add: access_def)
       with inv1' inv2' inv3 show ?thesis unfolding invariant_def by blast
     qed
   qed
 qed
 
 
 subsection \<open>Putting it all together \label{sec:unix-main-result}\<close>
 
 text \<open>
   The main result is now imminent, just by composing the three invariance
   lemmas (see \secref{sec:unix-inv-lemmas}) according the the overall
   procedure (see \secref{sec:unix-inv-procedure}).
 \<close>
 
 corollary
   assumes bogus: "init users \<Midarrow>bogus\<Rightarrow> root"
   shows "\<not> (\<exists>xs. (\<forall>x \<in> set xs. uid_of x = user\<^sub>1) \<and>
     can_exec root (xs @ [Rmdir user\<^sub>1 [user\<^sub>1, name\<^sub>1]]))"
 proof -
   from cannot_rmdir init_invariant preserve_invariant
     and bogus show ?thesis by (rule general_procedure)
 qed
 
 end
 
 end
diff --git a/src/HOL/ex/CTL.thy b/src/HOL/ex/CTL.thy
--- a/src/HOL/ex/CTL.thy
+++ b/src/HOL/ex/CTL.thy
@@ -1,312 +1,311 @@
 (*  Title:      HOL/ex/CTL.thy
     Author:     Gertrud Bauer
 *)
 
 section \<open>CTL formulae\<close>
 
 theory CTL
 imports Main
 begin
 
 text \<open>
-  We formalize basic concepts of Computational Tree Logic (CTL) @{cite
-  "McMillan-PhDThesis" and "McMillan-LectureNotes"} within the simply-typed
+  We formalize basic concepts of Computational Tree Logic (CTL) \<^cite>\<open>"McMillan-PhDThesis" and "McMillan-LectureNotes"\<close> within the simply-typed
   set theory of HOL.
 
   By using the common technique of ``shallow embedding'', a CTL formula is
   identified with the corresponding set of states where it holds.
   Consequently, CTL operations such as negation, conjunction, disjunction
   simply become complement, intersection, union of sets. We only require a
   separate operation for implication, as point-wise inclusion is usually not
   encountered in plain set-theory.
 \<close>
 
 lemmas [intro!] = Int_greatest Un_upper2 Un_upper1 Int_lower1 Int_lower2
 
 type_synonym 'a ctl = "'a set"
 
 definition imp :: "'a ctl \<Rightarrow> 'a ctl \<Rightarrow> 'a ctl"  (infixr "\<rightarrow>" 75)
   where "p \<rightarrow> q = - p \<union> q"
 
 lemma [intro!]: "p \<inter> p \<rightarrow> q \<subseteq> q" unfolding imp_def by auto
 lemma [intro!]: "p \<subseteq> (q \<rightarrow> p)" unfolding imp_def by rule
 
 
 text \<open>
   \<^smallskip>
   The CTL path operators are more interesting; they are based on an arbitrary,
   but fixed model \<open>\<M>\<close>, which is simply a transition relation over states
   \<^typ>\<open>'a\<close>.
 \<close>
 
 axiomatization \<M> :: "('a \<times> 'a) set"
 
 text \<open>
   The operators \<open>\<^bold>E\<^bold>X\<close>, \<open>\<^bold>E\<^bold>F\<close>, \<open>\<^bold>E\<^bold>G\<close> are taken as primitives, while \<open>\<^bold>A\<^bold>X\<close>,
   \<open>\<^bold>A\<^bold>F\<close>, \<open>\<^bold>A\<^bold>G\<close> are defined as derived ones. The formula \<open>\<^bold>E\<^bold>X p\<close> holds in a
   state \<open>s\<close>, iff there is a successor state \<open>s'\<close> (with respect to the model
   \<open>\<M>\<close>), such that \<open>p\<close> holds in \<open>s'\<close>. The formula \<open>\<^bold>E\<^bold>F p\<close> holds in a state
   \<open>s\<close>, iff there is a path in \<open>\<M>\<close>, starting from \<open>s\<close>, such that there exists a
   state \<open>s'\<close> on the path, such that \<open>p\<close> holds in \<open>s'\<close>. The formula \<open>\<^bold>E\<^bold>G p\<close>
   holds in a state \<open>s\<close>, iff there is a path, starting from \<open>s\<close>, such that for
   all states \<open>s'\<close> on the path, \<open>p\<close> holds in \<open>s'\<close>. It is easy to see that \<open>\<^bold>E\<^bold>F
   p\<close> and \<open>\<^bold>E\<^bold>G p\<close> may be expressed using least and greatest fixed points
-  @{cite "McMillan-PhDThesis"}.
+  \<^cite>\<open>"McMillan-PhDThesis"\<close>.
 \<close>
 
 definition EX  ("\<^bold>E\<^bold>X _" [80] 90)
   where [simp]: "\<^bold>E\<^bold>X p = {s. \<exists>s'. (s, s') \<in> \<M> \<and> s' \<in> p}"
 
 definition EF ("\<^bold>E\<^bold>F _" [80] 90)
   where [simp]: "\<^bold>E\<^bold>F p = lfp (\<lambda>s. p \<union> \<^bold>E\<^bold>X s)"
 
 definition EG ("\<^bold>E\<^bold>G _" [80] 90)
   where [simp]: "\<^bold>E\<^bold>G p = gfp (\<lambda>s. p \<inter> \<^bold>E\<^bold>X s)"
 
 text \<open>
   \<open>\<^bold>A\<^bold>X\<close>, \<open>\<^bold>A\<^bold>F\<close> and \<open>\<^bold>A\<^bold>G\<close> are now defined dually in terms of \<open>\<^bold>E\<^bold>X\<close>,
   \<open>\<^bold>E\<^bold>F\<close> and \<open>\<^bold>E\<^bold>G\<close>.
 \<close>
 
 definition AX  ("\<^bold>A\<^bold>X _" [80] 90)
   where [simp]: "\<^bold>A\<^bold>X p = - \<^bold>E\<^bold>X - p"
 definition AF  ("\<^bold>A\<^bold>F _" [80] 90)
   where [simp]: "\<^bold>A\<^bold>F p = - \<^bold>E\<^bold>G - p"
 definition AG  ("\<^bold>A\<^bold>G _" [80] 90)
   where [simp]: "\<^bold>A\<^bold>G p = - \<^bold>E\<^bold>F - p"
 
 
 subsection \<open>Basic fixed point properties\<close>
 
 text \<open>
   First of all, we use the de-Morgan property of fixed points.
 \<close>
 
 lemma lfp_gfp: "lfp f = - gfp (\<lambda>s::'a set. - (f (- s)))"
 proof
   show "lfp f \<subseteq> - gfp (\<lambda>s. - f (- s))"
   proof
     show "x \<in> - gfp (\<lambda>s. - f (- s))" if l: "x \<in> lfp f" for x
     proof
       assume "x \<in> gfp (\<lambda>s. - f (- s))"
       then obtain u where "x \<in> u" and "u \<subseteq> - f (- u)"
         by (auto simp add: gfp_def)
       then have "f (- u) \<subseteq> - u" by auto
       then have "lfp f \<subseteq> - u" by (rule lfp_lowerbound)
       from l and this have "x \<notin> u" by auto
       with \<open>x \<in> u\<close> show False by contradiction
     qed
   qed
   show "- gfp (\<lambda>s. - f (- s)) \<subseteq> lfp f"
   proof (rule lfp_greatest)
     fix u
     assume "f u \<subseteq> u"
     then have "- u \<subseteq> - f u" by auto
     then have "- u \<subseteq> - f (- (- u))" by simp
     then have "- u \<subseteq> gfp (\<lambda>s. - f (- s))" by (rule gfp_upperbound)
     then show "- gfp (\<lambda>s. - f (- s)) \<subseteq> u" by auto
   qed
 qed
 
 lemma lfp_gfp': "- lfp f = gfp (\<lambda>s::'a set. - (f (- s)))"
   by (simp add: lfp_gfp)
 
 lemma gfp_lfp': "- gfp f = lfp (\<lambda>s::'a set. - (f (- s)))"
   by (simp add: lfp_gfp)
 
 text \<open>
   In order to give dual fixed point representations of \<^term>\<open>\<^bold>A\<^bold>F p\<close> and
   \<^term>\<open>\<^bold>A\<^bold>G p\<close>:
 \<close>
 
 lemma AF_lfp: "\<^bold>A\<^bold>F p = lfp (\<lambda>s. p \<union> \<^bold>A\<^bold>X s)"
   by (simp add: lfp_gfp)
 
 lemma AG_gfp: "\<^bold>A\<^bold>G p = gfp (\<lambda>s. p \<inter> \<^bold>A\<^bold>X s)"
   by (simp add: lfp_gfp)
 
 lemma EF_fp: "\<^bold>E\<^bold>F p = p \<union> \<^bold>E\<^bold>X \<^bold>E\<^bold>F p"
 proof -
   have "mono (\<lambda>s. p \<union> \<^bold>E\<^bold>X s)" by rule auto
   then show ?thesis by (simp only: EF_def) (rule lfp_unfold)
 qed
 
 lemma AF_fp: "\<^bold>A\<^bold>F p = p \<union> \<^bold>A\<^bold>X \<^bold>A\<^bold>F p"
 proof -
   have "mono (\<lambda>s. p \<union> \<^bold>A\<^bold>X s)" by rule auto
   then show ?thesis by (simp only: AF_lfp) (rule lfp_unfold)
 qed
 
 lemma EG_fp: "\<^bold>E\<^bold>G p = p \<inter> \<^bold>E\<^bold>X \<^bold>E\<^bold>G p"
 proof -
   have "mono (\<lambda>s. p \<inter> \<^bold>E\<^bold>X s)" by rule auto
   then show ?thesis by (simp only: EG_def) (rule gfp_unfold)
 qed
 
 text \<open>
   From the greatest fixed point definition of \<^term>\<open>\<^bold>A\<^bold>G p\<close>, we derive as
   a consequence of the Knaster-Tarski theorem on the one hand that \<^term>\<open>\<^bold>A\<^bold>G p\<close> is a fixed point of the monotonic function
   \<^term>\<open>\<lambda>s. p \<inter> \<^bold>A\<^bold>X s\<close>.
 \<close>
 
 lemma AG_fp: "\<^bold>A\<^bold>G p = p \<inter> \<^bold>A\<^bold>X \<^bold>A\<^bold>G p"
 proof -
   have "mono (\<lambda>s. p \<inter> \<^bold>A\<^bold>X s)" by rule auto
   then show ?thesis by (simp only: AG_gfp) (rule gfp_unfold)
 qed
 
 text \<open>
   This fact may be split up into two inequalities (merely using transitivity
   of \<open>\<subseteq>\<close>, which is an instance of the overloaded \<open>\<le>\<close> in Isabelle/HOL).
 \<close>
 
 lemma AG_fp_1: "\<^bold>A\<^bold>G p \<subseteq> p"
 proof -
   note AG_fp also have "p \<inter> \<^bold>A\<^bold>X \<^bold>A\<^bold>G p \<subseteq> p" by auto
   finally show ?thesis .
 qed
 
 lemma AG_fp_2: "\<^bold>A\<^bold>G p \<subseteq> \<^bold>A\<^bold>X \<^bold>A\<^bold>G p"
 proof -
   note AG_fp also have "p \<inter> \<^bold>A\<^bold>X \<^bold>A\<^bold>G p \<subseteq> \<^bold>A\<^bold>X \<^bold>A\<^bold>G p" by auto
   finally show ?thesis .
 qed
 
 text \<open>
   On the other hand, we have from the Knaster-Tarski fixed point theorem that
   any other post-fixed point of \<^term>\<open>\<lambda>s. p \<inter> \<^bold>A\<^bold>X s\<close> is smaller than
   \<^term>\<open>\<^bold>A\<^bold>G p\<close>. A post-fixed point is a set of states \<open>q\<close> such that \<^term>\<open>q \<subseteq> p \<inter> \<^bold>A\<^bold>X q\<close>. This leads to the following co-induction principle for
   \<^term>\<open>\<^bold>A\<^bold>G p\<close>.
 \<close>
 
 lemma AG_I: "q \<subseteq> p \<inter> \<^bold>A\<^bold>X q \<Longrightarrow> q \<subseteq> \<^bold>A\<^bold>G p"
   by (simp only: AG_gfp) (rule gfp_upperbound)
 
 
 subsection \<open>The tree induction principle \label{sec:calc-ctl-tree-induct}\<close>
 
 text \<open>
   With the most basic facts available, we are now able to establish a few more
   interesting results, leading to the \<^emph>\<open>tree induction\<close> principle for \<open>\<^bold>A\<^bold>G\<close>
   (see below). We will use some elementary monotonicity and distributivity
   rules.
 \<close>
 
 lemma AX_int: "\<^bold>A\<^bold>X (p \<inter> q) = \<^bold>A\<^bold>X p \<inter> \<^bold>A\<^bold>X q" by auto
 lemma AX_mono: "p \<subseteq> q \<Longrightarrow> \<^bold>A\<^bold>X p \<subseteq> \<^bold>A\<^bold>X q" by auto
 lemma AG_mono: "p \<subseteq> q \<Longrightarrow> \<^bold>A\<^bold>G p \<subseteq> \<^bold>A\<^bold>G q"
   by (simp only: AG_gfp, rule gfp_mono) auto
 
 text \<open>
   The formula \<^term>\<open>AG p\<close> implies \<^term>\<open>AX p\<close> (we use substitution of
   \<open>\<subseteq>\<close> with monotonicity).
 \<close>
 
 lemma AG_AX: "\<^bold>A\<^bold>G p \<subseteq> \<^bold>A\<^bold>X p"
 proof -
   have "\<^bold>A\<^bold>G p \<subseteq> \<^bold>A\<^bold>X \<^bold>A\<^bold>G p" by (rule AG_fp_2)
   also have "\<^bold>A\<^bold>G p \<subseteq> p" by (rule AG_fp_1)
   moreover note AX_mono
   finally show ?thesis .
 qed
 
 text \<open>
   Furthermore we show idempotency of the \<open>\<^bold>A\<^bold>G\<close> operator. The proof is a good
   example of how accumulated facts may get used to feed a single rule step.
 \<close>
 
 lemma AG_AG: "\<^bold>A\<^bold>G \<^bold>A\<^bold>G p = \<^bold>A\<^bold>G p"
 proof
   show "\<^bold>A\<^bold>G \<^bold>A\<^bold>G p \<subseteq> \<^bold>A\<^bold>G p" by (rule AG_fp_1)
 next
   show "\<^bold>A\<^bold>G p \<subseteq> \<^bold>A\<^bold>G \<^bold>A\<^bold>G p"
   proof (rule AG_I)
     have "\<^bold>A\<^bold>G p \<subseteq> \<^bold>A\<^bold>G p" ..
     moreover have "\<^bold>A\<^bold>G p \<subseteq> \<^bold>A\<^bold>X \<^bold>A\<^bold>G p" by (rule AG_fp_2)
     ultimately show "\<^bold>A\<^bold>G p \<subseteq> \<^bold>A\<^bold>G p \<inter> \<^bold>A\<^bold>X \<^bold>A\<^bold>G p" ..
   qed
 qed
 
 text \<open>
   \<^smallskip>
   We now give an alternative characterization of the \<open>\<^bold>A\<^bold>G\<close> operator, which
   describes the \<open>\<^bold>A\<^bold>G\<close> operator in an ``operational'' way by tree induction:
   In a state holds \<^term>\<open>AG p\<close> iff in that state holds \<open>p\<close>, and in all
   reachable states \<open>s\<close> follows from the fact that \<open>p\<close> holds in \<open>s\<close>, that \<open>p\<close>
   also holds in all successor states of \<open>s\<close>. We use the co-induction principle
   @{thm [source] AG_I} to establish this in a purely algebraic manner.
 \<close>
 
 theorem AG_induct: "p \<inter> \<^bold>A\<^bold>G (p \<rightarrow> \<^bold>A\<^bold>X p) = \<^bold>A\<^bold>G p"
 proof
   show "p \<inter> \<^bold>A\<^bold>G (p \<rightarrow> \<^bold>A\<^bold>X p) \<subseteq> \<^bold>A\<^bold>G p"  (is "?lhs \<subseteq> _")
   proof (rule AG_I)
     show "?lhs \<subseteq> p \<inter> \<^bold>A\<^bold>X ?lhs"
     proof
       show "?lhs \<subseteq> p" ..
       show "?lhs \<subseteq> \<^bold>A\<^bold>X ?lhs"
       proof -
         {
           have "\<^bold>A\<^bold>G (p \<rightarrow> \<^bold>A\<^bold>X p) \<subseteq> p \<rightarrow> \<^bold>A\<^bold>X p" by (rule AG_fp_1)
           also have "p \<inter> p \<rightarrow> \<^bold>A\<^bold>X p \<subseteq> \<^bold>A\<^bold>X p" ..
           finally have "?lhs \<subseteq> \<^bold>A\<^bold>X p" by auto
         }
         moreover
         {
           have "p \<inter> \<^bold>A\<^bold>G (p \<rightarrow> \<^bold>A\<^bold>X p) \<subseteq> \<^bold>A\<^bold>G (p \<rightarrow> \<^bold>A\<^bold>X p)" ..
           also have "\<dots> \<subseteq> \<^bold>A\<^bold>X \<dots>" by (rule AG_fp_2)
           finally have "?lhs \<subseteq> \<^bold>A\<^bold>X \<^bold>A\<^bold>G (p \<rightarrow> \<^bold>A\<^bold>X p)" .
         }
         ultimately have "?lhs \<subseteq> \<^bold>A\<^bold>X p \<inter> \<^bold>A\<^bold>X \<^bold>A\<^bold>G (p \<rightarrow> \<^bold>A\<^bold>X p)" ..
         also have "\<dots> = \<^bold>A\<^bold>X ?lhs" by (simp only: AX_int)
         finally show ?thesis .
       qed
     qed
   qed
 next
   show "\<^bold>A\<^bold>G p \<subseteq> p \<inter> \<^bold>A\<^bold>G (p \<rightarrow> \<^bold>A\<^bold>X p)"
   proof
     show "\<^bold>A\<^bold>G p \<subseteq> p" by (rule AG_fp_1)
     show "\<^bold>A\<^bold>G p \<subseteq> \<^bold>A\<^bold>G (p \<rightarrow> \<^bold>A\<^bold>X p)"
     proof -
       have "\<^bold>A\<^bold>G p = \<^bold>A\<^bold>G \<^bold>A\<^bold>G p" by (simp only: AG_AG)
       also have "\<^bold>A\<^bold>G p \<subseteq> \<^bold>A\<^bold>X p" by (rule AG_AX) moreover note AG_mono
       also have "\<^bold>A\<^bold>X p \<subseteq> (p \<rightarrow> \<^bold>A\<^bold>X p)" .. moreover note AG_mono
       finally show ?thesis .
     qed
   qed
 qed
 
 
 subsection \<open>An application of tree induction \label{sec:calc-ctl-commute}\<close>
 
 text \<open>
   Further interesting properties of CTL expressions may be demonstrated with
   the help of tree induction; here we show that \<open>\<^bold>A\<^bold>X\<close> and \<open>\<^bold>A\<^bold>G\<close> commute.
 \<close>
 
 theorem AG_AX_commute: "\<^bold>A\<^bold>G \<^bold>A\<^bold>X p = \<^bold>A\<^bold>X \<^bold>A\<^bold>G p"
 proof -
   have "\<^bold>A\<^bold>G \<^bold>A\<^bold>X p = \<^bold>A\<^bold>X p \<inter> \<^bold>A\<^bold>X \<^bold>A\<^bold>G \<^bold>A\<^bold>X p" by (rule AG_fp)
   also have "\<dots> = \<^bold>A\<^bold>X (p \<inter> \<^bold>A\<^bold>G \<^bold>A\<^bold>X p)" by (simp only: AX_int)
   also have "p \<inter> \<^bold>A\<^bold>G \<^bold>A\<^bold>X p = \<^bold>A\<^bold>G p"  (is "?lhs = _")
   proof
     have "\<^bold>A\<^bold>X p \<subseteq> p \<rightarrow> \<^bold>A\<^bold>X p" ..
     also have "p \<inter> \<^bold>A\<^bold>G (p \<rightarrow> \<^bold>A\<^bold>X p) = \<^bold>A\<^bold>G p" by (rule AG_induct)
     also note Int_mono AG_mono
     ultimately show "?lhs \<subseteq> \<^bold>A\<^bold>G p" by fast
   next
     have "\<^bold>A\<^bold>G p \<subseteq> p" by (rule AG_fp_1)
     moreover
     {
       have "\<^bold>A\<^bold>G p = \<^bold>A\<^bold>G \<^bold>A\<^bold>G p" by (simp only: AG_AG)
       also have "\<^bold>A\<^bold>G p \<subseteq> \<^bold>A\<^bold>X p" by (rule AG_AX)
       also note AG_mono
       ultimately have "\<^bold>A\<^bold>G p \<subseteq> \<^bold>A\<^bold>G \<^bold>A\<^bold>X p" .
     }
     ultimately show "\<^bold>A\<^bold>G p \<subseteq> ?lhs" ..
   qed
   finally show ?thesis .
 qed
 
 end
diff --git a/src/Pure/Examples/Higher_Order_Logic.thy b/src/Pure/Examples/Higher_Order_Logic.thy
--- a/src/Pure/Examples/Higher_Order_Logic.thy
+++ b/src/Pure/Examples/Higher_Order_Logic.thy
@@ -1,520 +1,519 @@
 (*  Title:      Pure/Examples/Higher_Order_Logic.thy
     Author:     Makarius
 *)
 
 section \<open>Foundations of HOL\<close>
 
 theory Higher_Order_Logic
   imports Pure
 begin
 
 text \<open>
   The following theory development illustrates the foundations of Higher-Order
-  Logic. The ``HOL'' logic that is given here resembles @{cite
-  "Gordon:1985:HOL"} and its predecessor @{cite "church40"}, but the order of
+  Logic. The ``HOL'' logic that is given here resembles \<^cite>\<open>"Gordon:1985:HOL"\<close> and its predecessor \<^cite>\<open>"church40"\<close>, but the order of
   axiomatizations and defined connectives has be adapted to modern
   presentations of \<open>\<lambda>\<close>-calculus and Constructive Type Theory. Thus it fits
   nicely to the underlying Natural Deduction framework of Isabelle/Pure and
   Isabelle/Isar.
 \<close>
 
 
 section \<open>HOL syntax within Pure\<close>
 
 class type
 default_sort type
 
 typedecl o
 instance o :: type ..
 instance "fun" :: (type, type) type ..
 
 judgment Trueprop :: "o \<Rightarrow> prop"  ("_" 5)
 
 
 section \<open>Minimal logic (axiomatization)\<close>
 
 axiomatization imp :: "o \<Rightarrow> o \<Rightarrow> o"  (infixr "\<longrightarrow>" 25)
   where impI [intro]: "(A \<Longrightarrow> B) \<Longrightarrow> A \<longrightarrow> B"
     and impE [dest, trans]: "A \<longrightarrow> B \<Longrightarrow> A \<Longrightarrow> B"
 
 axiomatization All :: "('a \<Rightarrow> o) \<Rightarrow> o"  (binder "\<forall>" 10)
   where allI [intro]: "(\<And>x. P x) \<Longrightarrow> \<forall>x. P x"
     and allE [dest]: "\<forall>x. P x \<Longrightarrow> P a"
 
 lemma atomize_imp [atomize]: "(A \<Longrightarrow> B) \<equiv> Trueprop (A \<longrightarrow> B)"
   by standard (fact impI, fact impE)
 
 lemma atomize_all [atomize]: "(\<And>x. P x) \<equiv> Trueprop (\<forall>x. P x)"
   by standard (fact allI, fact allE)
 
 
 subsubsection \<open>Derived connectives\<close>
 
 definition False :: o
   where "False \<equiv> \<forall>A. A"
 
 lemma FalseE [elim]:
   assumes "False"
   shows A
 proof -
   from \<open>False\<close> have "\<forall>A. A" by (simp only: False_def)
   then show A ..
 qed
 
 
 definition True :: o
   where "True \<equiv> False \<longrightarrow> False"
 
 lemma TrueI [intro]: True
   unfolding True_def ..
 
 
 definition not :: "o \<Rightarrow> o"  ("\<not> _" [40] 40)
   where "not \<equiv> \<lambda>A. A \<longrightarrow> False"
 
 lemma notI [intro]:
   assumes "A \<Longrightarrow> False"
   shows "\<not> A"
   using assms unfolding not_def ..
 
 lemma notE [elim]:
   assumes "\<not> A" and A
   shows B
 proof -
   from \<open>\<not> A\<close> have "A \<longrightarrow> False" by (simp only: not_def)
   from this and \<open>A\<close> have "False" ..
   then show B ..
 qed
 
 lemma notE': "A \<Longrightarrow> \<not> A \<Longrightarrow> B"
   by (rule notE)
 
 lemmas contradiction = notE notE'  \<comment> \<open>proof by contradiction in any order\<close>
 
 
 definition conj :: "o \<Rightarrow> o \<Rightarrow> o"  (infixr "\<and>" 35)
   where "A \<and> B \<equiv> \<forall>C. (A \<longrightarrow> B \<longrightarrow> C) \<longrightarrow> C"
 
 lemma conjI [intro]:
   assumes A and B
   shows "A \<and> B"
   unfolding conj_def
 proof
   fix C
   show "(A \<longrightarrow> B \<longrightarrow> C) \<longrightarrow> C"
   proof
     assume "A \<longrightarrow> B \<longrightarrow> C"
     also note \<open>A\<close>
     also note \<open>B\<close>
     finally show C .
   qed
 qed
 
 lemma conjE [elim]:
   assumes "A \<and> B"
   obtains A and B
 proof
   from \<open>A \<and> B\<close> have *: "(A \<longrightarrow> B \<longrightarrow> C) \<longrightarrow> C" for C
     unfolding conj_def ..
   show A
   proof -
     note * [of A]
     also have "A \<longrightarrow> B \<longrightarrow> A"
     proof
       assume A
       then show "B \<longrightarrow> A" ..
     qed
     finally show ?thesis .
   qed
   show B
   proof -
     note * [of B]
     also have "A \<longrightarrow> B \<longrightarrow> B"
     proof
       show "B \<longrightarrow> B" ..
     qed
     finally show ?thesis .
   qed
 qed
 
 
 definition disj :: "o \<Rightarrow> o \<Rightarrow> o"  (infixr "\<or>" 30)
   where "A \<or> B \<equiv> \<forall>C. (A \<longrightarrow> C) \<longrightarrow> (B \<longrightarrow> C) \<longrightarrow> C"
 
 lemma disjI1 [intro]:
   assumes A
   shows "A \<or> B"
   unfolding disj_def
 proof
   fix C
   show "(A \<longrightarrow> C) \<longrightarrow> (B \<longrightarrow> C) \<longrightarrow> C"
   proof
     assume "A \<longrightarrow> C"
     from this and \<open>A\<close> have C ..
     then show "(B \<longrightarrow> C) \<longrightarrow> C" ..
   qed
 qed
 
 lemma disjI2 [intro]:
   assumes B
   shows "A \<or> B"
   unfolding disj_def
 proof
   fix C
   show "(A \<longrightarrow> C) \<longrightarrow> (B \<longrightarrow> C) \<longrightarrow> C"
   proof
     show "(B \<longrightarrow> C) \<longrightarrow> C"
     proof
       assume "B \<longrightarrow> C"
       from this and \<open>B\<close> show C ..
     qed
   qed
 qed
 
 lemma disjE [elim]:
   assumes "A \<or> B"
   obtains (a) A | (b) B
 proof -
   from \<open>A \<or> B\<close> have "(A \<longrightarrow> thesis) \<longrightarrow> (B \<longrightarrow> thesis) \<longrightarrow> thesis"
     unfolding disj_def ..
   also have "A \<longrightarrow> thesis"
   proof
     assume A
     then show thesis by (rule a)
   qed
   also have "B \<longrightarrow> thesis"
   proof
     assume B
     then show thesis by (rule b)
   qed
   finally show thesis .
 qed
 
 
 definition Ex :: "('a \<Rightarrow> o) \<Rightarrow> o"  (binder "\<exists>" 10)
   where "\<exists>x. P x \<equiv> \<forall>C. (\<forall>x. P x \<longrightarrow> C) \<longrightarrow> C"
 
 lemma exI [intro]: "P a \<Longrightarrow> \<exists>x. P x"
   unfolding Ex_def
 proof
   fix C
   assume "P a"
   show "(\<forall>x. P x \<longrightarrow> C) \<longrightarrow> C"
   proof
     assume "\<forall>x. P x \<longrightarrow> C"
     then have "P a \<longrightarrow> C" ..
     from this and \<open>P a\<close> show C ..
   qed
 qed
 
 lemma exE [elim]:
   assumes "\<exists>x. P x"
   obtains (that) x where "P x"
 proof -
   from \<open>\<exists>x. P x\<close> have "(\<forall>x. P x \<longrightarrow> thesis) \<longrightarrow> thesis"
     unfolding Ex_def ..
   also have "\<forall>x. P x \<longrightarrow> thesis"
   proof
     fix x
     show "P x \<longrightarrow> thesis"
     proof
       assume "P x"
       then show thesis by (rule that)
     qed
   qed
   finally show thesis .
 qed
 
 
 subsubsection \<open>Extensional equality\<close>
 
 axiomatization equal :: "'a \<Rightarrow> 'a \<Rightarrow> o"  (infixl "=" 50)
   where refl [intro]: "x = x"
     and subst: "x = y \<Longrightarrow> P x \<Longrightarrow> P y"
 
 abbreviation not_equal :: "'a \<Rightarrow> 'a \<Rightarrow> o"  (infixl "\<noteq>" 50)
   where "x \<noteq> y \<equiv> \<not> (x = y)"
 
 abbreviation iff :: "o \<Rightarrow> o \<Rightarrow> o"  (infixr "\<longleftrightarrow>" 25)
   where "A \<longleftrightarrow> B \<equiv> A = B"
 
 axiomatization
   where ext [intro]: "(\<And>x. f x = g x) \<Longrightarrow> f = g"
     and iff [intro]: "(A \<Longrightarrow> B) \<Longrightarrow> (B \<Longrightarrow> A) \<Longrightarrow> A \<longleftrightarrow> B"
   for f g :: "'a \<Rightarrow> 'b"
 
 lemma sym [sym]: "y = x" if "x = y"
   using that by (rule subst) (rule refl)
 
 lemma [trans]: "x = y \<Longrightarrow> P y \<Longrightarrow> P x"
   by (rule subst) (rule sym)
 
 lemma [trans]: "P x \<Longrightarrow> x = y \<Longrightarrow> P y"
   by (rule subst)
 
 lemma arg_cong: "f x = f y" if "x = y"
   using that by (rule subst) (rule refl)
 
 lemma fun_cong: "f x = g x" if "f = g"
   using that by (rule subst) (rule refl)
 
 lemma trans [trans]: "x = y \<Longrightarrow> y = z \<Longrightarrow> x = z"
   by (rule subst)
 
 lemma iff1 [elim]: "A \<longleftrightarrow> B \<Longrightarrow> A \<Longrightarrow> B"
   by (rule subst)
 
 lemma iff2 [elim]: "A \<longleftrightarrow> B \<Longrightarrow> B \<Longrightarrow> A"
   by (rule subst) (rule sym)
 
 
 subsection \<open>Cantor's Theorem\<close>
 
 text \<open>
   Cantor's Theorem states that there is no surjection from a set to its
   powerset. The subsequent formulation uses elementary \<open>\<lambda>\<close>-calculus and
   predicate logic, with standard introduction and elimination rules.
 \<close>
 
 lemma iff_contradiction:
   assumes *: "\<not> A \<longleftrightarrow> A"
   shows C
 proof (rule notE)
   show "\<not> A"
   proof
     assume A
     with * have "\<not> A" ..
     from this and \<open>A\<close> show False ..
   qed
   with * show A ..
 qed
 
 theorem Cantor: "\<not> (\<exists>f :: 'a \<Rightarrow> 'a \<Rightarrow> o. \<forall>A. \<exists>x. A = f x)"
 proof
   assume "\<exists>f :: 'a \<Rightarrow> 'a \<Rightarrow> o. \<forall>A. \<exists>x. A = f x"
   then obtain f :: "'a \<Rightarrow> 'a \<Rightarrow> o" where *: "\<forall>A. \<exists>x. A = f x" ..
   let ?D = "\<lambda>x. \<not> f x x"
   from * have "\<exists>x. ?D = f x" ..
   then obtain a where "?D = f a" ..
   then have "?D a \<longleftrightarrow> f a a" using refl by (rule subst)
   then have "\<not> f a a \<longleftrightarrow> f a a" .
   then show False by (rule iff_contradiction)
 qed
 
 
 subsection \<open>Characterization of Classical Logic\<close>
 
 text \<open>
   The subsequent rules of classical reasoning are all equivalent.
 \<close>
 
 locale classical =
   assumes classical: "(\<not> A \<Longrightarrow> A) \<Longrightarrow> A"
   \<comment> \<open>predicate definition and hypothetical context\<close>
 begin
 
 lemma classical_contradiction:
   assumes "\<not> A \<Longrightarrow> False"
   shows A
 proof (rule classical)
   assume "\<not> A"
   then have False by (rule assms)
   then show A ..
 qed
 
 lemma double_negation:
   assumes "\<not> \<not> A"
   shows A
 proof (rule classical_contradiction)
   assume "\<not> A"
   with \<open>\<not> \<not> A\<close> show False by (rule contradiction)
 qed
 
 lemma tertium_non_datur: "A \<or> \<not> A"
 proof (rule double_negation)
   show "\<not> \<not> (A \<or> \<not> A)"
   proof
     assume "\<not> (A \<or> \<not> A)"
     have "\<not> A"
     proof
       assume A then have "A \<or> \<not> A" ..
       with \<open>\<not> (A \<or> \<not> A)\<close> show False by (rule contradiction)
     qed
     then have "A \<or> \<not> A" ..
     with \<open>\<not> (A \<or> \<not> A)\<close> show False by (rule contradiction)
   qed
 qed
 
 lemma classical_cases:
   obtains A | "\<not> A"
   using tertium_non_datur
 proof
   assume A
   then show thesis ..
 next
   assume "\<not> A"
   then show thesis ..
 qed
 
 end
 
 lemma classical_if_cases: classical
   if cases: "\<And>A C. (A \<Longrightarrow> C) \<Longrightarrow> (\<not> A \<Longrightarrow> C) \<Longrightarrow> C"
 proof
   fix A
   assume *: "\<not> A \<Longrightarrow> A"
   show A
   proof (rule cases)
     assume A
     then show A .
   next
     assume "\<not> A"
     then show A by (rule *)
   qed
 qed
 
 
 section \<open>Peirce's Law\<close>
 
 text \<open>
   Peirce's Law is another characterization of classical reasoning. Its
   statement only requires implication.
 \<close>
 
 theorem (in classical) Peirce's_Law: "((A \<longrightarrow> B) \<longrightarrow> A) \<longrightarrow> A"
 proof
   assume *: "(A \<longrightarrow> B) \<longrightarrow> A"
   show A
   proof (rule classical)
     assume "\<not> A"
     have "A \<longrightarrow> B"
     proof
       assume A
       with \<open>\<not> A\<close> show B by (rule contradiction)
     qed
     with * show A ..
   qed
 qed
 
 
 section \<open>Hilbert's choice operator (axiomatization)\<close>
 
 axiomatization Eps :: "('a \<Rightarrow> o) \<Rightarrow> 'a"
   where someI: "P x \<Longrightarrow> P (Eps P)"
 
 syntax "_Eps" :: "pttrn \<Rightarrow> o \<Rightarrow> 'a"  ("(3SOME _./ _)" [0, 10] 10)
 translations "SOME x. P" \<rightleftharpoons> "CONST Eps (\<lambda>x. P)"
 
 text \<open>
   \<^medskip>
   It follows a derivation of the classical law of tertium-non-datur by
   means of Hilbert's choice operator (due to Berghofer, Beeson, Harrison,
   based on a proof by Diaconescu).
   \<^medskip>
 \<close>
 
 theorem Diaconescu: "A \<or> \<not> A"
 proof -
   let ?P = "\<lambda>x. (A \<and> x) \<or> \<not> x"
   let ?Q = "\<lambda>x. (A \<and> \<not> x) \<or> x"
 
   have a: "?P (Eps ?P)"
   proof (rule someI)
     have "\<not> False" ..
     then show "?P False" ..
   qed
   have b: "?Q (Eps ?Q)"
   proof (rule someI)
     have True ..
     then show "?Q True" ..
   qed
 
   from a show ?thesis
   proof
     assume "A \<and> Eps ?P"
     then have A ..
     then show ?thesis ..
   next
     assume "\<not> Eps ?P"
     from b show ?thesis
     proof
       assume "A \<and> \<not> Eps ?Q"
       then have A ..
       then show ?thesis ..
     next
       assume "Eps ?Q"
       have neq: "?P \<noteq> ?Q"
       proof
         assume "?P = ?Q"
         then have "Eps ?P \<longleftrightarrow> Eps ?Q" by (rule arg_cong)
         also note \<open>Eps ?Q\<close>
         finally have "Eps ?P" .
         with \<open>\<not> Eps ?P\<close> show False by (rule contradiction)
       qed
       have "\<not> A"
       proof
         assume A
         have "?P = ?Q"
         proof (rule ext)
           show "?P x \<longleftrightarrow> ?Q x" for x
           proof
             assume "?P x"
             then show "?Q x"
             proof
               assume "\<not> x"
               with \<open>A\<close> have "A \<and> \<not> x" ..
               then show ?thesis ..
             next
               assume "A \<and> x"
               then have x ..
               then show ?thesis ..
             qed
           next
             assume "?Q x"
             then show "?P x"
             proof
               assume "A \<and> \<not> x"
               then have "\<not> x" ..
               then show ?thesis ..
             next
               assume x
               with \<open>A\<close> have "A \<and> x" ..
               then show ?thesis ..
             qed
           qed
         qed
         with neq show False by (rule contradiction)
       qed
       then show ?thesis ..
     qed
   qed
 qed
 
 text \<open>
   This means, the hypothetical predicate \<^const>\<open>classical\<close> always holds
   unconditionally (with all consequences).
 \<close>
 
 interpretation classical
 proof (rule classical_if_cases)
   fix A C
   assume *: "A \<Longrightarrow> C"
     and **: "\<not> A \<Longrightarrow> C"
   from Diaconescu [of A] show C
   proof
     assume A
     then show C by (rule *)
   next
     assume "\<not> A"
     then show C by (rule **)
   qed
 qed
 
 thm classical
   classical_contradiction
   double_negation
   tertium_non_datur
   classical_cases
   Peirce's_Law
 
 end
diff --git a/src/ZF/Induct/Acc.thy b/src/ZF/Induct/Acc.thy
--- a/src/ZF/Induct/Acc.thy
+++ b/src/ZF/Induct/Acc.thy
@@ -1,61 +1,61 @@
 (*  Title:      ZF/Induct/Acc.thy
     Author:     Lawrence C Paulson, Cambridge University Computer Laboratory
     Copyright   1994  University of Cambridge
 *)
 
 section \<open>The accessible part of a relation\<close>
 
 theory Acc imports ZF begin
 
 text \<open>
-  Inductive definition of \<open>acc(r)\<close>; see @{cite "paulin-tlca"}.
+  Inductive definition of \<open>acc(r)\<close>; see \<^cite>\<open>"paulin-tlca"\<close>.
 \<close>
 
 consts
   acc :: "i \<Rightarrow> i"
 
 inductive
   domains "acc(r)" \<subseteq> "field(r)"
   intros
     vimage:  "\<lbrakk>r-``{a}: Pow(acc(r)); a \<in> field(r)\<rbrakk> \<Longrightarrow> a \<in> acc(r)"
   monos      Pow_mono
 
 text \<open>
   The introduction rule must require \<^prop>\<open>a \<in> field(r)\<close>,
   otherwise \<open>acc(r)\<close> would be a proper class!
 
   \medskip
   The intended introduction rule:
 \<close>
 
 lemma accI: "\<lbrakk>\<And>b. \<langle>b,a\<rangle>:r \<Longrightarrow> b \<in> acc(r);  a \<in> field(r)\<rbrakk> \<Longrightarrow> a \<in> acc(r)"
   by (blast intro: acc.intros)
 
 lemma acc_downward: "\<lbrakk>b \<in> acc(r);  \<langle>a,b\<rangle>: r\<rbrakk> \<Longrightarrow> a \<in> acc(r)"
   by (erule acc.cases) blast
 
 lemma acc_induct [consumes 1, case_names vimage, induct set: acc]:
     "\<lbrakk>a \<in> acc(r);
         \<And>x. \<lbrakk>x \<in> acc(r);  \<forall>y. \<langle>y,x\<rangle>:r \<longrightarrow> P(y)\<rbrakk> \<Longrightarrow> P(x)
 \<rbrakk> \<Longrightarrow> P(a)"
   by (erule acc.induct) (blast intro: acc.intros)
 
 lemma wf_on_acc: "wf[acc(r)](r)"
   apply (rule wf_onI2)
   apply (erule acc_induct)
   apply fast
   done
 
 lemma acc_wfI: "field(r) \<subseteq> acc(r) \<Longrightarrow> wf(r)"
   by (erule wf_on_acc [THEN wf_on_subset_A, THEN wf_on_field_imp_wf])
 
 lemma acc_wfD: "wf(r) \<Longrightarrow> field(r) \<subseteq> acc(r)"
   apply (rule subsetI)
   apply (erule wf_induct2, assumption)
    apply (blast intro: accI)+
   done
 
 lemma wf_acc_iff: "wf(r) \<longleftrightarrow> field(r) \<subseteq> acc(r)"
   by (rule iffI, erule acc_wfD, erule acc_wfI)
 
 end
diff --git a/src/ZF/Induct/Comb.thy b/src/ZF/Induct/Comb.thy
--- a/src/ZF/Induct/Comb.thy
+++ b/src/ZF/Induct/Comb.thy
@@ -1,273 +1,273 @@
 (*  Title:      ZF/Induct/Comb.thy
     Author:     Lawrence C Paulson
     Copyright   1994  University of Cambridge
 *)
 
 section \<open>Combinatory Logic example: the Church-Rosser Theorem\<close>
 
 theory Comb
 imports ZF
 begin
 
 text \<open>
   Curiously, combinators do not include free variables.
 
-  Example taken from @{cite camilleri92}.
+  Example taken from \<^cite>\<open>camilleri92\<close>.
 \<close>
 
 
 subsection \<open>Definitions\<close>
 
 text \<open>Datatype definition of combinators \<open>S\<close> and \<open>K\<close>.\<close>
 
 consts comb :: i
 datatype comb =
   K
 | S
 | app ("p \<in> comb", "q \<in> comb")  (infixl \<open>\<bullet>\<close> 90)
 
 text \<open>
   Inductive definition of contractions, \<open>\<rightarrow>\<^sup>1\<close> and
   (multi-step) reductions, \<open>\<rightarrow>\<close>.
 \<close>
 
 consts contract  :: i
 abbreviation contract_syntax :: "[i,i] \<Rightarrow> o"  (infixl \<open>\<rightarrow>\<^sup>1\<close> 50)
   where "p \<rightarrow>\<^sup>1 q \<equiv> \<langle>p,q\<rangle> \<in> contract"
 
 abbreviation contract_multi :: "[i,i] \<Rightarrow> o"  (infixl \<open>\<rightarrow>\<close> 50)
   where "p \<rightarrow> q \<equiv> \<langle>p,q\<rangle> \<in> contract^*"
 
 inductive
   domains "contract" \<subseteq> "comb \<times> comb"
   intros
     K:   "\<lbrakk>p \<in> comb;  q \<in> comb\<rbrakk> \<Longrightarrow> K\<bullet>p\<bullet>q \<rightarrow>\<^sup>1 p"
     S:   "\<lbrakk>p \<in> comb;  q \<in> comb;  r \<in> comb\<rbrakk> \<Longrightarrow> S\<bullet>p\<bullet>q\<bullet>r \<rightarrow>\<^sup>1 (p\<bullet>r)\<bullet>(q\<bullet>r)"
     Ap1: "\<lbrakk>p\<rightarrow>\<^sup>1q;  r \<in> comb\<rbrakk> \<Longrightarrow> p\<bullet>r \<rightarrow>\<^sup>1 q\<bullet>r"
     Ap2: "\<lbrakk>p\<rightarrow>\<^sup>1q;  r \<in> comb\<rbrakk> \<Longrightarrow> r\<bullet>p \<rightarrow>\<^sup>1 r\<bullet>q"
   type_intros comb.intros
 
 text \<open>
   Inductive definition of parallel contractions, \<open>\<Rrightarrow>\<^sup>1\<close> and
   (multi-step) parallel reductions, \<open>\<Rrightarrow>\<close>.
 \<close>
 
 consts parcontract :: i
 
 abbreviation parcontract_syntax :: "[i,i] \<Rightarrow> o"  (infixl \<open>\<Rrightarrow>\<^sup>1\<close> 50)
   where "p \<Rrightarrow>\<^sup>1 q \<equiv> \<langle>p,q\<rangle> \<in> parcontract"
 
 abbreviation parcontract_multi :: "[i,i] \<Rightarrow> o"  (infixl \<open>\<Rrightarrow>\<close> 50)
   where "p \<Rrightarrow> q \<equiv> \<langle>p,q\<rangle> \<in> parcontract^+"
 
 inductive
   domains "parcontract" \<subseteq> "comb \<times> comb"
   intros
     refl: "\<lbrakk>p \<in> comb\<rbrakk> \<Longrightarrow> p \<Rrightarrow>\<^sup>1 p"
     K:    "\<lbrakk>p \<in> comb;  q \<in> comb\<rbrakk> \<Longrightarrow> K\<bullet>p\<bullet>q \<Rrightarrow>\<^sup>1 p"
     S:    "\<lbrakk>p \<in> comb;  q \<in> comb;  r \<in> comb\<rbrakk> \<Longrightarrow> S\<bullet>p\<bullet>q\<bullet>r \<Rrightarrow>\<^sup>1 (p\<bullet>r)\<bullet>(q\<bullet>r)"
     Ap:   "\<lbrakk>p\<Rrightarrow>\<^sup>1q;  r\<Rrightarrow>\<^sup>1s\<rbrakk> \<Longrightarrow> p\<bullet>r \<Rrightarrow>\<^sup>1 q\<bullet>s"
   type_intros comb.intros
 
 text \<open>
   Misc definitions.
 \<close>
 
 definition I :: i
   where "I \<equiv> S\<bullet>K\<bullet>K"
 
 definition diamond :: "i \<Rightarrow> o"
   where "diamond(r) \<equiv>
     \<forall>x y. \<langle>x,y\<rangle>\<in>r \<longrightarrow> (\<forall>y'. <x,y'>\<in>r \<longrightarrow> (\<exists>z. \<langle>y,z\<rangle>\<in>r \<and> <y',z> \<in> r))"
 
 
 subsection \<open>Transitive closure preserves the Church-Rosser property\<close>
 
 lemma diamond_strip_lemmaD [rule_format]:
   "\<lbrakk>diamond(r);  \<langle>x,y\<rangle>:r^+\<rbrakk> \<Longrightarrow>
     \<forall>y'. <x,y'>:r \<longrightarrow> (\<exists>z. <y',z>: r^+ \<and> \<langle>y,z\<rangle>: r)"
     unfolding diamond_def
   apply (erule trancl_induct)
    apply (blast intro: r_into_trancl)
   apply clarify
   apply (drule spec [THEN mp], assumption)
   apply (blast intro: r_into_trancl trans_trancl [THEN transD])
   done
 
 lemma diamond_trancl: "diamond(r) \<Longrightarrow> diamond(r^+)"
   apply (simp (no_asm_simp) add: diamond_def)
   apply (rule impI [THEN allI, THEN allI])
   apply (erule trancl_induct)
    apply auto
    apply (best intro: r_into_trancl trans_trancl [THEN transD]
      dest: diamond_strip_lemmaD)+
   done
 
 inductive_cases Ap_E [elim!]: "p\<bullet>q \<in> comb"
 
 
 subsection \<open>Results about Contraction\<close>
 
 text \<open>
   For type checking: replaces \<^term>\<open>a \<rightarrow>\<^sup>1 b\<close> by \<open>a, b \<in>
   comb\<close>.
 \<close>
 
 lemmas contract_combE2 = contract.dom_subset [THEN subsetD, THEN SigmaE2]
   and contract_combD1 = contract.dom_subset [THEN subsetD, THEN SigmaD1]
   and contract_combD2 = contract.dom_subset [THEN subsetD, THEN SigmaD2]
 
 lemma field_contract_eq: "field(contract) = comb"
   by (blast intro: contract.K elim!: contract_combE2)
 
 lemmas reduction_refl =
   field_contract_eq [THEN equalityD2, THEN subsetD, THEN rtrancl_refl]
 
 lemmas rtrancl_into_rtrancl2 =
   r_into_rtrancl [THEN trans_rtrancl [THEN transD]]
 
 declare reduction_refl [intro!] contract.K [intro!] contract.S [intro!]
 
 lemmas reduction_rls =
   contract.K [THEN rtrancl_into_rtrancl2]
   contract.S [THEN rtrancl_into_rtrancl2]
   contract.Ap1 [THEN rtrancl_into_rtrancl2]
   contract.Ap2 [THEN rtrancl_into_rtrancl2]
 
 lemma "p \<in> comb \<Longrightarrow> I\<bullet>p \<rightarrow> p"
   \<comment> \<open>Example only: not used\<close>
   unfolding I_def by (blast intro: reduction_rls)
 
 lemma comb_I: "I \<in> comb"
   unfolding I_def by blast
 
 
 subsection \<open>Non-contraction results\<close>
 
 text \<open>Derive a case for each combinator constructor.\<close>
 
 inductive_cases K_contractE [elim!]: "K \<rightarrow>\<^sup>1 r"
   and S_contractE [elim!]: "S \<rightarrow>\<^sup>1 r"
   and Ap_contractE [elim!]: "p\<bullet>q \<rightarrow>\<^sup>1 r"
 
 lemma I_contract_E: "I \<rightarrow>\<^sup>1 r \<Longrightarrow> P"
   by (auto simp add: I_def)
 
 lemma K1_contractD: "K\<bullet>p \<rightarrow>\<^sup>1 r \<Longrightarrow> (\<exists>q. r = K\<bullet>q \<and> p \<rightarrow>\<^sup>1 q)"
   by auto
 
 lemma Ap_reduce1: "\<lbrakk>p \<rightarrow> q;  r \<in> comb\<rbrakk> \<Longrightarrow> p\<bullet>r \<rightarrow> q\<bullet>r"
   apply (frule rtrancl_type [THEN subsetD, THEN SigmaD1])
   apply (drule field_contract_eq [THEN equalityD1, THEN subsetD])
   apply (erule rtrancl_induct)
    apply (blast intro: reduction_rls)
   apply (erule trans_rtrancl [THEN transD])
   apply (blast intro: contract_combD2 reduction_rls)
   done
 
 lemma Ap_reduce2: "\<lbrakk>p \<rightarrow> q;  r \<in> comb\<rbrakk> \<Longrightarrow> r\<bullet>p \<rightarrow> r\<bullet>q"
   apply (frule rtrancl_type [THEN subsetD, THEN SigmaD1])
   apply (drule field_contract_eq [THEN equalityD1, THEN subsetD])
   apply (erule rtrancl_induct)
    apply (blast intro: reduction_rls)
   apply (blast intro: trans_rtrancl [THEN transD] 
                       contract_combD2 reduction_rls)
   done
 
 text \<open>Counterexample to the diamond property for \<open>\<rightarrow>\<^sup>1\<close>.\<close>
 
 lemma KIII_contract1: "K\<bullet>I\<bullet>(I\<bullet>I) \<rightarrow>\<^sup>1 I"
   by (blast intro: comb_I)
 
 lemma KIII_contract2: "K\<bullet>I\<bullet>(I\<bullet>I) \<rightarrow>\<^sup>1 K\<bullet>I\<bullet>((K\<bullet>I)\<bullet>(K\<bullet>I))"
   by (unfold I_def) (blast intro: contract.intros)
 
 lemma KIII_contract3: "K\<bullet>I\<bullet>((K\<bullet>I)\<bullet>(K\<bullet>I)) \<rightarrow>\<^sup>1 I"
   by (blast intro: comb_I)
 
 lemma not_diamond_contract: "\<not> diamond(contract)"
     unfolding diamond_def
   apply (blast intro: KIII_contract1 KIII_contract2 KIII_contract3
     elim!: I_contract_E)
   done
 
 
 subsection \<open>Results about Parallel Contraction\<close>
 
 text \<open>For type checking: replaces \<open>a \<Rrightarrow>\<^sup>1 b\<close> by \<open>a, b
   \<in> comb\<close>\<close>
 lemmas parcontract_combE2 = parcontract.dom_subset [THEN subsetD, THEN SigmaE2]
   and parcontract_combD1 = parcontract.dom_subset [THEN subsetD, THEN SigmaD1]
   and parcontract_combD2 = parcontract.dom_subset [THEN subsetD, THEN SigmaD2]
 
 lemma field_parcontract_eq: "field(parcontract) = comb"
   by (blast intro: parcontract.K elim!: parcontract_combE2)
 
 text \<open>Derive a case for each combinator constructor.\<close>
 inductive_cases
       K_parcontractE [elim!]: "K \<Rrightarrow>\<^sup>1 r"
   and S_parcontractE [elim!]: "S \<Rrightarrow>\<^sup>1 r"
   and Ap_parcontractE [elim!]: "p\<bullet>q \<Rrightarrow>\<^sup>1 r"
 
 declare parcontract.intros [intro]
 
 
 subsection \<open>Basic properties of parallel contraction\<close>
 
 lemma K1_parcontractD [dest!]:
     "K\<bullet>p \<Rrightarrow>\<^sup>1 r \<Longrightarrow> (\<exists>p'. r = K\<bullet>p' \<and> p \<Rrightarrow>\<^sup>1 p')"
   by auto
 
 lemma S1_parcontractD [dest!]:
     "S\<bullet>p \<Rrightarrow>\<^sup>1 r \<Longrightarrow> (\<exists>p'. r = S\<bullet>p' \<and> p \<Rrightarrow>\<^sup>1 p')"
   by auto
 
 lemma S2_parcontractD [dest!]:
     "S\<bullet>p\<bullet>q \<Rrightarrow>\<^sup>1 r \<Longrightarrow> (\<exists>p' q'. r = S\<bullet>p'\<bullet>q' \<and> p \<Rrightarrow>\<^sup>1 p' \<and> q \<Rrightarrow>\<^sup>1 q')"
   by auto
 
 lemma diamond_parcontract: "diamond(parcontract)"
   \<comment> \<open>Church-Rosser property for parallel contraction\<close>
     unfolding diamond_def
   apply (rule impI [THEN allI, THEN allI])
   apply (erule parcontract.induct)
      apply (blast elim!: comb.free_elims  intro: parcontract_combD2)+
   done
 
 text \<open>
   \medskip Equivalence of \<^prop>\<open>p \<rightarrow> q\<close> and \<^prop>\<open>p \<Rrightarrow> q\<close>.
 \<close>
 
 lemma contract_imp_parcontract: "p\<rightarrow>\<^sup>1q \<Longrightarrow> p\<Rrightarrow>\<^sup>1q"
   by (induct set: contract) auto
 
 lemma reduce_imp_parreduce: "p\<rightarrow>q \<Longrightarrow> p\<Rrightarrow>q"
   apply (frule rtrancl_type [THEN subsetD, THEN SigmaD1])
   apply (drule field_contract_eq [THEN equalityD1, THEN subsetD])
   apply (erule rtrancl_induct)
    apply (blast intro: r_into_trancl)
   apply (blast intro: contract_imp_parcontract r_into_trancl
     trans_trancl [THEN transD])
   done
 
 lemma parcontract_imp_reduce: "p\<Rrightarrow>\<^sup>1q \<Longrightarrow> p\<rightarrow>q"
   apply (induct set: parcontract)
      apply (blast intro: reduction_rls)
     apply (blast intro: reduction_rls)
    apply (blast intro: reduction_rls)
   apply (blast intro: trans_rtrancl [THEN transD]
     Ap_reduce1 Ap_reduce2 parcontract_combD1 parcontract_combD2)
   done
 
 lemma parreduce_imp_reduce: "p\<Rrightarrow>q \<Longrightarrow> p\<rightarrow>q"
   apply (frule trancl_type [THEN subsetD, THEN SigmaD1])
   apply (drule field_parcontract_eq [THEN equalityD1, THEN subsetD])
   apply (erule trancl_induct, erule parcontract_imp_reduce)
   apply (erule trans_rtrancl [THEN transD])
   apply (erule parcontract_imp_reduce)
   done
 
 lemma parreduce_iff_reduce: "p\<Rrightarrow>q \<longleftrightarrow> p\<rightarrow>q"
   by (blast intro: parreduce_imp_reduce reduce_imp_parreduce)
 
 end
diff --git a/src/ZF/Induct/ListN.thy b/src/ZF/Induct/ListN.thy
--- a/src/ZF/Induct/ListN.thy
+++ b/src/ZF/Induct/ListN.thy
@@ -1,61 +1,61 @@
 (*  Title:      ZF/Induct/ListN.thy
     Author:     Lawrence C Paulson, Cambridge University Computer Laboratory
     Copyright   1994  University of Cambridge
 *)
 
 section \<open>Lists of n elements\<close>
 
 theory ListN imports ZF begin
 
 text \<open>
   Inductive definition of lists of \<open>n\<close> elements; see
-  @{cite "paulin-tlca"}.
+  \<^cite>\<open>"paulin-tlca"\<close>.
 \<close>
 
 consts listn :: "i\<Rightarrow>i"
 inductive
   domains "listn(A)" \<subseteq> "nat \<times> list(A)"
   intros
     NilI: "\<langle>0,Nil\<rangle> \<in> listn(A)"
     ConsI: "\<lbrakk>a \<in> A; \<langle>n,l\<rangle> \<in> listn(A)\<rbrakk> \<Longrightarrow> <succ(n), Cons(a,l)> \<in> listn(A)"
   type_intros nat_typechecks list.intros
 
 
 lemma list_into_listn: "l \<in> list(A) \<Longrightarrow> <length(l),l> \<in> listn(A)"
   by (induct set: list) (simp_all add: listn.intros)
 
 lemma listn_iff: "\<langle>n,l\<rangle> \<in> listn(A) \<longleftrightarrow> l \<in> list(A) \<and> length(l)=n"
   apply (rule iffI)
    apply (erule listn.induct)
     apply auto
   apply (blast intro: list_into_listn)
   done
 
 lemma listn_image_eq: "listn(A)``{n} = {l \<in> list(A). length(l)=n}"
   apply (rule equality_iffI)
   apply (simp add: listn_iff separation image_singleton_iff)
   done
 
 lemma listn_mono: "A \<subseteq> B \<Longrightarrow> listn(A) \<subseteq> listn(B)"
     unfolding listn.defs
   apply (rule lfp_mono)
     apply (rule listn.bnd_mono)+
   apply (assumption | rule univ_mono Sigma_mono list_mono basic_monos)+
   done
 
 lemma listn_append:
     "\<lbrakk>\<langle>n,l\<rangle> \<in> listn(A); <n',l'> \<in> listn(A)\<rbrakk> \<Longrightarrow> <n#+n', l@l'> \<in> listn(A)"
   apply (erule listn.induct)
    apply (frule listn.dom_subset [THEN subsetD])
    apply (simp_all add: listn.intros)
   done
 
 inductive_cases
       Nil_listn_case: "\<langle>i,Nil\<rangle> \<in> listn(A)"
   and Cons_listn_case: "<i,Cons(x,l)> \<in> listn(A)"
 
 inductive_cases
       zero_listn_case: "\<langle>0,l\<rangle> \<in> listn(A)"
   and succ_listn_case: "<succ(i),l> \<in> listn(A)"
 
 end
diff --git a/src/ZF/Induct/Primrec.thy b/src/ZF/Induct/Primrec.thy
--- a/src/ZF/Induct/Primrec.thy
+++ b/src/ZF/Induct/Primrec.thy
@@ -1,374 +1,374 @@
 (*  Title:      ZF/Induct/Primrec.thy
     Author:     Lawrence C Paulson, Cambridge University Computer Laboratory
     Copyright   1994  University of Cambridge
 *)
 
 section \<open>Primitive Recursive Functions: the inductive definition\<close>
 
 theory Primrec imports ZF begin
 
 text \<open>
-  Proof adopted from @{cite szasz93}.
+  Proof adopted from \<^cite>\<open>szasz93\<close>.
 
-  See also @{cite \<open>page 250, exercise 11\<close> mendelson}.
+  See also \<^cite>\<open>\<open>page 250, exercise 11\<close> in mendelson\<close>.
 \<close>
 
 
 subsection \<open>Basic definitions\<close>
 
 definition
   SC :: "i"  where
   "SC \<equiv> \<lambda>l \<in> list(nat). list_case(0, \<lambda>x xs. succ(x), l)"
 
 definition
   CONSTANT :: "i\<Rightarrow>i"  where
   "CONSTANT(k) \<equiv> \<lambda>l \<in> list(nat). k"
 
 definition
   PROJ :: "i\<Rightarrow>i"  where
   "PROJ(i) \<equiv> \<lambda>l \<in> list(nat). list_case(0, \<lambda>x xs. x, drop(i,l))"
 
 definition
   COMP :: "[i,i]\<Rightarrow>i"  where
   "COMP(g,fs) \<equiv> \<lambda>l \<in> list(nat). g ` map(\<lambda>f. f`l, fs)"
 
 definition
   PREC :: "[i,i]\<Rightarrow>i"  where
   "PREC(f,g) \<equiv>
      \<lambda>l \<in> list(nat). list_case(0,
                       \<lambda>x xs. rec(x, f`xs, \<lambda>y r. g ` Cons(r, Cons(y, xs))), l)"
   \<comment> \<open>Note that \<open>g\<close> is applied first to \<^term>\<open>PREC(f,g)`y\<close> and then to \<open>y\<close>!\<close>
 
 consts
   ACK :: "i\<Rightarrow>i"
 primrec
   "ACK(0) = SC"
   "ACK(succ(i)) = PREC (CONSTANT (ACK(i) ` [1]), COMP(ACK(i), [PROJ(0)]))"
 
 abbreviation
   ack :: "[i,i]\<Rightarrow>i" where
   "ack(x,y) \<equiv> ACK(x) ` [y]"
 
 
 text \<open>
   \medskip Useful special cases of evaluation.
 \<close>
 
 lemma SC: "\<lbrakk>x \<in> nat;  l \<in> list(nat)\<rbrakk> \<Longrightarrow> SC ` (Cons(x,l)) = succ(x)"
   by (simp add: SC_def)
 
 lemma CONSTANT: "l \<in> list(nat) \<Longrightarrow> CONSTANT(k) ` l = k"
   by (simp add: CONSTANT_def)
 
 lemma PROJ_0: "\<lbrakk>x \<in> nat;  l \<in> list(nat)\<rbrakk> \<Longrightarrow> PROJ(0) ` (Cons(x,l)) = x"
   by (simp add: PROJ_def)
 
 lemma COMP_1: "l \<in> list(nat) \<Longrightarrow> COMP(g,[f]) ` l = g` [f`l]"
   by (simp add: COMP_def)
 
 lemma PREC_0: "l \<in> list(nat) \<Longrightarrow> PREC(f,g) ` (Cons(0,l)) = f`l"
   by (simp add: PREC_def)
 
 lemma PREC_succ:
   "\<lbrakk>x \<in> nat;  l \<in> list(nat)\<rbrakk>
     \<Longrightarrow> PREC(f,g) ` (Cons(succ(x),l)) =
       g ` Cons(PREC(f,g)`(Cons(x,l)), Cons(x,l))"
   by (simp add: PREC_def)
 
 
 subsection \<open>Inductive definition of the PR functions\<close>
 
 consts
   prim_rec :: i
 
 inductive
   domains prim_rec \<subseteq> "list(nat)->nat"
   intros
     "SC \<in> prim_rec"
     "k \<in> nat \<Longrightarrow> CONSTANT(k) \<in> prim_rec"
     "i \<in> nat \<Longrightarrow> PROJ(i) \<in> prim_rec"
     "\<lbrakk>g \<in> prim_rec; fs\<in>list(prim_rec)\<rbrakk> \<Longrightarrow> COMP(g,fs) \<in> prim_rec"
     "\<lbrakk>f \<in> prim_rec; g \<in> prim_rec\<rbrakk> \<Longrightarrow> PREC(f,g) \<in> prim_rec"
   monos list_mono
   con_defs SC_def CONSTANT_def PROJ_def COMP_def PREC_def
   type_intros nat_typechecks list.intros
     lam_type list_case_type drop_type map_type
     apply_type rec_type
 
 
 lemma prim_rec_into_fun [TC]: "c \<in> prim_rec \<Longrightarrow> c \<in> list(nat) -> nat"
   by (erule subsetD [OF prim_rec.dom_subset])
 
 lemmas [TC] = apply_type [OF prim_rec_into_fun]
 
 declare prim_rec.intros [TC]
 declare nat_into_Ord [TC]
 declare rec_type [TC]
 
 lemma ACK_in_prim_rec [TC]: "i \<in> nat \<Longrightarrow> ACK(i) \<in> prim_rec"
   by (induct set: nat) simp_all
 
 lemma ack_type [TC]: "\<lbrakk>i \<in> nat;  j \<in> nat\<rbrakk> \<Longrightarrow>  ack(i,j) \<in> nat"
   by auto
 
 
 subsection \<open>Ackermann's function cases\<close>
 
 lemma ack_0: "j \<in> nat \<Longrightarrow> ack(0,j) = succ(j)"
   \<comment> \<open>PROPERTY A 1\<close>
   by (simp add: SC)
 
 lemma ack_succ_0: "ack(succ(i), 0) = ack(i,1)"
   \<comment> \<open>PROPERTY A 2\<close>
   by (simp add: CONSTANT PREC_0)
 
 lemma ack_succ_succ:
   "\<lbrakk>i\<in>nat;  j\<in>nat\<rbrakk> \<Longrightarrow> ack(succ(i), succ(j)) = ack(i, ack(succ(i), j))"
   \<comment> \<open>PROPERTY A 3\<close>
   by (simp add: CONSTANT PREC_succ COMP_1 PROJ_0)
 
 lemmas [simp] = ack_0 ack_succ_0 ack_succ_succ ack_type
   and [simp del] = ACK.simps
 
 
 lemma lt_ack2: "i \<in> nat \<Longrightarrow> j \<in> nat \<Longrightarrow> j < ack(i,j)"
   \<comment> \<open>PROPERTY A 4\<close>
   apply (induct i arbitrary: j set: nat)
    apply simp
   apply (induct_tac j)
    apply (erule_tac [2] succ_leI [THEN lt_trans1])
    apply (rule nat_0I [THEN nat_0_le, THEN lt_trans])
    apply auto
   done
 
 lemma ack_lt_ack_succ2: "\<lbrakk>i\<in>nat; j\<in>nat\<rbrakk> \<Longrightarrow> ack(i,j) < ack(i, succ(j))"
   \<comment> \<open>PROPERTY A 5-, the single-step lemma\<close>
   by (induct set: nat) (simp_all add: lt_ack2)
 
 lemma ack_lt_mono2: "\<lbrakk>j<k; i \<in> nat; k \<in> nat\<rbrakk> \<Longrightarrow> ack(i,j) < ack(i,k)"
   \<comment> \<open>PROPERTY A 5, monotonicity for \<open><\<close>\<close>
   apply (frule lt_nat_in_nat, assumption)
   apply (erule succ_lt_induct)
     apply assumption
    apply (rule_tac [2] lt_trans)
     apply (auto intro: ack_lt_ack_succ2)
   done
 
 lemma ack_le_mono2: "\<lbrakk>j\<le>k;  i\<in>nat;  k\<in>nat\<rbrakk> \<Longrightarrow> ack(i,j) \<le> ack(i,k)"
   \<comment> \<open>PROPERTY A 5', monotonicity for \<open>\<le>\<close>\<close>
   apply (rule_tac f = "\<lambda>j. ack (i,j) " in Ord_lt_mono_imp_le_mono)
      apply (assumption | rule ack_lt_mono2 ack_type [THEN nat_into_Ord])+
   done
 
 lemma ack2_le_ack1:
   "\<lbrakk>i\<in>nat;  j\<in>nat\<rbrakk> \<Longrightarrow> ack(i, succ(j)) \<le> ack(succ(i), j)"
   \<comment> \<open>PROPERTY A 6\<close>
   apply (induct_tac j)
    apply simp_all
   apply (rule ack_le_mono2)
     apply (rule lt_ack2 [THEN succ_leI, THEN le_trans])
       apply auto
   done
 
 lemma ack_lt_ack_succ1: "\<lbrakk>i \<in> nat; j \<in> nat\<rbrakk> \<Longrightarrow> ack(i,j) < ack(succ(i),j)"
   \<comment> \<open>PROPERTY A 7-, the single-step lemma\<close>
   apply (rule ack_lt_mono2 [THEN lt_trans2])
      apply (rule_tac [4] ack2_le_ack1)
       apply auto
   done
 
 lemma ack_lt_mono1: "\<lbrakk>i<j; j \<in> nat; k \<in> nat\<rbrakk> \<Longrightarrow> ack(i,k) < ack(j,k)"
   \<comment> \<open>PROPERTY A 7, monotonicity for \<open><\<close>\<close>
   apply (frule lt_nat_in_nat, assumption)
   apply (erule succ_lt_induct)
     apply assumption
    apply (rule_tac [2] lt_trans)
     apply (auto intro: ack_lt_ack_succ1)
   done
 
 lemma ack_le_mono1: "\<lbrakk>i\<le>j; j \<in> nat; k \<in> nat\<rbrakk> \<Longrightarrow> ack(i,k) \<le> ack(j,k)"
   \<comment> \<open>PROPERTY A 7', monotonicity for \<open>\<le>\<close>\<close>
   apply (rule_tac f = "\<lambda>j. ack (j,k) " in Ord_lt_mono_imp_le_mono)
      apply (assumption | rule ack_lt_mono1 ack_type [THEN nat_into_Ord])+
   done
 
 lemma ack_1: "j \<in> nat \<Longrightarrow> ack(1,j) = succ(succ(j))"
   \<comment> \<open>PROPERTY A 8\<close>
   by (induct set: nat) simp_all
 
 lemma ack_2: "j \<in> nat \<Longrightarrow> ack(succ(1),j) = succ(succ(succ(j#+j)))"
   \<comment> \<open>PROPERTY A 9\<close>
   by (induct set: nat) (simp_all add: ack_1)
 
 lemma ack_nest_bound:
   "\<lbrakk>i1 \<in> nat; i2 \<in> nat; j \<in> nat\<rbrakk>
     \<Longrightarrow> ack(i1, ack(i2,j)) < ack(succ(succ(i1#+i2)), j)"
   \<comment> \<open>PROPERTY A 10\<close>
   apply (rule lt_trans2 [OF _ ack2_le_ack1])
     apply simp
     apply (rule add_le_self [THEN ack_le_mono1, THEN lt_trans1])
        apply auto
   apply (force intro: add_le_self2 [THEN ack_lt_mono1, THEN ack_lt_mono2])
   done
 
 lemma ack_add_bound:
   "\<lbrakk>i1 \<in> nat; i2 \<in> nat; j \<in> nat\<rbrakk>
     \<Longrightarrow> ack(i1,j) #+ ack(i2,j) < ack(succ(succ(succ(succ(i1#+i2)))), j)"
   \<comment> \<open>PROPERTY A 11\<close>
   apply (rule_tac j = "ack (succ (1), ack (i1 #+ i2, j))" in lt_trans)
    apply (simp add: ack_2)
    apply (rule_tac [2] ack_nest_bound [THEN lt_trans2])
       apply (rule add_le_mono [THEN leI, THEN leI])
          apply (auto intro: add_le_self add_le_self2 ack_le_mono1)
   done
 
 lemma ack_add_bound2:
      "\<lbrakk>i < ack(k,j);  j \<in> nat;  k \<in> nat\<rbrakk>
       \<Longrightarrow> i#+j < ack(succ(succ(succ(succ(k)))), j)"
   \<comment> \<open>PROPERTY A 12.\<close>
   \<comment> \<open>Article uses existential quantifier but the ALF proof used \<^term>\<open>k#+#4\<close>.\<close>
   \<comment> \<open>Quantified version must be nested \<open>\<exists>k'. \<forall>i,j \<dots>\<close>.\<close>
   apply (rule_tac j = "ack (k,j) #+ ack (0,j) " in lt_trans)
    apply (rule_tac [2] ack_add_bound [THEN lt_trans2])
       apply (rule add_lt_mono)
          apply auto
   done
 
 
 subsection \<open>Main result\<close>
 
 declare list_add_type [simp]
 
 lemma SC_case: "l \<in> list(nat) \<Longrightarrow> SC ` l < ack(1, list_add(l))"
     unfolding SC_def
   apply (erule list.cases)
    apply (simp add: succ_iff)
   apply (simp add: ack_1 add_le_self)
   done
 
 lemma lt_ack1: "\<lbrakk>i \<in> nat; j \<in> nat\<rbrakk> \<Longrightarrow> i < ack(i,j)"
   \<comment> \<open>PROPERTY A 4'? Extra lemma needed for \<open>CONSTANT\<close> case, constant functions.\<close>
   apply (induct_tac i)
    apply (simp add: nat_0_le)
   apply (erule lt_trans1 [OF succ_leI ack_lt_ack_succ1])
    apply auto
   done
 
 lemma CONSTANT_case:
     "\<lbrakk>l \<in> list(nat);  k \<in> nat\<rbrakk> \<Longrightarrow> CONSTANT(k) ` l < ack(k, list_add(l))"
   by (simp add: CONSTANT_def lt_ack1)
 
 lemma PROJ_case [rule_format]:
     "l \<in> list(nat) \<Longrightarrow> \<forall>i \<in> nat. PROJ(i) ` l < ack(0, list_add(l))"
     unfolding PROJ_def
   apply simp
   apply (erule list.induct)
    apply (simp add: nat_0_le)
   apply simp
   apply (rule ballI)
   apply (erule_tac n = i in natE)
    apply (simp add: add_le_self)
   apply simp
   apply (erule bspec [THEN lt_trans2])
    apply (rule_tac [2] add_le_self2 [THEN succ_leI])
    apply auto
   done
 
 text \<open>
   \medskip \<open>COMP\<close> case.
 \<close>
 
 lemma COMP_map_lemma:
   "fs \<in> list({f \<in> prim_rec. \<exists>kf \<in> nat. \<forall>l \<in> list(nat). f`l < ack(kf, list_add(l))})
     \<Longrightarrow> \<exists>k \<in> nat. \<forall>l \<in> list(nat).
       list_add(map(\<lambda>f. f ` l, fs)) < ack(k, list_add(l))"
   apply (induct set: list)
    apply (rule_tac x = 0 in bexI)
     apply (simp_all add: lt_ack1 nat_0_le)
   apply clarify
   apply (rule ballI [THEN bexI])
   apply (rule add_lt_mono [THEN lt_trans])
        apply (rule_tac [5] ack_add_bound)
          apply blast
         apply auto
   done
 
 lemma COMP_case:
  "\<lbrakk>kg\<in>nat;
      \<forall>l \<in> list(nat). g`l < ack(kg, list_add(l));
      fs \<in> list({f \<in> prim_rec .
                  \<exists>kf \<in> nat. \<forall>l \<in> list(nat).
                         f`l < ack(kf, list_add(l))})\<rbrakk>
    \<Longrightarrow> \<exists>k \<in> nat. \<forall>l \<in> list(nat). COMP(g,fs)`l < ack(k, list_add(l))"
   apply (simp add: COMP_def)
   apply (frule list_CollectD)
   apply (erule COMP_map_lemma [THEN bexE])
   apply (rule ballI [THEN bexI])
    apply (erule bspec [THEN lt_trans])
     apply (rule_tac [2] lt_trans)
      apply (rule_tac [3] ack_nest_bound)
        apply (erule_tac [2] bspec [THEN ack_lt_mono2])
          apply auto
   done
 
 text \<open>
   \medskip \<open>PREC\<close> case.
 \<close>
 
 lemma PREC_case_lemma:
  "\<lbrakk>\<forall>l \<in> list(nat). f`l #+ list_add(l) < ack(kf, list_add(l));
      \<forall>l \<in> list(nat). g`l #+ list_add(l) < ack(kg, list_add(l));
      f \<in> prim_rec;  kf\<in>nat;
      g \<in> prim_rec;  kg\<in>nat;
      l \<in> list(nat)\<rbrakk>
   \<Longrightarrow> PREC(f,g)`l #+ list_add(l) < ack(succ(kf#+kg), list_add(l))"
     unfolding PREC_def
   apply (erule list.cases)
    apply (simp add: lt_trans [OF nat_le_refl lt_ack2])
   apply simp
   apply (erule ssubst)  \<comment> \<open>get rid of the needless assumption\<close>
   apply (induct_tac a)
    apply simp_all
    txt \<open>base case\<close>
    apply (rule lt_trans, erule bspec, assumption)
    apply (simp add: add_le_self [THEN ack_lt_mono1])
   txt \<open>ind step\<close>
   apply (rule succ_leI [THEN lt_trans1])
    apply (rule_tac j = "g ` ll #+ mm" for ll mm in lt_trans1)
     apply (erule_tac [2] bspec)
     apply (rule nat_le_refl [THEN add_le_mono])
        apply typecheck
    apply (simp add: add_le_self2)
    txt \<open>final part of the simplification\<close>
   apply simp
   apply (rule add_le_self2 [THEN ack_le_mono1, THEN lt_trans1])
      apply (erule_tac [4] ack_lt_mono2)
       apply auto
   done
 
 lemma PREC_case:
    "\<lbrakk>f \<in> prim_rec;  kf\<in>nat;
        g \<in> prim_rec;  kg\<in>nat;
        \<forall>l \<in> list(nat). f`l < ack(kf, list_add(l));
        \<forall>l \<in> list(nat). g`l < ack(kg, list_add(l))\<rbrakk>
     \<Longrightarrow> \<exists>k \<in> nat. \<forall>l \<in> list(nat). PREC(f,g)`l< ack(k, list_add(l))"
   apply (rule ballI [THEN bexI])
    apply (rule lt_trans1 [OF add_le_self PREC_case_lemma])
           apply typecheck
      apply (blast intro: ack_add_bound2 list_add_type)+
   done
 
 lemma ack_bounds_prim_rec:
     "f \<in> prim_rec \<Longrightarrow> \<exists>k \<in> nat. \<forall>l \<in> list(nat). f`l < ack(k, list_add(l))"
   apply (induct set: prim_rec)
   apply (auto intro: SC_case CONSTANT_case PROJ_case COMP_case PREC_case)
   done
 
 theorem ack_not_prim_rec:
     "(\<lambda>l \<in> list(nat). list_case(0, \<lambda>x xs. ack(x,x), l)) \<notin> prim_rec"
   apply (rule notI)
   apply (drule ack_bounds_prim_rec)
   apply force
   done
 
 end